Windows defender Error code: 0x80073b01

Anonymous
2013-05-13T04:39:35+00:00

So yesterday I was on a site and a flash player update popped up and said that there was an update for "flash". I checked the certificate and it looked legit, so I had just clicked ask me later and then Windows Defender freaks out saying virus detected over and over. I tried clicking on the popup but nothing, then it said that windows needed to be restarted to delete a virus(or malware couldn't remember what it said). so I restarted it and i am not getting the error code. I also received an alert stating that windows could not make a backup because of a bad file or virus.

I have also reverted back to a previous backup and still the same problem.

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2013-05-25T16:13:08+00:00

stunnedjack:

If you have not resolved the problem yet, please note that a possible fix has been posted (by user bhringer) here.

You may wish to try using HitmanPro 3.7 (v3.7.5.198-Beta) with Kickstart 2.2.

A HitmanPro.Kickstart User Manual & FAQ (PDF File) is available here.

"The latest variant of ZeroAccess/Sirefef disables Microsoft Security Essentials and Windows Defender by placing a Reparse Point (Junction/Symbolic Link) on the files of these products. The result is that these antivirus products are disabled by the malware! More info can be found here at KernelMode.info."

"This BETA release of HitmanPro now detects and removes these Reparse Points so that the mentioned AV products will function again."

See original Source.

<EDITED/ADDED>

On june 3, 2013, BETA release of HitmanPro referenced above was RTM'd to final version 3.7.6 Build 201, to include improvements, fixes and "additional repairs of folders and corresponding files in Winsxs folders. In addition, ACL security is reset". See: HitmanPro Release History.

For additional information, see: HitmanPro rescues anti-virus programs from malware attack.

To download the latest version of the tool, please visit HitmanPro 3.7 with Kickstart download site.

HitmanPro.Kickstart User Manual & FAQ (Video & PDF File) is available here.

<EDITED/ADDED>

See probably related/additional information:

Good Luck - Please post back and tell us how it goes.

PD.- David s. cole and Footos29 might wish to give it a shot whilst still awaiting for their disks :-)

Was this answer helpful?

3 people found this answer helpful.
0 comments

65 additional answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Anonymous
    2013-06-01T00:09:31+00:00

    In other words, did I pop for $25 bucks yet?  :)  no not yet.

    No, no need to pay. HitmanPro offers you a free license for 30 days (if you are a home user), even when running the program from a USB flash drive.

    Also FYI, quarantining the infected file(s) will make an encrypted copy of the infection on the computer itself - not on the flash drive.

    HitmanPro automatically selects quarantine on infections that were identified by only one other security vendor in the cloud. The infection is set to delete when more vendors marked it as malware.

    You may wish to try again with the most recent beta (with improvements) v3.7.6.201 released today, and/or alternatively - MBAR Beta 1.06; both, as suggested above by user bhringer.

    Good Luck!

    In the meantime still no email from MS defender dept. with the "'advanced methods."

    Any news?

    Was this answer helpful?

    0 comments
  2. Anonymous
    2013-06-01T00:21:08+00:00

    Finally MBAR on the scene. Now this is getting interesting :)

    Unfortunately, stunnedjack nor Footos29 have not returned to this thread to provide additional feedback :(

    Was this answer helpful?

    0 comments
  3. Anonymous
    2013-06-01T03:23:08+00:00

    TO ALL...

    This IS the solution!

    Just make sure that you run the MBAR Rootkit scan TWICE! That is: run the program and let it cleanse your nasties, reboot and run it the second time and...voila! Siredef detected and deleted!

    Apparently its hiding at the $Recycle Bin folder per Log below

    Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1953505168-1953525168)...

    Done!

    Infected: c:$Recycle.Bin\S-1-5-18$c1a69442954af3e37352f355b4c20d4c\U --> [Trojan.Siredef.C]

    Infected: c:$Recycle.Bin\S-1-5-21-3273266631-3058561546-3722927689-1001$c1a69442954af3e37352f355b4c20d4c\U --> [Trojan.Siredef.C]

    Infected: c:$Recycle.Bin\S-1-5-18$c1a69442954af3e37352f355b4c20d4c\L --> [Trojan.Siredef.C]

    Infected: c:$Recycle.Bin\S-1-5-21-3273266631-3058561546-3722927689-1001$c1a69442954af3e37352f355b4c20d4c\L --> [Trojan.Siredef.C]

    Infected: c:$Recycle.Bin\S-1-5-18$c1a69442954af3e37352f355b4c20d4c --> [Trojan.Siredef.C]

    Infected: c:$Recycle.Bin\S-1-5-21-3273266631-3058561546-3722927689-1001$c1a69442954af3e37352f355b4c20d4c --> [Trojan.Siredef.C]

    Scan finished

    Creating System Restore point...

    Cleaning up...

    Executing an action fixdamage.exe...

    Success!

    Queuing an action fixdamage.exe

    Removal successful. No system shutdown is required

    Was this answer helpful?

    0 comments
  4. Anonymous
    2013-06-01T05:54:07+00:00

    Well, I can see MBAR apparently removed Sirefef successfully, but I see no mention of any ReparsePoints repairs? Can you please post the complete logs?

    Or maybe that part was really fixed by HMPK on your earlier run on May 29? Could you please also post this log? And MBAR is now only removing some remnants?

    Who knows, but... the real question would be:

    Are you confirming that WD is now enabled and working 'properly' (updating, scanning, etc..) again?

    Again, thanks for your feedback.

    Was this answer helpful?

    0 comments