Yes, it appears to be just that one - hopefully that was before the changes (makes sense that Windows would make a restore point before then)
I'll go ahead and restore to that restore point. Pleae let me know if I should run any of what I've run before again (like Windows Defender Offline or anything else you recommend) & repost the new results
At this point, my recommendation is:
1. Backup all data dear to your heart to an external storage device, such as USB stick or usb drive.
2. Perform a repair install:
Repair Install
Did the System Restore, but based on the look of the Action Center's Security window, it looks like it was restored to a point after I made the reg & other changes. (Instead of the one Windows Security Center Service button that was there in the past, there was a list of separate functions - see attached)
First it asked if I wanted to activate Windows Defender - when I tried an error came up (see other attached jpeg) & it defaulted to Comodo's.
Before I redo your initial recommendations, I wanted to get your advice on how to undo the registry & other steps I did - the steps all listed below. (Earlier you mentioned something about "Use Control Panel | Programs and Features | rt-click on a file to uninstall" and "The only other approach I can recommend is RevoUninstaller Pro." -- but I'm not sure what exactly I should be looking to uninstall and what to do when I find those files - a neophyte with this stuff)
Here's what I did:
Download both the registry files
http://download.bleepingcomputer.com...s/7/MpsSvc.reg
Base filtering engine
http://download.bleepingcomputer.com...ices/7/BFE.reg
Launch them and click YES when you get a UAC prompt
Restart [COLOR=#3485bd !important][COLOR=#3485bd !important]your [COLOR=#3485bd !important]PC[/COLOR][/COLOR][/COLOR]
Now,open RUN and type
regedit and click ok
go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE
Right click on it-permissions
Click on ADD and type
Everyone and click ok
Now Click on Everyone
Below you have permission for users
Select full control and click ok
Now,open RUN and type
services.msc and click ok
start base filtering engine service and then [COLOR=#3485bd !important][COLOR=#3485BD ! important]windows [COLOR=#3485BD ! important]firewall[/COLOR][/COLOR][/COLOR] service
You may also be missing security center and windows defender service
Download
Security center service
http://download.bleepingcomputer.com...s/7/wscsvc.reg
windows defender
http://download.bleepingcomputer.com.../WinDefend.reg
I'll call Microsoft first, have them read this thread/data and let me know if it's something they can fix without a reinstall. It's worth the $99 not to have to do that
First, you don't need (or really should have) more than one firewall. Second, You shouldn't have more than one active antivirus so I disagree with the recommendation to install MSE and another antivirus. Now I don't know about Comodo but some antivirus suites disable Windows firewall and possibly Windows defender. I know that MSE disables Windows defender.
Called Microsoft support - they were able to find & fix the problem without a reinstall, and run a program to remove the four registry entries I was incorrectly encouraged to install early on in this thread. They're calling back tomorrow to make sure the OS is running smoothly.
What caused my Windows Firewall and Windows Security Center to shut down (and what prevented them from starting again) were two trojans:
Trojan:Win64/Sirefef
Trojan:Win64/Sirefef.AA
I'd caution Adblock/Adblock Lite users: the plugin may stop popups, but instead the ads may flip over web pages within Firefox windows. One of them flipped over a page I had open--clicking on it by accident brought in the trojan.
The free Microsoft Safety Scanner I downloaded a few days ago said it detected 5 problems, but listed only 4 as being removed, including those two. The Microsoft rep (who, despite less-than-perfect English, was very thorough & smart) saw this on my post & said this was the problem - she said these trojans can attach to any program on the computer. While an antivirus/antimalware program may say they've been removed, remnants can remain. She said they need to be carefully deleted since it's possible a program may be deleted along with it.
I tried to call Kaspersky & have them simply look at the info I posted here to determine whether or not they could fix the problem--if they thought they could, I'd have signed on for a year. But one tech there replied to my email (similar to my first post here) by telling me what I needed to do to remove programs to install Comodo. When I pointed out this wasn't the question I asked, she replied a day later by just saying that Kaspersky and Defender wouldn't run simultaneously, ignoring the question of whether or not they could solve the root problem. When I called them, the phone rep who looked at my ReportMaker report said there was nothing that appeared to be a problem -- when I asked for a supervisor to review it, I was told only customers could talk to them (never mind that I was figuring out if I should become one).
Once the Microsoft rep told me she solved 6 of 6 similar cases without requiring a reinstall, I figured it was worth the risk, She went through folder by folder with a Microsoft program and removed the trojans from several folders. Also ran the Kaspersky TDSS Killer and ESET online scanner (which found an additional "variant of Win32/Adware.Yontoo.B application," but she said that wasn't a major issue).
I really do appreciate Karl's help. I'd also encourage any board members to question the reasoning behind any advice, and for those giving it not to take offense when someone questions it (as long as it's done politely). Both approaches will foster an environment here that's more fail safe.
Let me explain: after my initial post, I was directed to a Microsoft site with an answer that advised making registry changes--yet when I posted here that I didn't have the symptoms that fit the problem on that page, I was encouraged to make the registry changes anyway by the same "power user". Ultimately it was my fault for taking the advice--If I'd been more questioning, I wouldn't have gone along with it, and maybe without the resulting complications I would've been able to solve it with Karl or someone else for free.
Thanks again to everyone who helps on this board & runs it!
Last edited by compheadache; 19 Jul 2012 at 21:46. Reason: Microsoft Safety Scanner, not Microsoft Security Scanner - fixed
Well despite the "in a way insult" I am happy you solved the problem. I am still learning, so I made a mistake. I will accept that. Sorry for having you do registry changes. Now I learned that registry changes are never good(IMO now atleast).
Your initially directing me to a Microsoft site that solved a similar problem with the same error code was a fine thing to do, and helpful to check out whether it was ultimately the right solution or not- thanks for that.
It was only the follow-up nudging to try the solution they gave--after I said my computer didn't have the two files that matched the problem that described--that was a step too far. The lesson for us both to take from this isn't just about not making registry changes (and I had no idea about that, either)--it's making sure the problem & solution are an exact fit, since one error code can cover multiple issues with very different solutions. Also, in case it comes up in the future, I saw other posts about making registry changes that put a big warning up top first (with instructions) to backup your current registry before making changes. In any event, that part was no problem for Microsoft to fix.
Well i still feel bad for giving bad instructions. In the future i will not suggest registry changes. Way to dangourous to try and do.
Quote