Windows defender Error code: 0x80073b01

Anonymous

So yesterday I was on a site and a flash player update popped up and said that there was an update for "flash". I checked the certificate and it looked legit, so I had just clicked ask me later and then Windows Defender freaks out saying virus detected over and over. I tried clicking on the popup but nothing, then it said that windows needed to be restarted to delete a virus(or malware couldn't remember what it said). so I restarted it and i am not getting the error code. I also received an alert stating that windows could not make a backup because of a bad file or virus.

I have also reverted back to a previous backup and still the same problem.

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

Answer accepted by question author

Anonymous

stunnedjack:

If you have not resolved the problem yet, please note that a possible fix has been posted (by user bhringer) here.

You may wish to try using HitmanPro 3.7 (v3.7.5.198-Beta) with Kickstart 2.2.

A HitmanPro.Kickstart User Manual & FAQ (PDF File) is available here.

"The latest variant of ZeroAccess/Sirefef disables Microsoft Security Essentials and Windows Defender by placing a Reparse Point (Junction/Symbolic Link) on the files of these products. The result is that these antivirus products are disabled by the malware! More info can be found here at KernelMode.info."

"This BETA release of HitmanPro now detects and removes these Reparse Points so that the mentioned AV products will function again."

See original Source.

<EDITED/ADDED>

On june 3, 2013, BETA release of HitmanPro referenced above was RTM'd to final version 3.7.6 Build 201, to include improvements, fixes and "additional repairs of folders and corresponding files in Winsxs folders. In addition, ACL security is reset". See: HitmanPro Release History.

For additional information, see: HitmanPro rescues anti-virus programs from malware attack.

To download the latest version of the tool, please visit HitmanPro 3.7 with Kickstart download site.

HitmanPro.Kickstart User Manual & FAQ (Video & PDF File) is available here.

<EDITED/ADDED>

See probably related/additional information:

MMPC's Encyclopedia entry on the Win32/Sirefef malware family. Please make sure to see the 'Additional remediation steps' section in this entry for more information/additional repairs that might be needed afterwards.
Microsoft Security Advisory 2846338.

Good Luck - Please post back and tell us how it goes.

PD.- David s. cole and Footos29 might wish to give it a shot whilst still awaiting for their disks :-)

0 comments

65 additional answers

Anonymous

2013-06-16T22:10:05+00:00

It WORKED !!! I ran v3.7.6.201 , and Boom ... I've been following the thread and I can't thank you enough ALL of you for your help even if it wasn't meant directly for me, it fixed the problem..

Of course it was directed to you, same as to anyone else affected by this issue. We're glad you made it but you're not done yet :) Time to provide some feedback (same as requested from others above): Are you able to post your logs? You should find it at *C:\Users\All Users\AppData\HitmanPro\Logs* and the file shall be identified as HitmanPro_[DATE]_[TIME].log. Please post the one you ran the very first time. Thanks in advance.

Thank you RickCP, Hitman worked for me too. Although I'm not Jennifer, I thought I would contribute so that people like me might find it useful. I've had a similar problem with Windows Defender; two days ago, while I was working on this laptop, a message popped up saying that Windows Defender detected a malware and is working to get rid of it. And then after a second, it popped up "An error has occurred during initialization. If this problem continues, please contact your system administrator.

Error code: 0x80073b01". Windows Defender wouldn't start at all.

I tried system restoration with no success, and wondered if I needed to buy a new Windows 8 pro disc - I haven't got one because this laptop came with it already installed.

So I found this thread, tried the Hitman program, and WD is back! Here is the log (first and last, at this point):

[code]

HitmanPro 3.7.6.201

www.hitmanpro.com

   Computer name . . . . : [my name]

   Windows . . . . . . . : 6.2.0.9200.X64/4

   User name . . . . . . : [my PC name]

   UAC . . . . . . . . . : Enabled

   License . . . . . . . : Free

   Scan date . . . . . . : 2013-06-16 22:30:10

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 1m 44s

   Disk access mode . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot . . . . . . . : No

   Threats . . . . . . . : 0

   Traces . . . . . . . : 1159

   Objects scanned . . . : 1,493,425

   Files scanned . . . . : 36,778

   Remnants scanned . . : 407,840 files / 1,048,807 keys

Repairs _____________________________________________________________________

   Redirection: en-GB -> c:\windows\system32\config

   Disables Windows Defender (C:\Program Files\Windows Defender)

   Redirection: en-US -> c:\windows\system32\config

   Disables Windows Defender (C:\Program Files\Windows Defender)

   Redirection: ja-JP -> c:\windows\system32\config

   Disables Windows Defender (C:\Program Files\Windows Defender)

Cookies _____________________________________________________________________

   C:\Users[my PC name]\AppData\Roaming\Microsoft\Windows\Cookies\EWKN96MN.txt

   C:\Users[my PC name]\AppData\Roaming\Microsoft\Windows\Cookies\G51OMR6B.txt

   C:\Users[my PC name]\AppData\Roaming\Microsoft\Windows\Cookies\HN1B9KMN.txt

   C:\Users[my PC name]\AppData\Roaming\Microsoft\Windows\Cookies\IXW60I51.txt

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:ad.dmm.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:ad.yieldmanager.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:ads.us.e-planning.net

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:adserver.twitpic.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:adtech.de

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:advertising.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:apmebf.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:ar.atwola.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:at.atwola.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:atdmt.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:atwola.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:c1.atdmt.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:casalemedia.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:dmm.112.2o7.net

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:doubleclick.net

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:invitemedia.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:kakakucom.112.2o7.net

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:media6degrees.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:mediaplex.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:questionmarket.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:revsci.net

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:ru4.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:serving-sys.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:statse.webtrendslive.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:tacoda.at.atwola.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:www.googleadservices.com

   C:\Users[my PC name]\AppData\Roaming\Mozilla\Firefox\Profiles\ug1w7foc.default\cookies.sqlite:www.sexpixbox.com

[/code]

That's it.

I thought I would find a few malware stuff as "Threats", but none appeared, although there are some dodgy-looking cookies (embarrassing!). I'm wondering if this PC is now clean and safe...I'm running a full WD scan now. I'll try running some other virus/malware detection programs too.
Was this answer helpful?

0 comments No comments
Anonymous

2013-06-06T21:05:18+00:00

Hi, I can't find the log anywhere.. I can't imagine I deleted it, I wouldn't have know to do it or even where to look for it.. I will keep looking in my files to see if it's hidden somehow.
Was this answer helpful?

0 comments No comments
bhringer-9380 4,350 Reputation points Volunteer Moderator

2013-06-06T16:11:44+00:00

David,

Thanks for the log, much appreciated.

Hope all is well.

bhringer
Was this answer helpful?

0 comments No comments
bhringer-9380 4,350 Reputation points Volunteer Moderator

2013-06-06T16:07:37+00:00

Jennifer,

Thanks for the log. Would still be interestd in seeing the first one if you locate it.

Your help and feedback is apprecited. Hope all is well.

bhringer
Was this answer helpful?

0 comments No comments