Solved Windows firewall could not turn on...!!!

[vinny1008]

Hi all!
Since last couple of days I am facing trouble in enabling Windows Firewall on my machine which uses Windows 7 Ultimate x64 as the Operating System. It all started with an error that I received while using Internet Download Manager v6.11 regarding Base Filtering Engine. I googled the error and found a fix for the said problem and fixed it in no time. Just out of curiosity I read the post further and found that there could be some other services that might not be working properly, so I checked for the same and was shocked to realize that the windows firewall was not working. Its start up type was ‘automatic’ however the status showed ‘stopped’. When I tried to start the service I got following error:
Windows could not start the Windows Firewall on Local Computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service- specific error code 5.
Now I read a couple of posts and they said various things about being attacked by some malware or Trojan etc. I use Microsoft Security Essential as anti-virus and scanned the entire computer. It found more than a dozen of Trojans and some hack related viruses which it very smartly handled. I also used Malwarebyte and found at least 100 of infections. I don’t know if I did good or not, I removed them all. Then gain I tried to start the Windows Firewall service after I restarted my system, yet again it gave me the same error that it could not start. When I try to start the Firewall from Action Centre it gives me an error 0x6d9. I have tried a lot of things like fix-it by Microsoft and tried to clean up registry errors using ccleaner. But nothing seems to have worked. Please help as I am too afraid to use the internet on my affected system without firewall being enabled.

Regards,
Vinny

 

[marsmimar]

Hello Vinny and welcome to Seven Forums.

Couple of things you can try. If you have a restore point that goes back to before the initial problems, try restoring your computer to that date/time.

http://www.sevenforums.com/tutorials/700-system-restore.html

You could also see if your machine has any damaged or corrupt system files by running a system file checker scan from an elevated command prompt (option two.) If problems are found run the scan 3 times rebooting in between each scan.

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

MSE is good, but no anti-malware product is 100% effective 100% of the time. If there was such a product we'd all be using it. Here are a few more free scanning tools recommended on this Forum.

Malwarebytes

Hitman Pro

SuperAntispyware

Comodo Cleaning Essentials

Windows Defender Offline

 

[vinny1008]

Hi Marsmimar. Thanx for the reply.
Have initiated sfc/scannow will let you know the results as soon as it finishes. 3 times...

 

[Kaktussoft]

http://www.sevenforums.com/system-s...n-error-code-0x6d9-error-code-0x80070424.html
https://blogs.technet.com/b/asiasup...n-services-database-list.aspx?Redirected=true

 

[vinny1008]

Hi Kaktussoft. Already followed the steps mentioned in the links, but no success. Firewall didn't start. I am running sfc/scannow right now. will post the results as soon as its done.

 

[vinny1008]

Hi Marsmimar! Ran the sfc scannow... attaching screen shot for the result..

created a cbs file in the end.... unable to open as get error 'Access Denied'... screen shot attachedView attachment 229855

View attachment 229856

What should i do now...??

Attaching sfc result file... got to know how to read the file...
View attachment sfcdetails.txt

 

[Kaktussoft]

This seams to be the solution Repair Windows Firewall
v1.7.3
Updated the Repair Windows Firewall. It now restores the reg keys for the BFE, MPSSVC and WSCSVC services. Before it only put back the shared access service. Which in XP is all the firewall needed. But in Vista and 7 it required more services. They are now part of the repair

 

[karlsnooks]

vinny,

First lets make sure that your system is truly clean.

The only method to accomplish such is with an OFFLINE malware remover.

Malware writers are very clever, but if your Win 7 doesn't run, then the malware doen't run.

With an OFFLINE scanner, Win 7 is never started. You boot up the offline scanner from either a USB stick or a DVD. The scanner is self-sufficient and needs nothing from the win 7 on your disk.

There is such a wonder product. Here is how to use this product:

HOW TO USE MICROSOFT'S OFFLINE MALWARE REMOVER
Windows Defender Offline
· performs an offline scan of an infected PC to remove viruses, rootkits and other advanced malware.
· is a free standalone, bootable malware and virus remover from Microsoft.

