Microsoft Security Essentials Error Code: 0x80070424

Cunning · Jul 1, 2012

Hello and thanks for the support.

Last night while playing an online game called Cockatice with a buddy of mine, a random song began playing. I thought it was from a website that was open, so I closed the web browser but it still played. I also closed Media player and it kept on. I looked at volume button in the lower right hand of the screen and noticed Microsoft Security Essentials (MSE) was red. I tried to start it and it gave me the message in the details: Error Code: 0x80070424.

I went to mute the sound as the song was still playing. I have Windows 7 so the output sounds are all separated and can be individually muted. I assumed the song would be coming from the main playback device, but it had it's own separate channel labeled all by itself (which made it easy to mute). I unfortunately do not remember the name, but it was something like "Nothing is here" or "Nothing special".

This creeped me out so I started running SuperAnti Spyware(SAS) and then followed up with Malwarebytes (MBAM). I got a bunch of cookies from SAS and a trojan from MBAM. I restarted my PC and MSE still wouldn't start. I restarted in safe mode and cleaned it all with both programs (SAS and MBAM) and restarting until nothing was found anymore, but when I restarted my PC, MSE was still in the red.

I did some searching online and found that I might be missing an update. I attempted to update but got an error every time. When the mist cleared it was 4am and I think I remember reading something online about my registry being corrupted and remembered a friend having a wonderful success story from you guys. Thanks for any help you can offer, and here are the files:

chaslang · Jul 2, 2012

Welcome to Major Geeks!

You have a Zero Access infection.

Please do the below so that we can boot to System Recovery Options to run a scan.

For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options from the Advanced Boot Options:

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Select US as the keyboard language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt
Click to expand...

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
Note: Replace letter e with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)

Cunning · Jul 3, 2012

I assume I was not supposed to press the 'fix' button after doing the FRST scan, though the temptation was maddening.

Here is the scan results:

Kestrel13! · Jul 8, 2012

Hello, I am Kestrel, I'll be helping you to remove malware. Chaslang is extremely busy.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Attached is fixlist.txt

Save fixlist.txt to your flash drive.

You should now have both fixlist.txt and FRST64.exe on your flash drive.

Now re-enter System Recovery Options.
Run FRST64 and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt).
Please attach this to your next message. (How to attach)

Now attempt to boot normally.

Now continue with this procedure: How to Remove TrojanOS/Alureon.A

Reboot normally. You should be able to run programs.

Run FRST like you did the first time and attach the log.

Cunning · Jul 8, 2012

Part 1/2 attachments

Cunning · Jul 8, 2012

Part 2/2

Cunning · Jul 8, 2012

Thanks for the help; I'm ready for the next step.

Kestrel13! · Jul 9, 2012

You're welcome. Run RogueKiller once more and attach the log for me to see.

Cunning · Jul 9, 2012

Here is the new rogue scan.

Kestrel13! · Jul 10, 2012

http://img805.imageshack.us/img805/9659/rktigzy.gif Fix items using RogueKiller.

Double-click RogueKiller.exe to run. (Vista/7 right-click and select Run as Administrator)
When it opens, press the Scan button
Now click the Registry tab and locate these 3 detections:

[ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\Cunning\AppData\Local\{3ed00ce9-33f8-4457-6e0c-c8a86ffb532d}\n.) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

Place a checkmark each of these items, leave the others unchecked.
Now press the Delete button.
When it is finished, there will be a log on your desktop called: RKreport[2].txt
Attach RKreport[2].txt to your next message. (How to attach)

Reboot, now run RogueKiller again and attach this message too.

Cunning · Jul 10, 2012

If this is the last stage, can I uninstall these programs (RK, Hitman, CC, etc.) and redownload Malwarebytes AntiMalware and Microsoft Security Essentials?

Here are the most recent RK files:

Cunning · Jul 10, 2012

I had a few other RK files still on the desktop when these 2 files were generated, so they were named [3] and [4] and I renamed them. I fear I named them backwards. It appears there is a time-stamp though, so no biggie right?

Kestrel13! · Jul 11, 2012

Yes if everything is now running well again you can follow final steps and remove tools/logs we used. I could see that the latest RK log was clean too.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Cunning · Jul 17, 2012

Thank you, the problem seems to have been fixed.

Kestrel13! · Jul 17, 2012

From Chas and I, you are welcome. Safe surfing!

Log in or Sign up

Microsoft Security Essentials Error Code: 0x80070424

Cunning Private E-2

Attached Files:

RKreport[1].txt

mbam-log-2012-06-06 (19-20-23).txt

MGlogs.zip

hitmanpro.xml.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Cunning Private E-2

Attached Files:

FRST.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

fixlist.txt

Cunning Private E-2

Attached Files:

FRST.txt

hitmanpro.zip

mbam-log-2012-07-08 (18-43-45).txt

MBRCheck_07.08.12_18.31.53.txt

Cunning Private E-2

Attached Files:

MGlogs.zip

RKreport[1].txt

TDSSKiller.2.7.44.0_08.07.2012_18.28.01_log.txt

Cunning Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Cunning Private E-2

Attached Files:

RKreport[1].txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Cunning Private E-2

Attached Files:

RKreport[1].txt

RKreport[2].txt

Cunning Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Cunning Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Microsoft Security Essentials Error Code: 0x80070424

Cunning Private E-2

Attached Files:

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Cunning Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Attached Files:

Cunning Private E-2

Attached Files:

Cunning Private E-2

Attached Files:

Cunning Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Cunning Private E-2

Attached Files:

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Cunning Private E-2

Attached Files:

Cunning Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Cunning Private E-2

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Useful Searches