Critical Issues with Norton After Update

[AP_Dru]

Issue abstract:
After updating Norton 360 Premium to the latest version (24.11.9615), I am experiencing several issues affecting the firewall, Windows notifications, and product reinstallation.

Detailed description:
Since upgrading to the current version of Norton 360 Premium, I have encountered the following problems:

1. Windows firewall notifications:
   Windows continuously shows the message: “Windows Firewall and Norton 360 are both turned off,” even though Windows Security indicates “No actions needed.”
2. Smart Firewall cannot be disabled:
   When I try to turn off the Smart Firewall from the Norton interface and confirm the action, nothing happens – the firewall remains active.
3. Error during repair/reinstallation:
   Attempts to repair or reinstall Norton result in the following error:
   4.“Problems found. We ran into some issues installing Norton 360 and couldn’t complete it successfully. The application may still function…”*
4. Firewall status in Windows Security:
   The Firewall & Network Protection section in Windows Security no longer displays a secure (green) status.
5. Windows Store issues:
   I am unable to install apps, with the error: Code: 0x80073D0A, which appears to be firewall-related.
6. Threats detected by Windows Security:

• Trojan:Win32/MpTamperSrvDisableAV.D
• VirTool:Win32/DefenderTamperingRestore DisableAntiSpyware
  Affected item:
• CmdLine C:\Windows\System32\sc.exe stop windefend

What happened when I contacted Norton support:
A support representative attempted to reinstall Norton via remote assistance, but during the process, my internet connection was completely lost. The errors displayed were:

• “Network doesn’t have a valid IP configuration”
• “The default gateway is not available.”

I spent over 5 hours trying to restore the internet connection by resetting settings, using CMD commands, and manually configuring IP/DNS. The only solution was performing a system restore from a backup image, which caused me to lose important files from my Desktop.

Product & version number:
Norton 360 Premium, version 24.11.9615 (build 24.11.9615.889)

OS details:
Windows 10

What is the error message you are seeing?

• “Windows Firewall and Norton 360 are both turned off”
• “Problems found. We ran into some issues installing Norton 360 and couldn’t complete it successfully.”
• Code: 0x80073D0A

Requests:

• Tested solutions to resolve these issues without requiring a Windows reinstall or Norton uninstallation.
• Clarification on the malfunctioning behavior of the firewall and Windows notifications.

Thank you in advance for any assistance!

Screenshots:

[bjm]

VirTool:Win32/DefenderTamperingRestore
Microsoft added the Tamper Protection service to one of the newer updates to Windows 10 a while back. It is designed to help keep malware or other security products from disabling Windows Defender without properly doing so.

Microsoft added the Tamper setting in a newer version of Windows via Updates. From my understanding both malware and in some cases even legit security programs change that setting and disable it. Microsoft re-enables the Tamper Protection.

Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system.

The download links & the how-to-run-the tool are at this link at Microsoft

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break; walk away. Do not pay credence if you see some intermediate early flash messages on the screen display. The only things that count are the End result at the end of the run.
• The scan will take several hours. Leave it alone. It will remove any other remaining threats as it goes along. Take a very long break, do your normal personal errands …just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log and the log will be at C:\Windows\debug\msert.log

It is normal for the Microsoft Safety Scanner to show detections during the scan process. It is scanning for basically all bread crumbs or traces of files and registry entries that “might” be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.Microsoft added the Tamper Protection service to one of the newer updates to Windows 10 a while back. It is designed to help keep malware or other security products from disabling Windows Defender without properly doing so.

source: https://forums.malwarebytes.com/topic/293824-virtoolwin32defendertamperingrestore-question/

VirTool:Win32/DefenderTamperingRestore
“DefenderTamperingRestore” notification is usually caused if you have a third-party antivirus installed. This is because some third-party antivirus programs add the “DisableAntiSpyware” registry value to turn off Defender. But the notification is not normal when you have no third-party AV installed. The suboptimal settings could be a result of malware.

source: https://answers.microsoft.com/en-us/windows/forum/all/i-wanna-know-what/de198fd5-c38c-4b67-aa80-58135d7c4e2c

[bjm]

Hello @AP_Dru
Please post progress

[SoulAsylum]

FWIW!! The initial screenshots show Norton IS active on the system. Windows Defender Firewall will only run in a mode that Microsoft requires it to do so for Windows Updates to function correctly. There is nothing of note in the OP original post that is of concern. The OP should also review this article regarding the error code they were seeing. It is NOT related to firewall but is related to the Windows Store repository being corrupted:

https://answers.microsoft.com/en-us/windows/forum/all/0x80073d0a-error-code/08c99839-4778-40e0-ad00-a9a0da08b9a8

Additionally, if the system was infected prior to the Norton install WD would have quarantined it as the screenshots also show.

SA