Windows Firewall blocking sharing, Action Center turned off

[Kari]

Neighbor's rig. After a teenager got it totally messed up I was called to have a look.

Windows 7 Home Premium x64. MSE and Malwarebytes found some 40+ threats which I cleaned. Rescans after last reboot clean. Got a cup of coffee as thank you, came home.

Later this evening a call, neighbor told that now media sharing is not working. Went to have a look, Action Center is disabled and can't be turned on, and when Windows Firewall is enabled you can't turn sharing on. Sharing OK when Firewall is turned off.

I have gone through all services, from security services to sharing. All services running as they should be.

Gone through everything mentioned in these:
http://www.sevenforums.com/network-sharing/242945-windows-firewall-blocking-media-streaming.html
Action Center is turned off

Ideas?

Kari

 

[gregrocker]

I'd look at the Malwarebytes and MSE logs to see what was involved. Serious infection can require specialized tools and methods known to our Security specialists to remove them.

Then check if damaged System files can be repaired using SFC /SCANNOW Command, or if not a Repair Install.

It is rare however that truly serious infection can be completely cleaned up. It may save time to get a Clean Install Windows 7 or Clean Reinstall - Factory OEM Windows 7.

But I'd consult Jacee first to see what can be done for the specfic infection(s).

 

[Kari]

Thanks Greg. Too late now, almost 1 AM here, but I will check the logs tomorrow.

 

[Kari]

OK, this was really serious. Was over there now, MSE logs had a lot of entries of Sirefef, Sirefef.W and Sirefef.AB. This from Encyclopedia entry: Trojan:Win64/Sirefef.AB - Learn more about malware - Microsoft Malware Protection Center

Summary

Trojan:Win64/Sirefef.AB is a component of the Sirefef multi-platform rootkit, related to Win32/Sirefef. Sirefef is multi-component malware family that modifies search results when you search for something on the Internet and generates pay-per-click advertising revenue for its controllers. This particular component clicks on links supplied by a remote attacker to generate revenue.

Caution: Win32/Sirefef is a dangerous threat that uses advanced stealth techniques in order to hinder its detection and removal. As a consequence of being infected with this threat, you may need to repair and reconfigure some Windows security features. Please see Additional remediation steps in this entry for more information.

Nothing I did helped, Security Center impossible to turn on, all sharing and network connections dead as soon as firewall was turned on. Everything I found on the net told me it's better to restore the system.

Luckily (I thought!) I have teached my neighbors to backup, so I just asked the teenager of the house to give me the external disk with image backups. His face was shining like the sun when he revealed how clever he is: anticipating that we need to restore the system, he told he had deleted all old images yesterday evening and created a brand new image...

We had to reinstall, of course, this image from yesterday is not usable, containing all the errors of current system. I left them now to download and install Windows Updates.

Kari

 

[boohbah]

that reminds me of the fridge magnet we have that says....

" ask a teenager whilst they still know everything"