Windows Firewall won't start (authorization driver problem)

[Overkill]

I just removed a fake AV from a Win7 machine, and now the firewall won't start. At first the BFE and firewall weren't showing up in services, found a forum thread fixing it, and they show up. BFE runs but the firewall doesn't; the firewall authorization driver won't start (code 24). All the necessary permissions seem to be set on the file & registry, and I've done the fixes that I found on google to no avail.

When starting the firewall service, I get a dependency error but all the listed dependencies are running.

Can you guys help me fix this?

 

[Azo]

Let us try one of the following methods:

Method 1: Press Win+R, type 'services.msc', hit enter. Sop "Windows Event Controller" service first, then mcheck if the 'Base Filtering Engine' service is started.
Now go to Start Menu and type devmgmt.msc, and open Device Manager. On the View tab and select 'Devices by connection' and put a check next to 'Show hidden devices'. Look for Windows Firewall Authorization Driver (it will have a gold gear icon). Double-click the icon and on the Driver tab, make sure the Startup type is set to 'Demand'.
Then start 'Windows Firewall' service, and check if the issue gets resolved.

Method 2: The Firewall Authorization Driver (mdsdrv.sys) is a protected windows system file. You can run the System File Checker tool and if the file is found to be corrupted, it will be replaced.
Follow these steps carefully.
Go to Start / All Programs / Accessories.
Right click the 'Command Prompt' item and select the 'Run As Administrator' option.
Click 'Continue' on the UAC prompt.
In the command window type the following command.
SFC /SCANNOW
Press ENTER.

This will take some time. The head on to Turn Windows Firewall on or off

Also when everything is sorted download and install any free antivirus program. Microsoft Security Essentials is a very good one: http://windows.microsoft.com/en-US/windows/products/security-essentials

Good Luck !

 

[Overkill]

Method 1:
I disabled WEC & BFE, the startup type on the firewall auth driver is set to demand but, as stated in the OP, will not start (code 24). When trying to start the firewall auth driver, it tells me that it cannot create a file when that file already exists. Starting windows firewall still gives the dependency error.


Method 2:
Before making the OP, I tried SFC. It found no errors. Checking again for ##its and giggles, but in the meantime I'd like to try other solutions.


--
We're trying to install SOPHOS on the machine, but the services are interfering with this.

 

[Borg 386]

This is becoming a common problem, once you get the fake AV, the firewall is disabled and hard to start. Check out this link, people have had success restoring their firewall following the directions given in it.

http://www.sevenforums.com/system-security/202166-unable-start-windows-firewall.html

 

[Overkill]

Been there and no luck. We're ready to do a system restore but REALLY want to avoid that if at all possible.

 

[Borg 386]

It's recommended that you run SFC at least 3X since it doesn't always get everything on the 1st pass.

You could also try a repair install:

http://www.sevenforums.com/tutorials/3413-repair-install.html

If you can do a system restore to 2 or 3 points past where the infection occurred, that may remedy the problem, depending on how badly the system was compromised.

 

[Overkill]

Repair install worked. Thanks!