Windows Firewall blocking sharing, Action Center turned off

Neighbor's rig. After a teenager got it totally messed up I was called to have a look.

Windows 7 Home Premium x64. MSE and Malwarebytes found some 40+ threats which I cleaned. Rescans after last reboot clean. Got a cup of coffee as thank you, came home.

Later this evening a call, neighbor told that now media sharing is not working. Went to have a look, Action Center is disabled and can't be turned on, and when Windows Firewall is enabled you can't turn sharing on. Sharing OK when Firewall is turned off.

I have gone through all services, from security services to sharing. All services running as they should be.

Gone through everything mentioned in these:
Windows firewall blocking media streaming
Action Center is turned off

Ideas?

Kari

Thanks Greg. Too late now, almost 1 AM here, but I will check the logs tomorrow.

OK, this was really serious. Was over there now, MSE logs had a lot of entries of Sirefef, Sirefef.W and Sirefef.AB. This from Encyclopedia entry: Trojan:Win64/Sirefef.AB - Learn more about malware - Microsoft Malware Protection Center

Summary

Trojan:Win64/Sirefef.AB is a component of the Sirefef multi-platform rootkit, related to Win32/Sirefef. Sirefef is multi-component malware family that modifies search results when you search for something on the Internet and generates pay-per-click advertising revenue for its controllers. This particular component clicks on links supplied by a remote attacker to generate revenue.

Caution: Win32/Sirefef is a dangerous threat that uses advanced stealth techniques in order to hinder its detection and removal. As a consequence of being infected with this threat, you may need to repair and reconfigure some Windows security features. Please see Additional remediation steps in this entry for more information.

Nothing I did helped, Security Center impossible to turn on, all sharing and network connections dead as soon as firewall was turned on. Everything I found on the net told me it's better to restore the system.

Luckily (I thought!) I have teached my neighbors to backup, so I just asked the teenager of the house to give me the external disk with image backups. His face was shining like the sun when he revealed how clever he is: anticipating that we need to restore the system, he told he had deleted all old images yesterday evening and created a brand new image...

We had to reinstall, of course, this image from yesterday is not usable, containing all the errors of current system. I left them now to download and install Windows Updates.

Kari

that reminds me of the fridge magnet we have that says....

" ask a teenager whilst they still know everything"