Background: Windows 8, not a special edition. Windows Defender and Webroot are both installed and have been installed for over a month. Yesterday I got a weird error that I've never seen before that Windows Defender couldn't load because "some other antivirus" was installed. I had never seen this error before or experienced this issue and unfortunately the solutions I've searched for don't work to resolve it.
Odd behavior: I get an alert in the messaging center that suddenly virus protection is turned off - both Webroot and Windows Defender. Now, every time I start my computer, Webroot will launch, but will be unable to scan the system (the scanner loads, but scans 0 files). Note that this is all happening while I am not connected to the internet, which I default don't connect to the internet. Cisco's VPN client begin loading multiple times and tries logging in; this is not set as default to load, so I have no idea why this is suddenly loading. I uninstall the app. Next I all of the sudden see this begin to appear in Task Manager, and after a restart see it again:
Service Host: Local System (16) -Microsoft Account Sign-in Assistant -Windows Management Instrumentation -Themes -Shell Hardware Detection -Remote Desktop Configuration -System Event Notification Service -Task Scheduler -User Profile Service -Multimedia Class Scheduler -Server -IP Helper -Group Policy Client -Device Setup Manager -Certificate Propagation -Background Intelligent Transfer Service -Application Information
Remember, I'm not connected to the internet at this point, yet my computer is acting as if I am. In addition, it's very slow, even though I'm doing very little as far as application usage. Note that when I terminated some of the services listed above this, like Remote Desktop Configuration (I don't recall seeing this before this week), it starts a whole new
Service Host: Local System (16).
The problem is after a restart twice, Webroot will load, but still can't scan. After ten minutes, it still has the scanning page loaded, but can't scan any files. I don't know how much I can even trust Webroot, especially since the Windows messaging center will state later that Webroot is turned off (I didn't do this, so how did this happen).
Remember that I am not connecting to the internet at all while all of this is happening. What is going on and what can I do?
netstat -ano, I get quite a few TCP connections and UDP connections (internet is disabled). Most of these are 0.0.0.0 with various ports, like 135, 445, 27019, 49152-7. Some have 127.0.0.1 and the remaining six have [::] and then a port.
The UDP's, which are peculiar when I run further details with
netstat =a -p UDP -b show sqlbrower.exe, and SSDPSRV (svchost.exe) twice.