Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Yesterday I visited some web site, and apparently got infected via some Flash exploit. Microsoft Security essentials immediately kicked in, and displayed a warning about four items:

> Trojan:Win64/Sirefef.B 
> DDoS:Win32/Fareit.gen!A 
> Rogue:Win32/FakeRean
> PWS:Win32/Karagany.A

I deleted them, and thought Security Essentials caught the infection before it did any harm. However, today I discovered that Windows Firewall service disappeared completely, I cannot visit Firewall in the Control Panel, "Base Filtering Engine" service is marked as disabled. Looked in the Process Explorer, didn't see anything suspicious. Additional antivirus scans didn't turn up anything.

Questions:

  • How can I return my firewall back to its life?
  • What else these viruses break, so I can check if I'm affected?

I know the best course of action is to re-install Windows or restore from backup. I would like to know if there is any other option...

share|improve this question
    
I would say your first step should be to install some sort of 3rd party firewall, before you get burned further. Also, check for a file named "wpbt0.dll", and disable that if present. –  Daniel R Hicks Feb 3 '12 at 18:19
    
Tough call, it can take a long time to get it back right again, with the things they will have turned off. On XP I would do what I call a "Lapped install". that is where you re-install on top of without format. this resets the "system" without doing to much damage to the users settings and changes, a super duper SFC scan kind of thing. In windows 7 I have only heard of this process one time, and never attempted it. –  Psycogeek Feb 3 '12 at 19:51
    
I would probably start by Trying :-) to reset everything. SFC scan, then turning services back on using a registry import, various virus tools like combofix can do some of that, but in the case of combofix it also makes other changes that I did not want , even though they might be more secure. There are many registry imports on the web, that "fix" certian items. I know in the end I am going to be returning my "image backup" or reinstalling because of "unknowns" even if I learn something along the way. –  Psycogeek Feb 3 '12 at 19:56
add comment

4 Answers

up vote 6 down vote accepted

You should probably run Malware Bytes or SpyBot S&D to make sure there isn't anything else (malware/spyware/adware) messing with your system. A free online scan at eSet just to make sure its all gone might be a good idea.

Once you know the system is clean, open an elevated command prompt and run SFC /SCANNOW to run the System File Check. When it is done, reboot and see if your firewall service is back.

If SFC doesn't work you can try this diagnostic from Microsoft.

share|improve this answer
2  
+1 I knew that windows could restore system files but wasn't sure of how. Learned something new today. –  Evan Plaice Feb 3 '12 at 20:08
    
The diagnostic tool is not ready yet for windows 8. Is there another workaround ? –  Larry Sep 11 '13 at 9:16
    
@Laurent This question and answer is specific to Windows 7. Here is not the best place to ask a question. You may want to search for Windows 8 firewall issues or post your own question to get specific help. –  CharlieRB Sep 11 '13 at 19:57
    
@CharlieRB, yes you are right. Meanwhile I found an tool that fixes this for both systems: it's on tweaking.com "Windows repair all in one". I has worked fine for my firewall. –  Larry Sep 15 '13 at 19:15
add comment

Method 1: Call the "Setup API InstallHinfSection" function to install Windows Firewall To install Windows Firewall, follow these steps:

Click Start, click Run, type cmd, and then click OK.
At the command prompt, type the following command line, and then press ENTER:
Rundll32 setupapi,InstallHinfSection Ndi-Steelhead 132 %windir%\inf\netrass.inf
Restart Windows,
Click Start, click Run, type cmd, and then click OK.
At the command prompt, type the following command, and then press ENTER:
Netsh firewall reset
Click Start, click Run, type firewall.cpl, and then press ENTER. In the Windows Firewall dialog box, click On (recommended), and then click OK.

Method 2: Add the Windows Firewall entry to the registry Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: 322756 How to back up and restore the registry in Windows

To add the Windows Firewall entry to the registry, follow these steps:

Copy the following text into Notepad, and then save the file as Sharedaccess.reg:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"DependOnGroup"=hex(7):00,00
"DependOnService"=hex(7):4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,57,00,69,00,\
  6e,00,4d,00,67,00,6d,00,74,00,00,00,00,00
"Description"="Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network."
"DisplayName"="Windows Firewall/Internet Connection Sharing (ICS)"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
"Epoch"=dword:00002cd0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
  00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  69,00,70,00,6e,00,61,00,74,00,68,00,6c,00,70,00,2e,00,64,00,6c,00,6c,00,00,\
  00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"All"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum]
"0"="Root\\LEGACY_SHAREDACCESS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Double-click Sharedaccess.reg to merge the contents of this file into the registry and to create the Windows Firewall entry.
Restart Windows.
Click Start, click Run, type cmd, and then click OK.
At the command prompt, type the following command, and then press ENTER:
Netsh firewall reset
Click Start, click Run, type firewall.cpl, and then click OK.
Configure the Windows Firewall settings that you want to use.

If these methods do not work, reinstall Windows XP SP2.

share|improve this answer
add comment

After successful removal of the above mentioned viruses if you find Windows Firewall not working with some 800 error. Then chances are that dependences like BFE, sharedaccess would have been deleted or corrupted along with firewall service.

Service can be rebuilt after downloading from a reliable source, for which I trust Bleeping Computer. After rebuilding the services they might not start and throw errors like access denied. For that you should go to hkey_local_machine\system\currentcontrolset\services\bfe & sharedaccess and add permission to the specified user.

Alternately you could go to Firewall will not start on Windows 7.

share|improve this answer
add comment

I would not restore or reinstall just yet. You should be able to run the Malicious Software tool and go from there depending on the results. If it returns empty then go back to MS and look for a .MSC plugin for Firewall.

You want to make sure you have removed everything, it may be you just need to remove the virus/malicious code and restore Firewall.

share|improve this answer
1  
Question is, how to restore the firewall? Service is missing, msc snap-in wouldn't open (error 0x6D9)... –  haimg Feb 3 '12 at 18:04
    
If you are sure the system is clean, Run the System File Checker, at the command prompt type: sfc /scannow (space between c and /) and hit the enter key. When its done scanning and produces a report, restart see if the firewall service is back. –  Moab Feb 3 '12 at 21:17
add comment

protected by Community Jun 20 '13 at 4:10

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.