Download Windows Defender Offline (about 785 kB)
You will have the choice of downloading the 32bit version (x86) or the 64 bit version (x64).
The link will help you determine whether you are running a 32 bit version or 64 bit version of Windows

NOTE!! You can download and prepare a 32 bit version using a 64 bit version of Windows
NOTE!! You can download and prepare a 64 bit version using a 32bit version of Windows.

You run the 32 bit version on a 32 bit version of Windows.
You run the 64 bit version on a 64 bit version of Windows.

The 32 bit download file name is: mssstool32.exe
The 64 bit download file name is: mssstool64.exe

For the curious, this program was originally name Microsoft Standalone System Sweeper.


INSTALLATION:
· Requires an Internet Connection.
· Insert 512 mB or larger USB stick into a usb port.
· Run the downloaded program--mssstool64.exe or mssstool32.exe
· NEXT button
· Choose the option On a USB flash drive that is not password protected
· NEXT button
· NEXT button
.
The install program will:
· format the usb stick using the NTFS format.
· download less than 230 mB.
· name the USB stick WDO_Media32 or WDO_Media64
· use less than 300 mB.

How to UPDATE the Windows Defender Offline USB stick:
· reinsert the usb stick
· run the installation program, mssstool64.exe or mssstool32.exe, again.
· the update will download less than 65 mB.

Since the malware database is sometimes updated several times in a day, always update before running.

PERFORM AN OFFLINE SCAN
Bootup your computer from the USB stick
Windows Defender Offline will automatically perform a quick scan.
After the quick scan finishes, Choose Full Scan
Select all of your drives

The initial, full scan can easily take several hours, but
Remember, your computer is being very thoroughly checked for all types of malware.

 

[shawn77]

sfc /scannow will not help you because here you are missing registry keys

Windows Firewall damaged by 'Windows 7 antivirus 2012'

 

[vinny1008]

Hey guys...
Finally got my windows firewall up and running. I don’t know if the things I do were correct but it got the job done. I was asked by my cousin to follow these steps as he also once faced the same problem. Here are the detailed steps I followed:
-> Used Malwarebytes to scan for infections and removed those which were found.
->Downloaded following file:
-> Base Filtering Engine - View attachment BFE.reg
->Windows firewall - View attachment MpsSvc.reg
->Launched the file and clicked YES at UAC prompt.
->Win+r, type regedit ---- ok
-> go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
-> Right click on BFE ---> Permission
-> Click on ADD and type EVERYONE and click OK
-> Select EVERYONE ---> Below we have permission for users.
-> Select Full Control ----> Apply ----> Ok.
-> win+r and type services.msc and click ok.
-> Search for Base Filtering Engine and double click on it. Start the service and Startup type should be Automatic.
-> Search for Windows Firewall service and follow same steps.
This resolved the issue for my cousin, but not for me.
I still got this error when I tried to start the Windows Firewall service:
Windows could not start Windows Firewall on local computer. See Event Log, if non-windows service, contact vendor, Error code 5.
Then he asked me to download a registry key:
Shared access - View attachment SharedAccess.reg
-> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess
-> Right click on SharedAccess and select Permission
-> Click on Add and type Everyone and click ok.
-> Select Everyone and below give full rights for it as we did for BFE above.
-> Start --->Services.msc ---> Find Windows Firewall and Start the service. Startup type should be Automatic.
This finally did the trick for me. I restarted my system and ran Malwarebytes again. Just to be sure, and no threat was found. I updated the Microsoft Security Essentials and now the system is working fine as before.
Thanks for all the suggestions and support friends. I really appreciate your time and efforts... Cheers...!!!

P.S : I am not sure what all important services should be present on the system in order for windows to work fine. Is there a list of such services that I can refer to?

 

[karlsnooks]

win 7 is NOT XP!

Do NOT muck around with the services.

 

[vinny1008]

win 7 is NOT XP!

Do NOT muck around with the services.

Hi Karlsnooks! I tried following your instructions before I did all this jazz that my cousin told me. But I got stuck at the booting with usb flash drive part. My system would not boot using the flash drive. I would really appreciate if you could let me know how to do this.

Regards.

