Windows defender Error code: 0x80073b01

Anonymous
2013-05-13T04:39:35+00:00

So yesterday I was on a site and a flash player update popped up and said that there was an update for "flash". I checked the certificate and it looked legit, so I had just clicked ask me later and then Windows Defender freaks out saying virus detected over and over. I tried clicking on the popup but nothing, then it said that windows needed to be restarted to delete a virus(or malware couldn't remember what it said). so I restarted it and i am not getting the error code. I also received an alert stating that windows could not make a backup because of a bad file or virus.

I have also reverted back to a previous backup and still the same problem.

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2013-05-25T16:13:08+00:00

stunnedjack:

If you have not resolved the problem yet, please note that a possible fix has been posted (by user bhringer) here.

You may wish to try using HitmanPro 3.7 (v3.7.5.198-Beta) with Kickstart 2.2.

A HitmanPro.Kickstart User Manual & FAQ (PDF File) is available here.

"The latest variant of ZeroAccess/Sirefef disables Microsoft Security Essentials and Windows Defender by placing a Reparse Point (Junction/Symbolic Link) on the files of these products. The result is that these antivirus products are disabled by the malware! More info can be found here at KernelMode.info."

"This BETA release of HitmanPro now detects and removes these Reparse Points so that the mentioned AV products will function again."

See original Source.

<EDITED/ADDED>

On june 3, 2013, BETA release of HitmanPro referenced above was RTM'd to final version 3.7.6 Build 201, to include improvements, fixes and "additional repairs of folders and corresponding files in Winsxs folders. In addition, ACL security is reset". See: HitmanPro Release History.

For additional information, see: HitmanPro rescues anti-virus programs from malware attack.

To download the latest version of the tool, please visit HitmanPro 3.7 with Kickstart download site.

HitmanPro.Kickstart User Manual & FAQ (Video & PDF File) is available here.

<EDITED/ADDED>

See probably related/additional information:

Good Luck - Please post back and tell us how it goes.

PD.- David s. cole and Footos29 might wish to give it a shot whilst still awaiting for their disks :-)

Was this answer helpful?

3 people found this answer helpful.
0 comments

65 additional answers

Sort by: Newest
Most helpful Newest Oldest
  1. Anonymous
    2013-06-17T22:17:24+00:00

    Thank you, Gaumzi. If MBAR was the only tool you used, I would be interested to see that log (the first one or the one containing the repairs) :-)

    Was this answer helpful?

    0 comments
  2. Anonymous
    2013-06-17T21:20:13+00:00

    Hi RickCP, thank you for your reply.

    I opened WD and these were all detected items:

    Exploit: Java/CVE-2013-0422 (Removed)

    Exploit: Java/CEV-2013-0431 (Removed)

    TrojanDropper:Win32/Sirefef.gen!E (Quarantined)

    TrojanDropper:Win32/Sirefef.gen!G (Quarantined)

    TrojanDropper:Win32/Sirefef.gen!E (Quarantined)

    Trojan:Win64/Sirefef.AE (Quarantined)

    Trojan:Win64/Sirefef.AE (Quarantined)

    All of them were of "severe" alert.

    I've deleted them all. Hitman didn't find anything, and I also ran AdwCleaner, and it didn't find anything either.

    Does this mean I can relax now??

    Was this answer helpful?

    0 comments
  3. Anonymous
    2013-06-17T15:31:25+00:00

    OS- WIn * 64 bit

    Had the same issue and resolved it by removing the malware using MBAR malware remover software. Thanks for the help...cheers!!

    Was this answer helpful?

    0 comments
  4. Anonymous
    2013-06-17T01:09:07+00:00

    You're welcome and many thanks for your feedback on this nasty issue.

    I thought I would find a few malware stuff as "Threats"...

    Yes, HMP is only showing the repairs it performed (plus the cookies) after the real 'culprit' (ZA/Sirefef) was (I think) detected and quarantined by WD 'before' getting disabled. Could you please take a look at your WD's History and provide as much detail as you can about the info contained therein?

    I would also suggest you run HMP one more time.

    ... although there are some dodgy-looking cookies (embarrassing!).

    These cookies may be used by some PUP/Adware programs you may like to identify and remove as well. You may wish to use a good adware remover such as AdwCleaner. Please also tell us about whatever is detected and removed by this tool.

    Again, thanks in advance for your feedback.

    Was this answer helpful?

    0 comments