Windows 7: Unable to start Windows Firewall

Zymus · 12 Dec 2011

I did a clean install of Windows 7 Professional x64. I installed all the usual programs (Microsoft Security Essentials, Firefox, etc).

In under a day, I was infected with a virus (the Win 7 Antivirus 2012). I believe it was a false "Update Adobe Flash Player" window that did it.

I removed it with the help of this guide, however I believe that more damage has been done, as I am unable to start the Windows Firewall (it was on before the infection).

When I try to start it via the Control Panel, it says

Quote:

Windows Firewall can't change some of your settings.
Error code 0x80070424

I used Google to find more information about this error, and the suggestions did not work. The most common set of instructions were these.

I downloaded many Malware scanners (ones provided by Microsoft, and some from third-party locations), and all of them came up negative.

I was then told to start the services manually. This involved starting the Service manager, scroll to Windows Firewall, and restart it. However, in my Service window, I didn't have a Windows Firewall service, a Base Filtering Engine service, or a Firewall Client Agent service. This didn't change anything, as I was still unable to start the Firewall.

Then, I tried starting the dependent services manually. That is, to go into the command prompt, and enter the following commands

Code:

sc config MpsSvc start= auto
sc config KeyIso start= auto
sc config BFE start= auto
sc config FwcAgent start= auto
net stop MpsSvc 
net start MpsSvc 
net stop KeyIso 
net start KeyIso 
net stop BFE 
net start BFE 
net stop FwcAgent 
net start FwcAgent
pause

This resulted in the following errors

Code:

C:\Windows\system32>sc config MpsSvc start= auto
[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.


C:\Windows\system32>sc config KeyIso start= auto
[SC] ChangeServiceConfig SUCCESS

C:\Windows\system32>sc config BFE start= auto
[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.


C:\Windows\system32>sc config FwcAgent start= auto
[SC] OpenService FAILED 1060:

The specified service does not exist as an installed service.


C:\Windows\system32>net stop MpsSvc
The service name is invalid.

More help is available by typing NET HELPMSG 2185.


C:\Windows\system32>net start MpsSvc
The service name is invalid.

More help is available by typing NET HELPMSG 2185.


C:\Windows\system32>net stop KeyIso
The CNG Key Isolation service is stopping.
The CNG Key Isolation service was stopped successfully.


C:\Windows\system32>net start KeyIso
The CNG Key Isolation service is starting.
The CNG Key Isolation service was started successfully.


C:\Windows\system32>net stop BFE
The service name is invalid.

More help is available by typing NET HELPMSG 2185.


C:\Windows\system32>net start BFE
The service name is invalid.

More help is available by typing NET HELPMSG 2185.


C:\Windows\system32>net stop FwcAgent
The service name is invalid.

More help is available by typing NET HELPMSG 2185.


C:\Windows\system32>net start FwcAgent
The service name is invalid.

More help is available by typing NET HELPMSG 2185.


C:\Windows\system32>pause
Press any key to continue . . .

I have also tried repeating all these steps in Safe Mode, and Safe Mode with a clean boot to no avail. I have also tried repairing the install, with different Windows CDs, and they all said that there was nothing wrong.

If anyone has any information on how to fix these problems, I would greatly appreciate it.

Jacee · 12 Dec 2011

Try the commands listed here:
Error code 0x80070422 Can't turn on firewall - Microsoft Answers

This may be a problem with Bits or if you are connected to a Domain

Zymus · 12 Dec 2011

Doing the steps in the link you posted resulted in the following errors

Code:

C:\Windows\system32>sc config wuauserv start= auto
[SC] ChangeServiceConfig SUCCESS

C:\Windows\system32>sc config bits start= auto
[SC] ChangeServiceConfig SUCCESS

C:\Windows\system32>sc config DcomLaunch start= auto
[SC] OpenService FAILED 5:

Access is denied.


C:\Windows\system32>net stop wuauserv
The Windows Update service is stopping.
The Windows Update service was stopped successfully.


C:\Windows\system32>net start wuauserv
The Windows Update service is starting.
The Windows Update service was started successfully.


C:\Windows\system32>net stop bits
The Background Intelligent Transfer Service service is not started.

More help is available by typing NET HELPMSG 3521.


C:\Windows\system32>net start bits
The Background Intelligent Transfer Service service is starting.
The Background Intelligent Transfer Service service was started successfully.


C:\Windows\system32>net start DcomLaunch
The requested service has already been started.

More help is available by typing NET HELPMSG 2182.


C:\Windows\system32>pause
Press any key to continue . . .

I am still unable to start the Firewall, and the services still aren't showing up in the Service window.

Jacee · 13 Dec 2011

Did you do the 'clean' install after you were infected, or before you got infected? I'm not clear on this.

Zymus · 13 Dec 2011

Quote: Originally Posted by Jacee

Did you do the 'clean' install after you were infected, or before you got infected? I'm not clear on this.

By "clean" install, I mean that I wiped the hard drive, and reinstalled windows.

Originally, I had Windows 7 and Debian on one hard drive. I rarely used Debian, and my younger brother was using the computer, and so I thought that I might as well have only Windows on the hard drive. I was infected (with the Windows 7 Antivirus 2012 virus), and so decided that it was as good a time as any to do a clean install.

After reinstalling Windows 7, I installed the usual programs, had the Adobe Flash Updater show up twice, and after that I was infected.

So basically
Clean -> Infected -> Reinstall -> Clean -> Infected

Jacee · 13 Dec 2011

Download Security Check by screen317 from
http://screen317.spywareinfoforum.org/SecurityCheck.exe
or http://screen317.changelog.fr/SecurityCheck.exe
Save it to your Desktop.
Right click SecurityCheck.exe (to run as Administrator) and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Zymus · 13 Dec 2011

Results of screen317's Security Check version 0.99.28
Windows 7 x64 (UAC is enabled)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Adobe Flash Player 11.1.102.55
Adobe Reader X (10.1.1)
Mozilla Firefox (8.0.1)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
Microsoft Security Client Antimalware MsMpEng.exe
Microsoft Security Client Antimalware NisSrv.exe
``````````End of Log````````````

Also, it was suggested in another thread to download malwarebytes and run a full scan. It reported my computer was clean.

Jacee · 14 Dec 2011

See if the netsh advfirewall firewall command works:
How to use the "netsh advfirewall firewall" context instead of the "netsh firewall" context to control Windows Firewall behavior in Windows Server 2008 and in Windows Vista

Zymus · 14 Dec 2011

I tried doing

Code:

netsh advfirewall firewall set opmode ENABLE

And it said that opmode wasn't a valid argument.

Corrine · 14 Dec 2011

Hi, Zymus.

See if the instructions at Error message 0x80070424 when you use Windows Update or Microsoft Update Web sites to install updates work. Let us know how you make out.

Windows 7: Unable to start Windows Firewall

Unable to start Windows Firewall problems?