up vote 2 down vote favorite
1
share [g+] share [fb]

Yesterday I visited some web site, and apparently got infected via some Flash exploit. Microsoft Security essentials immediately kicked in, and displayed a warning about four items:

> Trojan:Win64/Sirefef.B 
> DDoS:Win32/Fareit.gen!A 
> Rogue:Win32/FakeRean
> PWS:Win32/Karagany.A

I deleted them, and thought Security Essentials caught the infection before it did any harm. However, today I discovered that Windows Firewall service disappeared completely, I cannot visit Firewall in the Control Panel, "Base Filtering Engine" service is marked as disabled. Looked in the Process Explorer, didn't see anything suspicious. Additional antivirus scans didn't turn up anything.

Questions:

  • How can I return my firewall back to its life?
  • What else these viruses break, so I can check if I'm affected?

I know the best course of action is to re-install Windows or restore from backup. I would like to know if there is any other option...

link|improve this question
85% accept rate
I would say your first step should be to install some sort of 3rd party firewall, before you get burned further. Also, check for a file named "wpbt0.dll", and disable that if present. – DanH Feb 3 at 18:19
Tough call, it can take a long time to get it back right again, with the things they will have turned off. On XP I would do what I call a "Lapped install". that is where you re-install on top of without format. this resets the "system" without doing to much damage to the users settings and changes, a super duper SFC scan kind of thing. In windows 7 I have only heard of this process one time, and never attempted it. – Psycogeek Feb 3 at 19:51
I would probably start by Trying :-) to reset everything. SFC scan, then turning services back on using a registry import, various virus tools like combofix can do some of that, but in the case of combofix it also makes other changes that I did not want , even though they might be more secure. There are many registry imports on the web, that "fix" certian items. I know in the end I am going to be returning my "image backup" or reinstalling because of "unknowns" even if I learn something along the way. – Psycogeek Feb 3 at 19:56
feedback

2 Answers

up vote 3 down vote accepted

You should probably run Malware Bytes or SpyBot S&D to make sure there isn't anything else (malware/spyware/adware) messing with your system. A free online scan at eSet just to make sure its all gone might be a good idea.

Once you know the system is clean, open an elevated command prompt and run SFC /SCANNOW to run the System File Check. When it is done, reboot and see if your firewall service is back.

If SFC doesn't work you can try this diagnostic from Microsoft.

link|improve this answer
1  
+1 I knew that windows could restore system files but wasn't sure of how. Learned something new today. – Evan Plaice Feb 3 at 20:08
feedback
up vote 0 down vote

I would not restore or reinstall just yet. You should be able to run the Malicious Software tool and go from there depending on the results. If it returns empty then go back to MS and look for a .MSC plugin for Firewall.

You want to make sure you have removed everything, it may be you just need to remove the virus/malicious code and restore Firewall.

link|improve this answer
1  
Question is, how to restore the firewall? Service is missing, msc snap-in wouldn't open (error 0x6D9)... – haimg Feb 3 at 18:04
If you are sure the system is clean, Run the System File Checker, at the command prompt type: sfc /scannow (space between c and /) and hit the enter key. When its done scanning and produces a report, restart see if the firewall service is back. – Moab Feb 3 at 21:17
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.