 

[karlsnooks]

Need full and complete system specs:
Update your SevenForums System Specs
User CP (located on the top menu bar) |
Your Profile | Edit System Spec (left-hand column)

To gather info, use Speccy (my favorite) or SIW or System Info

In the System Manufacturer Block, enter:
Ø Manufacturer and Model OR Custom build.
Ø ADD the word laptop, desktop, netbook or tablet.
For example:
Toshiba Satellite L305D notebook.

Provide full windows version info, for example:
MS Windows 7 Ultimate SP1 64-bit

Use the “Other Info” block for Optical Reader,
Mouse, touchpad, wifi adapter, speakers, monitor, etc

Scroll down and click on SAVE CHANGES.

With Speccy, you can select with your mouse/touchpad info from the display
and paste that info into your specs.

SIW is a marvelous program, but the free version does not offer
this capability.

 

[Kaktussoft]

Maybe this is the problem(?) Do It Scared! » Blog Archive » Recover From The “win64/Sirefef.W” Virus Infection

http://blogs.technet.com/b/networki...vice-fails-to-start-registry-permissions.aspx

 

[Golden]

-> Used Malwarebytes to scan for infections and removed those which were found.

Which ones did it find?

 

[vinny1008]

-> Used Malwarebytes to scan for infections and removed those which were found.

Which ones did it find?

Trojan:Win32/Rimecud.A
Virus:Win32/Virut.gen!epo_debris
HackTool:Win32/Keygen
Trojan:Win32/piptea.E
Trojan:Win64/Sirefef.AC
Trojan:Win64/Sirefef.AA
Trojan:Win64/Sirefef.AN
Trojan:Win64/Sirefef.W
Trojan:Win64/Sirefef
Trojan:Win64/Sirefef.P
Trojan:Win64/Sirefef.AB
Worm:Win32/Autorun!inf
Virus:Win64/Sirefef.A
Are few to be named::shock:

 

[Golden]

-> Used Malwarebytes to scan for infections and removed those which were found.

Which ones did it find?

Trojan:Win32/Rimecud.A
Virus:Win32/Virut.gen!epo_debris
HackTool:Win32/Keygen
Trojan:Win32/piptea.E
Trojan:Win64/Sirefef.AC
Trojan:Win64/Sirefef.AA
Trojan:Win64/Sirefef.AN
Trojan:Win64/Sirefef.W
Trojan:Win64/Sirefef
Trojan:Win64/Sirefef.P
Trojan:Win64/Sirefef.AB
Worm:Win32/Autorun!inf
Virus:Win64/Sirefef.A
Are few to be named::shock:

Yikes..........lots of ZeroAccess, and a highly compromised system. Interesting keygen there....what did you use that for?

 

[vinny1008]

Which ones did it find?

Trojan:Win32/Rimecud.A
Virus:Win32/Virut.gen!epo_debris
HackTool:Win32/Keygen
Trojan:Win32/piptea.E
Trojan:Win64/Sirefef.AC
Trojan:Win64/Sirefef.AA
Trojan:Win64/Sirefef.AN
Trojan:Win64/Sirefef.W
Trojan:Win64/Sirefef
Trojan:Win64/Sirefef.P
Trojan:Win64/Sirefef.AB
Worm:Win32/Autorun!inf
Virus:Win64/Sirefef.A
Are few to be named::shock:

Yikes..........lots of ZeroAccess, and a highly compromised system. Interesting keygen there....what did you use that for?

Maybe it was for Mass Effect 1 PC game which I used a long time ago. I'm not sure but that was the last keygen that I ever used.

Just out of curiosity, was my system hacked or what? How do I make sure nothing like this ever happen again. I'm too scared to work on this system now as I have to work on some real important official stuff which I cannot compromise on?

 

[Golden]

Are you confident your Windows 7 installation is genuine and not the source of the malware? Would you like us to check for you?

 

[vinny1008]

Are you confident your Windows 7 installation is genuine and not the source of the malware? Would you like us to check for you?

I bought this PC from a friend of mine and he assured that the OS is GENUINE...
And moreover its been 2 years that I am using this system without any such trouble. I very recently started using Internet on this machine a couple of months ago itself. Before that I just used this to work on my office assignment and to play some games.
But if that could be the case then how can we check whether it is genuine or not???