1.) After you do the clean install, go to WU. When you get there, start the procedure. It will fail, however if you look closely at the popup dialog box, it's telling you it can't validate the ActiveX control in addition to asking if you want to install and run it.
2.) Click on the Microsoft Software Publisher link at the bottom of the dialog, and force IE to install the certificate.
3.) At this point the web control should work and WU will start the scanning process.
4.) However, there's another gotcha. The first thing the scanner does is DL a cabinet file which contains information WU needs to figure out what updates you require. Of course this has to get validated as well, but the problem now is that WU doesn't give you the opportunity to ram the certificate down Windows throat like it did for the ActiveX control.
5.) Now for the part you're REALLY going to love! If you recall, the Root Certificate updates for 2K were (and still are) classified as "optional" ones. Worse, I couldn't find it when rooting through the Windows Update Catalog catacombs! So, I had to resort to doing a Google search for "Windows 2000 Root Certificate Updates". Here's the link for where I got the one I used:
Run the exe, and now WU should work on your win 2000 installation again.