Windows defender Error code: 0x80073b01

Anonymous
2013-05-13T04:39:35+00:00

So yesterday I was on a site and a flash player update popped up and said that there was an update for "flash". I checked the certificate and it looked legit, so I had just clicked ask me later and then Windows Defender freaks out saying virus detected over and over. I tried clicking on the popup but nothing, then it said that windows needed to be restarted to delete a virus(or malware couldn't remember what it said). so I restarted it and i am not getting the error code. I also received an alert stating that windows could not make a backup because of a bad file or virus.

I have also reverted back to a previous backup and still the same problem.

Windows for home | Previous Windows versions | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments
Answer accepted by question author
Anonymous
2013-05-25T16:13:08+00:00

stunnedjack:

If you have not resolved the problem yet, please note that a possible fix has been posted (by user bhringer) here.

You may wish to try using HitmanPro 3.7 (v3.7.5.198-Beta) with Kickstart 2.2.

A HitmanPro.Kickstart User Manual & FAQ (PDF File) is available here.

"The latest variant of ZeroAccess/Sirefef disables Microsoft Security Essentials and Windows Defender by placing a Reparse Point (Junction/Symbolic Link) on the files of these products. The result is that these antivirus products are disabled by the malware! More info can be found here at KernelMode.info."

"This BETA release of HitmanPro now detects and removes these Reparse Points so that the mentioned AV products will function again."

See original Source.

<EDITED/ADDED>

On june 3, 2013, BETA release of HitmanPro referenced above was RTM'd to final version 3.7.6 Build 201, to include improvements, fixes and "additional repairs of folders and corresponding files in Winsxs folders. In addition, ACL security is reset". See: HitmanPro Release History.

For additional information, see: HitmanPro rescues anti-virus programs from malware attack.

To download the latest version of the tool, please visit HitmanPro 3.7 with Kickstart download site.

HitmanPro.Kickstart User Manual & FAQ (Video & PDF File) is available here.

<EDITED/ADDED>

See probably related/additional information:

Good Luck - Please post back and tell us how it goes.

PD.- David s. cole and Footos29 might wish to give it a shot whilst still awaiting for their disks :-)

Was this answer helpful?

3 people found this answer helpful.
0 comments

65 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2013-06-20T10:07:10+00:00

    Thank you RickCP, I'm relieved...I will certainly follow the advice on other threads.

    As for the date and time of detection/action, it looks like it mostly happened on June 13th.

    The top two (Java/CVE-something) were removed on 17th after I ran Hitman which enabled WD to work again. 

    Exploit: Java/CVE-2013-0422 (Removed) June 17th 22:17

    Exploit: Java/CEV-2013-0431 (Removed) June 17th 22:16

    TrojanDropper:Win32/Sirefef.gen!E (Quarantined) June 13th 20:58

    TrojanDropper:Win32/Sirefef.gen!G (Quarantined) June 13th 20:58

    TrojanDropper:Win32/Sirefef.gen!E (Quarantined) June 13th 20:56

    Trojan:Win64/Sirefef.AE (Quarantined) June 13th 20:40

    Trojan:Win64/Sirefef.AE (Quarantined) June 13th 20:39

    Thank you very much for your help again!

    Was this answer helpful?

    0 comments
  2. Anonymous
    2013-06-20T01:11:36+00:00

    This was helpful.  I installed Hitman and it was able to find malware that was preventing Defender from starting.

    Was this answer helpful?

    0 comments
  3. Anonymous
    2013-06-17T23:39:38+00:00

    Thank you CheHorn. Meet the enemy:

    Exploit: Java/CVE-2013-0422

    Exploit: Java/CEV-2013-0431

    Trojan:Win64/Sirefef.AE

    Could you please add the detection's date/time for each one?

    Hitman didn't find anything, and I also ran AdwCleaner, and it didn't find anything either.

    Does this mean I can relax now??

    Yes, it would appear you're already done for good now. However, as a final recommendation, I would suggest you read (specially the section related to Java) and follow the 'additional recommendations' provided in this other related thread/**post** :-)

    Good Luck!

    Was this answer helpful?

    0 comments
  4. Anonymous
    2013-06-17T22:17:24+00:00

    Thank you, Gaumzi. If MBAR was the only tool you used, I would be interested to see that log (the first one or the one containing the repairs) :-)

    Was this answer helpful?

    0 comments