Windows Firewall errors 8007042c and 1068

The error message is a result of ZeroAccess disabling Microsoft Security Essentials and/or Windows Defender by placing a Reparse Point (Junction/Symbolic Link) on the files of these products.

Please use HitmanPro 64-bit version.
Downlaod > HitmanPro Download
Save to the Desktop
Double-click the downloaded file to start the program.

When HitmanPro starts, follow the prompts and click Next to scan for malicious software.
Accept the license agreement to run the program.
In the Setup prompt, select the option to do a one time scan. Uncheck everything else, and press: Next

When it finishes it will display a list of the Identified Threats (malware) or other entries found (i.e. cookies, PUPs, etc.).

Click on the Next button and select the option: Activate Free License
This begins the free 30 days trial, and removes all the Identified files from the computer.

After the entries are removed, click on the Save Log option.
Save the HitmanPro log to the Desktop.

Now, close the program, and restart the computer.

Try installing MSE once again, let us know what happens, and please post the content of the HitmanPro log in your reply.

The problem is a bear to resolve. Have seen many times where the User uninstalls MSE and opts to install another AV program. There are a few free ones available besides MSE.

Also, MSE is no longer considered a top notch AV program, however, I must qualify that, and admit that I still use it along with Malwarebytes Anti-Malware.

Normally, I don't give up easily, and can continue to look for a resolution...may find one, or may not.
Or, you can install a different AV.

Will leave the decision up to you. Either way, it is your system we are dealing with.

There are times when ZeroAccess does damage that cannot be repaired.

As far as being active in your system, in my opinion, that is not the case.

Just to confirm that this is a miscellaneous issue, and not an active case of ZA, please do the following:

Please use: Rkill
Download > http://www.bleepingcomputer.com/download/rkill/
Save to the Desktop.

Right-click on the downloaded file and select: Run As Administrator
A black DOS box briefly flashes and disappears. This is normal and indicates the tool ran successfully.

Once the scan is done, a file named Rkill.txt appears on the Desktop.

Please provide the RKill.txt in your reply.

The RKill report does not point to an active ZA...Registry OK, no malware services.

Two entries need attention:

Performing miscellaneous checks:
* ALERT: ZEROACCESS Reparse Point/Junction found!
* C:\Program Files\Microsoft Security Client\Drivers => c:\windows\system32\config\ [Dir]
* C:\Program Files\Microsoft Security Client\en-us => c:\windows\system32\config\ [Dir]

Checking Windows Service Integrity:
* PcaSvc [Missing Service]

PcaSvc = Program Compatibility Assistant Service

The PCA may not be the result of ZA damage, however, the Reparse Point/Junctions are.

Need to get a hold of the PcaSvs, so I'll get back with you tomorrow.

Thanks for your patience.

Let's see if this takes care of the reparse points rkill is reporting...

Once again, please open notepad (Start > All Programs > Accessories > Notepad)
Copy the entire contents of the code box below to Notepad. (Do not copy the word 'code')
Save it to the Desktop, where FRST is located, and name it: fixlist.txt

Code:

start
DeleteJunctionsInDirectory: C:\Program Files\Microsoft Security Client\Drivers
DeleteJunctionsInDirectory: C:\Program Files\Microsoft Security Client\en-us
end

NOTICE: This script is written specifically for this computer!!!
Running this on another computer may cause damage to the Operating System.

Now, please run FRST, and press the Fix button, just once, and wait.
When done, the tool creates a report on the Desktop called: Fixlog.txt
Please post the Fixlog.txt in your reply.


Next, please download the following file and save it to the Desktop:
(Direct links only available)
http://download.bleepingcomputer.com...s/7/PcaSvc.reg

Double-click on the PcaSvc.reg file.

A prompt appears asking if you want to merge the information contained in the file into the Registry.
Confirm the prompt to merge to your Registry.
Click: OK

Restart the computer.

On the Desktop, right-click PcaSvc.reg, and select: Delete
Also empty the Recycle Bin.


Once again press the Windows key and the R key at the same time.
In the Open area, type: services.msc

In the Services console, make sure Program Compatibility Assistant Service is there, and:
Startup Type is set to: Manual
Service Status is set to: Started


Last, run RKill once again, and post its report.

Thanks!


.