Windows defender Error code: 0x80073b01

Here's the last one I ran.. I'm having trouble finding the first scan log, but will keep looking               [code]

HitmanPro 3.7.6.201

www.hitmanpro.com

   Computer name . . . . : JENS

   Windows . . . . . . . : 6.2.0.9200.X64/4

   User name . . . . . . : JENS\Jennifer

   UAC . . . . . . . . . : Enabled

   License . . . . . . . : Free

   Scan date . . . . . . : 2013-06-01 13:17:25

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 2m 52s

   Disk access mode  . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0

   Traces  . . . . . . . : 21

   Objects scanned . . . : 1,463,047

   Files scanned . . . . : 31,810

   Remnants scanned  . . : 410,904 files / 1,020,333 keys

Repairs _____________________________________________________________________

   Redirection: en-US -> c:\windows\system32\config

   Disables Windows Defender (C:\Program Files\Windows Defender)

Cookies _____________________________________________________________________

   C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net

[/code]

Having the MBAR and HMP logs is what interests me mostly. I've assumed that all those affected had the engine update as on or about May 14 and that the vulnerability addressed didn't involve ZAccess/Sirefef. and I think the timing of some of the first reports was purely coincidental. However, I did share your thought about some action of MSE-Win Defender acting as a trigger, possibly the creation of the reparse points after the Sirefef detection. Don't expect support logs would provide much than skull cramps ;-)

Certainly not trying to be argumentative and saying your wrong, it merely is above my pay grade to prove otherwise. After reading The Wonder of Sirefef Plunder my feeling is that this is somewhat of a retaliation targeted attack.

Couple of asides. The MSE uninstall issues still require some attention, see here. The stable version of HMP 3.7.6 Build 201 should be available Monday or Tuesday, version 3.8 is scheduled for July 1st.

Edit: Removed comment regarding XP not being affected. Obviously wrong and since XP is indeed affected this would suggest that the vulnerability in the antimalware engine is not the vulnerability this infection is exploiting as the vulnerability that was addressed with the May 14th update only affected 64-bit machines at that time.

Did you note repair of reparse points/juntions by HitmanPro or MBAR? Logs would be nice.

1+

If there were none it almost seems that emptying the Recycle Bin may have been the quick fix. Maybe that was MS Support's advanced method., <large grin>

Or running HMPK or MBAR ;)

I think it might be a good idea to compare the contents of each tool's logs, and depending on which one was first ran, we might get an idea of what exactly was the cleaning done by each tool.

Further, would you think we may also get some further feedback on the issue if WD's support files were created/requested now? For instance, about the date it happened and if the 'new' engine was already installed?

On Unyclept's thread, for example, he confirmed Sirefef was quarantined "by MSE" on May 26 (a week after the engine's update) making MSE to break (first time to notice the issue).

I don't know why I still have this idea in my head...

1.- Malware was already present in users' systems some time 'before' the new engine was installed - and took advantage/exploited the vulnerability existing at the time affecting the old/vulnerable engine.

2.- The issue was triggered by the new engine upon detection (and action taken before its blockage) during RTP or otherwise scan of a crafted file.

3.- HMPK and/or MBAR cleaning labor now is only referred to the infection remnants (malware not active as it was addressed before MSE's breakage) and repairs of the junctions left behind.

I know... difficult to tell but, what you think?

It WORKED !!! I ran v3.7.6.201 , and Boom ... I've been following the thread and I can't thank you enough ALL of you for your help even if it wasn't meant directly for me, it fixed the problem..

Of course it was directed to you, same as to anyone else affected by this issue. We're glad you made it but you're not done yet :) Time to provide some feedback (same as requested from others above): Are you able to post your logs? You should find it at *C:\Users\All Users\AppData\HitmanPro\Logs* and the file shall be identified as HitmanPro_[DATE]_[TIME].log. Please post the one you ran the very first time. Thanks in advance.