Working on my son's laptop and it had some sort of virus and not group policy is not accessible, cannot turn on firewall nor update the virus software from MS. Looked at several solutions and none work. What is the skinny on what caused it and how do I fix? Thanks!
Do you remember the name of the virus?
D/L & make Windows Defender Offline on another PC that's clean & run it on the infected machine.
Windows Defender Offline
You can manually d/l the definitions for MSE here:
Install the latest Microsoft Security Essentials definition updates - Get the latest definitions - Microsoft Malware Protection Center
Another tool you could run is MS Safety Scanner
Microsoft Safety Scanner - Antivirus | Remove Spyware, Malware, Viruses Free
Did not try the Defender, but the other two options showed that there was not any virus but the gray is still there and I cannot turn on the firewall. I tried to load Zone Alarm and that shut the Internet down completely with a basic load. I think ome was called something like Im Yahoo and I forget the other one. Very exasperating!
First, completely uninstall ZoneAlarm How to Completely Uninstall Zonealarm Free Firewall: 12 steps
Type services.msc in the start search box, click on the 'services' icon ... scroll down to Windows Firewall, right click> choose Properties> in the dropdown bar, set it to Automatic, then click start.
Next, I'd like you to scan your machine with ESET OnlineScan
- Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan- Click the
button.
- For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on
to download the ESET Smart Installer. Save it to your desktop.
- Double click on the
icon on your desktop.
- Check
- Click the
button.
- Accept any security warnings from your browser.
- Check
- Push the Start button.
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, push
- Push
, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
- Push the
button.
- Push
Just updated my IOBIT malware fighter and it found FunMoods and Babylon Toolbar and cleaned them. Will reboot and see what happens.
MavMin,
You will more than likely have damage caused by the virus. It would help if you knew what the virus was.
Please do the following to see if something needs fixing:
Download: Farbar Service Scanner
Save to the Desktop
Please provide the FSS.txt in your reply.
- Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
- Press: Scan
- FSS creates a log, FSS.txt, on the Desktop.
By any chance, are you using an Internet security suite? If so, which one?
The reason for asking is that it may not be compatible with the Windows Action Center, and the program may have disabled the firewall.
Not knowing any more specifics, malware damage is probably the cause, though.
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error. Google IP is offline
Google.com is accessible.
Yahoo IP is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is OK.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.
bfe Service is not running. Checking service configuration:
The start type of bfe service is OK.
The ImagePath of bfe service is OK.
The ServiceDll of bfe service is OK.
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.
Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
Quote
