Windows Firewall Service unable to activate, SFC scan unable to work

Jorgenheim · 27 Jun 2013

Well I got a big problem.

A couple days ago I noticed network connectivity issues. Random connection drops, overall bad connection, etc. I recently had some really bad malware and I removed it, so I suspected leftover malware from the start. I went to check Windows Update to see if I missed a security update, and it wasn't even on my computer. Something removed the service completely off my computer, so I found a .reg to fix it. I then started Windows Update and found that I had 30 updates missing and updated all of them successfully.

I then decided to see what was going on with my Windows Firewall, only to find that it was also removed. Wasn't in my services or anything. So I downloaded the .reg to fix that, tried to activate the service, only to run into another roadblock that I still haven't been able to fix, an error stating

"The Windows Firewall/Internet Connection Sharing (ICS) Service on local computer started then stopped. Some services stop automatically if they are not in use by other services or programs".

Ok. So I checked my services again and I believe that some more were completely missing(Base Filtering Engine, NSI proxy Service). So to try and remedy this, I attempted an sfc /scannow in elevated cmd prompt.

Then another brick wall. I get to 59% and then I get this message

"Windows Resource Protection could not perform the requested operation".

Trustedinstaller service is turned on, so I have no idea why I'm getting this message. But I tried doing the command again, both in safe mode and windows repair. In safe mode I get the same error, and in windows repair trying to execute the command only gives me another error saying that I have to restart windows to perform the sfc because its in the process of repairing (even though it shouldn't be). I restarted again and tried to do the command in repair mode yet again only to get the same message.

My computer still operates normally, its just I really want to turn on Windows Firewall so I don't get completely destroyed by more infections. Installing Windows again is not an option, as I don't have the disc or even a working disc drive. I'm also trying to save my hard drive and don't have anything else to back it up on (I also have no money) so I'm trying to get this fixed without wiping my system.

VistaKing · 27 Jun 2013

Jorgenheim

Click here DDS

Click on Download Now button

When the download is complete . Drag the DDS program from the Downloads folder to your Desktop

Double click the DDS icon on the Desktop then click the Run button to run the tool.

Place a check next to attact.txt and click Start . When done, DDS will open two logs

DDS.txt
Attach.txt

Save two logs onto your desktop and upload them with your reply

Farbar Service Scanner

Click here

Farbar Service Scanner to DOWNLOAD

Place file into your desktop

Place a check mark next to the following options

Internet Services
Windows Firewall
System Restore
Security Center
Windows Update
Windows Defender

Press the Scan button

Farbar Service Scanner will create a log, called FSS.txt, on the Desktop. Upload the FSS.txt with your reply

Jorgenheim · 27 Jun 2013

Well it appears I'm missing some services..

VistaKing · 27 Jun 2013

AdwCleaner

Click here AdwCleaner

Click on Download Now button

Save to the Desktop

Right-click on AdwCleaner.exe and choose

Click on Delete and confirm the prompt.

Your computer will be rebooted automatically. A text file will open after the restart.

Upload the log : The log file is at C:\AdwCleaner[Sn].txt

Download Junkware Removal Toolkit

Click here Junkware Removal Tool to download

Drag the JRT.exe from the Downloads folder to your Desktop

Right click JRT.exe and choose

Once done upload the JRT.txt file

VistaKing · 27 Jun 2013

Farbar Recovery Scan Tool

64-Bit Version OS

Farbar Recovery Scan Tool x64
Drag the FRST64.exe from the Downloads folder to your Desktop
Right click on FRST64.exe and choose

When the tool opens click Yes to disclaimer.
Press Scan button.
FRST will let you know when the scan is complete and has written the FRST.txt to file

Note

The first time Farbar Recovery Scan Tool is run, it makes also another log Addition.txt

Please copy and paste both logs in your reply.(FRST.txt and Addition.txt)

Jorgenheim · 27 Jun 2013

Alright, everything attached

VistaKing · 27 Jun 2013

Download the attachment below . Save it to onto your Desktop

Open up FRST64.exe click on the FIX button. Once it has completed it will create a log called Fixlog.txt Restart your PC once complete

Note

Make sure FRST64.exe is on the desktop or the fixlog.txt will not work

Upload the Fixlog.txt with your reply.

Contents of Fixlist.txt

Code:


start
HKLM-x32\...\Winlogon: [Shell] C:\PROGRA~3\8db0.bat [x ] ()
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$a66139f1f5cd9a45b3d302c7f62391fb\n. ATTENTION! ====> ZeroAccess
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] C:\Users\Hunter\AppData\Local\Temp\seyxcpb\snwokqv\wow64.dll ATTENTION! ====> ZeroAccess
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKU\Default\...\Run: [HPADVISOR]  [x]
HKU\Default User\...\Run: [HPADVISOR]  [x]
HKU\Mcx1-HUNTER-PC\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation) <==== ATTENTION 
HKU\Mcx2-HUNTER-PC\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [343552 2009-07-13] (Microsoft Corporation) <==== ATTENTION 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Toolbar: HKLM-x32 - AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File
Handler: navnet - {AD6E5643-7B0C-46AA-95AD-9773FF2A857A} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
C:\ProgramData\uninstaller.exe
C:\Windows\SysWOW64\gaeffect.sti
C:\Windows\SysWOW64\gafilter.sti
C:\Windows\System32\.crusader
C:\ProgramData\D642.tmp
C:\ProgramData\4230.tmp
C:\Windows\Tasks\ZatisfiUpdateTaskMachineCore.job
C:\Windows\Tasks\SA.DAT
C:\Windows\Tasks\ZatisfiUpdateTaskMachineUA.job
C:\Windows\Tasks\HPCeeScheduleForHunter.job
C:\Users\Hunter\msconfig.exe
C:\Users\Hunter\windowsupdate.exe
C:\ProgramData\8db0.bat
C:\ProgramData\8db0.pad
C:\ProgramData\8db0.reg
C:\ProgramData\hash.dat
C:\$Recycle.Bin\S-1-5-18\$a66139f1f5cd9a45b3d302c7f62391fb
C:\$Recycle.Bin\S-1-5-18\$a66139f1f5cd9a45b3d302c7f62391fb
C:\$Recycle.Bin\S-1-5-21-3148910470-3271661593-1142576814-1001\$a66139f1f5cd9a45b3d302c7f62391fb
C:\$Recycle.Bin\S-1-5-18\$a66139f1f5cd9a45b3d302c7f62391fb
DeleteJunctionsIndirectory: C:\Program Files\Windows Defender
end

Jorgenheim · 27 Jun 2013

Alright

VistaKing · 27 Jun 2013

Did you restart the PC ? Can you delete the old FSS.txt file and rerun the FSS.exe and upload the new FSS.txt file ?

VistaKing · 27 Jun 2013

Download Services Repair

Click here

ServiceRepair

When done . Drag the file to your desktop

Right click on ServicesRepair.exe choose

Click on Yes or Continue . Once the tool has completed it will ask you to restart . Please restart the PC .

Then run RogueKiller

RogueKiller for 32bit or RogueKiller for 64bit

Click on one of the links above that goes with your Windows 7 bit versions

Save to the Desktop.

Close all windows and browsers

Right click on

and choose Run as Administrator

Press: SCAN

provide the RKreport.txt (Mode: Scan) in your reply.