Something or someone disabled my AV and firewall

12 years ago

I noticed that my AV icon was not loaded onto the Taskbar. When I went into the Start menu and clicked on MSE, I got this message: Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item. I was naturally suspicious, so I checked my Windows Firewall, and it wasn't working, either.

I ran Malwarebytes, and it found five infected items. I deleted them and restarted the computer. Still no active AV or firewall.

I figured that a System Restore wouldn't work, but I tried it anyway and got my firewall back - so far. The AV still won't work. I am pretty sure that uninstalling MSE and installing another AV would be a waste of time, since whatever evil hyjacker bug disabled it is evidently still in my computer.

What is my next step to getting my AV back working and hopefully getting rid of the cause?

I have a Dell PC running Win7.

Dee

Sort by:Oldest

Comments (4)

grandms
12 years ago
Dee, if I were you, I would go directly over to the Landzdown forum where there are people who specialize in helping with this kind of problem.

Here is a link that might be useful: Landzdown malware removal
zep516
12 years ago
When you try to open Microsoft Security Essentials and you got the message Ã¢ÂÂWindows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.Ã¢ÂÂ then your computer is probably infected with the ZeroAccess rootkit. The new variants of this rootkit will alters the junction points for Microsoft Security Essentials and Windows Defender. Causing either program not to be able to be accessed, reinstalled or uninstalled.

The ZeroAccess rootkit is a dangerous threat that has been circulating for several years. SophosLabs has recently seen the number of machines infected with Zero Access increase sharply as there has been a proliferation of samples appearing in the wild.

You need or should to go to a Malware removal forum, where log files can be looked at, or take it in for repair, or return it to factory defaults.

I would suggest you Google Zero Access rootkit. Just to become familiar with it . This is also know as a back door Trojan. You might want to Google Backdoor Trojan.

The link I have provided shows how to remove it, but you will never understand the log files that get generated or find then difficult to understand, that's why I suggest getting help at a forum.

Here is a link that might be useful: malwareremovalguides
Related Discussions
Something's eating my AV !!!!! HELP
Q
Comments (5)
I get marks and spots quite often on my av's, since I have stopped spraying them with anything, it has stopped. I believe I used Safers once, that caused marking, and I have wet the leaves and caused markings as well......do you spray them with anything? even water? When I posted about my spots, I was told not to worry....unless I continue to see more bad signs......is anything else happening to the plant? Tracy
...See More
Firewall is not turned on message
Q
Comments (86)
it does take a little getting used to and letting the program learn, it will pop up and ask you do you want to let such and such connect to the internet you will likely know what is asking because you are trying to use something that needs access so in those cases say yes, if it is something that needs to access it regularly like your antivirus check mark where it says remember this so it does not ask each time. Do not give server rights some things will ask but it is not necessary once you say no to server rights it will next pop up asking for access, that you can allow. If it is something you do not recognize asking then say no and see if you can determine what it is, if you had some type of malware that is trying to phone home you would not want to allow that access. I prefer mine to pop up and ask each time with some of the rarely used stuff I like to know what is connecting. When getting zonealarm or any other free firewall or any program actually be very alert during the install period and uncheck or do not allow the addition of any toolbars or extras, Zone alarm unfortunately now does try to include a toolbar with the free version, you do not want that toolbar. and if you have problems or questions just ask. When something like generic win 32 something ask for permission say yes or you will not be able to connect to the internet, that is one to check mark always allow. Yes as grandms said with cable you have a direct connection and with no router in between you and the internet that even more dictates the use of a software firewall. The benefit of a router with built in hardware firewall is great but I use both on my windows machines, actually my linux has guarddog firewall built into it so I even have one on linux. The link I had provided the main reason I do refer that link is that there are such good instructions and pictures for someone new to firewalls.
...See More
'Network cable unplugged, firewalled'
Q
Comments (5)
Maybe the first thing I would do .. Go into the device manager(right click myComputer & select properties) and look for yellow exclamation or red stop errors. While there under Network Adapters you should see two adapters; One will be your wireless adapter and it probably says 802.11b/g/n and manufacturer name. The other network adapter should say something about 'Ethernet adapter and manufacturer name. Double click the Ethernet adapter and then look around for probably a check box that says something about Disable this device. I would disable that ethernet adapter because you aren't using it... that will stop that Network Cable Unplugged message,,, and might possibly be the conflict - if so you might get lucky and your wifi will connect after a reboot. Ummm, what else might you try. The Event logs in your computer management window might give you a hint what's wrong... thats accessable by right clicking myComputer and select Manage. You say you never have added hardware... hardware that would use an irq would be things like a portable hard drive, a flash memory card, anything usb, a pc-card slot device, a seperate monitor. Try unplugging things attached one by one to see if one of those might be causing the conflict. Hopefully its not your wifi card, but if after trying to eliminate the conflict and nothing else hardware wise stops the error message maybe you could disable the wifi adapter in Device Manager and then if the error message instantly goes away that would be a good indication its bumm or maybe rolling back or reinstalling the driver might fix it.
...See More
My firewall keeps reporting DOS attacks
Q
Comments (4)
Wow, that was a fast reply! Thanks RC! Now the next million dollar question..I saw a bunch of things that I'm not sure about..should I be worried about this entry I found? Thanks so much, I didn't know I could check that stuff. Here's the thing, I don't use the windows firewall (to my knowledge anyway), my antivirus software has one though. I really appreciate your help on this, I keep getting these darn attacks, one popped up when I was reading your instructions. >:( =:O A port was listed as an exception when the Windows Firewall started. Policy origin: Local Policy Profile used: Standard Interface: All interfaces Name: SSDP Component of UPnP Framework Port number: 1900 Protocol: UDP State: Disabled Scope: Local subnet only
...See More
zep516
12 years ago
" I am pretty sure that uninstalling MSE and installing another AV would be a waste of time,"

If you are able to force either Windows Defender or Microsoft Security Essentials folders and file removal Windows no longer boots normally, so donÃ¢ÂÂt try to remove Windows Defender or Microsoft Security Essentials in this case.
john_wc
12 years ago
Download and run Kasperky's TDSSKiller at the link.

This file is small and scans for rootkit infections. It is a very quick scan, a couple of minutes or so.

If you happen to have Avast loaded on your computer, also run a boot time scan.

I have cleaned many friends' machines using these two scans.

Good luck.

Here is a link that might be useful: Kaspersky TDSSKiller

Something or someone disabled my AV and firewall

Comments (4)

grandms

zep516

Related Discussions

zep516

john_wc

COMPANY

BUSINESS SERVICES

GET HELP

CONNECT WITH US