Virus deleted windows firewall service

[aelled]

Hello, i recently suffered a virus that AVG picked up on to late it infected c/windows/system32/services.exe i managed to remove it dispite many antiviruses inability to by renaming the infected file services.exe.old then restarting my computer windows replaced it and was working properly so i ran my antiviruses and downloaded afew more picked up a total of 10 infections and im no longer picking up viruses with my antiviruses (AVG free, spybot S&D, avast, malewarebytes) after all that i looked at windows firewall and found i couldn't turn it on so after more digging found its service had been deleted, more digging i managed to get its service back but i cannot start it nor can the program from windows for fixing the firewall. Please help!

 

[Golden]

Hello aelled,

I think the best thing is to perform a scan from outside the Windows environment. Please follow this tutorial in order to do that:

http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

Post the results so we can help out further.

Regards,
Golden

 

[aelled]

Thanks im working on it now and ill let you know the results asap

 

[aelled]

i keep getting a problem where it stops downloading the files with about 1.7mb to go then says there was a rpoblem downloading the required windows defender offline files what should i do? its happened 3 times now

 

[aelled]

ok so i ran windows defender offline finaly completed the download after the 4th try, iit picked up 2 trojan downloaders and 5 trojans for a total of 7 items but i cant find the log where its supposed to be any help? also i still cannot turn on windows firewall.

 

[Golden]

Hi,

Please if this post helps:

http://www.sevenforums.com/system-s...ervice-problems-automatically.html#post918234

Regards,
Golden

 

[aelled]

just ran it and the results are as follows

Windows Firewall Troubleshooter Publisher details Issues found Windows could not start Windows Firewall
Not fixed

Set permissions for the related registry keys
Succeeded

Windows Firewall service is not started
Not fixed

Start Windows Firewall service
Succeeded

Issues checked Cannot Access Shared Files and Printers
Checked

Remote Assistance is not working
Checked

Windows could not start Windows Firewall BFE service
Checked

Issues found Detection details
6
Windows could not start Windows Firewall Not fixed

On a computer that is running Windows 7 or Windows Vista, you find that the Windows Firewall service is not running. When you try to manually start the service, you receive the following error message: "Windows could not start the Windows Firewall, DHCP client, or Diagnostic Policy on Local Computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 5."

6
Windows Firewall service is not started Not fixed

Windows Firewall service is not running or is not started.


Issues checked Detection details
6
Cannot Access Shared Files and Printers Checked

You cannot access shared files and printers even though you have enabled File and Printer Sharing in Windows.

6
Remote Assistance is not working Checked

Remote Assistance is not working even though you have enabled Remote Assistance in Windows.

6
Windows could not start Windows Firewall BFE service Checked

On a computer that is running Windows 7 or Windows Vista, the Windows Firewall service is not running. When you try to manually start the service, you receive the following error message "Windows could not start the Windows Firewall, DHCP client, or Diagnostic Policy on Local Computer. For more information, review the System Event Log. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 5."

 

[aelled]

apologies it would not allow me to upload the document in its original format.

 

[Borg 386]

ok so i ran windows defender offline finaly completed the download after the 4th try, iit picked up 2 trojan downloaders and 5 trojans for a total of 7 items but i cant find the log where its supposed to be any help? also i still cannot turn on windows firewall.

The location of the log files are here.

The log files for Windows Defender Offline are stored in a MPLog-MM/DD/YYYY-HH/MM/SS .txt file in the folder below on the computer that was scanned at boot.C:\Windows\Windows Defender Offline\Support

 

[aelled]

it dosent exists on my computer i have checked twice now i can upload a screenshot but there is no Windows defender offline folder in C:\Windows on this computer could it have saved to another location? if not would running it again be any use?

 

[Borg 386]

It wouldn't hurt to run it again. It looks like whatever you have has scrambled your system files. You may have a rootkit. D/L this tool and do a scan with it & see what comes up:

Anti-rootkit utility TDSSKiller

You may want to consider a repair install:

http://www.sevenforums.com/tutorials/3413-repair-install.html

Or, start anew & do a clean install

http://www.sevenforums.com/tutorials/1649-clean-install-windows-7-a.html

 

[aelled]

at this point a clean install sounds wonderful but as i am lacking the windows 7 CD that seems out of the question, i do however have axcess to another windows 7 computer would i be able to make a windows 7 cd on it and reinstall from it? and if yes would it have to be exactly the same version of windows 7 as i have? as to the TDSSKiller its getting late so ill do it tomorrow. thanks for the help so far its making this alot less stressful.

the origional virus i found was known as Trojan horse Patched_c.LYU to AVG Free i belive i managed to remove it by renaming services.exe, services.exe.old then restarting windows repaired the problem and after a virus scan turned up alot of results i realised just how bad it was

 

[Golden]

Hi alled,

You can download the same Windows 7 version ISO from here:
Official Windows 7 SP1 ISO from Digital River « My Digital Life

Then use this tool to burn it to a 4GB USB:
Microsoft Store Online

Boot from this USB to clean install Windows 7, and use the original product key that you have to activate it.

Regards,
Golden

 

[aelled]

does it have to be a 4 GB USB, i only have a 2 and a 16?

English x86: X17-58996.iso
English x64: X17-58997.iso

out of the two which would be the right one to use or how would i be able to tell?

 

[Golden]

Hi,

Yes, unfortunately a minimum of 4GB is required, you could use the 16GB if you want - note : it will completely format the USB before installing the ISO to it! If you don't have that, just burn to a DVD as normal using this:

The Official ImgBurn Website

The x86 is 32-bit, the x64 is 64-bit. Which version do you currently have? Your product key is valid for either version.

Regards,
Golden

 

[aelled]

i have 32-bit so ill start downloading the x86, will it be safe to use this computer to do it? and the product key is that code on the microsoft sticker on the bottom of my laptop right? again thanks for the help!

 

[Golden]

Hi,

To be absolutely safe, I would do it on another known safe computer. Yes, the key is the one underneath your laptop.

Also, have a read of this which covers the steps for the clean install:

http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

Regards,
Golden