How to restore Windows Firewall after some malware deleted its service?

Question

Yesterday I visited some web site, and apparently got infected via some Flash exploit. Microsoft Security essentials immediately kicked in, and displayed a warning about four items:

> Trojan:Win64/Sirefef.B 
> DDoS:Win32/Fareit.gen!A 
> Rogue:Win32/FakeRean
> PWS:Win32/Karagany.A

I deleted them, and thought Security Essentials caught the infection before it did any harm. However, today I discovered that Windows Firewall service disappeared completely, I cannot visit Firewall in the Control Panel, "Base Filtering Engine" service is marked as disabled. Looked in the Process Explorer, didn't see anything suspicious. Additional antivirus scans didn't turn up anything.

Questions:

How can I return my firewall back to its life?
What else these viruses break, so I can check if I'm affected?

I know the best course of action is to re-install Windows or restore from backup. I would like to know if there is any other option...

I would say your first step should be to install some sort of 3rd party firewall, before you get burned further. Also, check for a file named "wpbt0.dll", and disable that if present. — Daniel R Hicks, Feb 3, 2012 at 18:19
Tough call, it can take a long time to get it back right again, with the things they will have turned off. On XP I would do what I call a "Lapped install". that is where you re-install on top of without format. this resets the "system" without doing to much damage to the users settings and changes, a super duper SFC scan kind of thing. In windows 7 I have only heard of this process one time, and never attempted it. — Psycogeek, Feb 3, 2012 at 19:51
I would probably start by Trying :-) to reset everything. SFC scan, then turning services back on using a registry import, various virus tools like combofix can do some of that, but in the case of combofix it also makes other changes that I did not want , even though they might be more secure. There are many registry imports on the web, that "fix" certian items. I know in the end I am going to be returning my "image backup" or reinstalling because of "unknowns" even if I learn something along the way. — Psycogeek, Feb 3, 2012 at 19:56

CharlieRB · Accepted Answer · 2012-02-03 19:56:44Z

6

You should probably run Malware Bytes or SpyBot S&D to make sure there isn't anything else (malware/spyware/adware) messing with your system. A free online scan at eSet just to make sure its all gone might be a good idea.

Once you know the system is clean, open an elevated command prompt and run SFC /SCANNOW to run the System File Check. When it is done, reboot and see if your firewall service is back.

If SFC doesn't work you can try this diagnostic from Microsoft.

answered Feb 3, 2012 at 19:56

CharlieRB

22.5k5 gold badges56 silver badges105 bronze badges

2

+1 I knew that windows could restore system files but wasn't sure of how. Learned something new today.
– Evan Plaice
Feb 3, 2012 at 20:08
The diagnostic tool is not ready yet for windows 8. Is there another workaround ?
– Larry
Sep 11, 2013 at 9:16
@Laurent This question and answer is specific to Windows 7. Here is not the best place to ask a question. You may want to search for Windows 8 firewall issues or post your own question to get specific help.
– CharlieRB
Sep 11, 2013 at 19:57
1

@CharlieRB, yes you are right. Meanwhile I found an tool that fixes this for both systems: it's on tweaking.com "Windows repair all in one". I has worked fine for my firewall.
– Larry
Sep 15, 2013 at 19:15

Add a comment |

Ganesh · Accepted Answer · 2012-11-24 07:54:49Z

Method 1: Call the "Setup API InstallHinfSection" function to install Windows Firewall To install Windows Firewall, follow these steps:

Click Start, click Run, type cmd, and then click OK.
At the command prompt, type the following command line, and then press ENTER:
Rundll32 setupapi,InstallHinfSection Ndi-Steelhead 132 %windir%\inf\netrass.inf
Restart Windows,
Click Start, click Run, type cmd, and then click OK.
At the command prompt, type the following command, and then press ENTER:
Netsh firewall reset
Click Start, click Run, type firewall.cpl, and then press ENTER. In the Windows Firewall dialog box, click On (recommended), and then click OK.

Method 2: Add the Windows Firewall entry to the registry Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: 322756 How to back up and restore the registry in Windows

To add the Windows Firewall entry to the registry, follow these steps:

Copy the following text into Notepad, and then save the file as Sharedaccess.reg:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"DependOnGroup"=hex(7):00,00
"DependOnService"=hex(7):4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,57,00,69,00,\
  6e,00,4d,00,67,00,6d,00,74,00,00,00,00,00
"Description"="Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network."
"DisplayName"="Windows Firewall/Internet Connection Sharing (ICS)"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
"Epoch"=dword:00002cd0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
  00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  69,00,70,00,6e,00,61,00,74,00,68,00,6c,00,70,00,2e,00,64,00,6c,00,6c,00,00,\
  00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"All"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum]
"0"="Root\\LEGACY_SHAREDACCESS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Double-click Sharedaccess.reg to merge the contents of this file into the registry and to create the Windows Firewall entry.
Restart Windows.
Click Start, click Run, type cmd, and then click OK.
At the command prompt, type the following command, and then press ENTER:
Netsh firewall reset
Click Start, click Run, type firewall.cpl, and then click OK.
Configure the Windows Firewall settings that you want to use.

If these methods do not work, reinstall Windows XP SP2.

You should include a reference for that registry edit
– barlop
Aug 30, 2015 at 5:46 — barlop, Aug 30, 2015 at 5:46

slhck · Accepted Answer · 2013-05-02 10:14:02Z

After successful removal of the above mentioned viruses if you find Windows Firewall not working with some 800 error. Then chances are that dependences like BFE, sharedaccess would have been deleted or corrupted along with firewall service.

Service can be rebuilt after downloading from a reliable source, for which I trust Bleeping Computer. After rebuilding the services they might not start and throw errors like access denied. For that you should go to hkey_local_machine\system\currentcontrolset\services\bfe & sharedaccess and add permission to the specified user.

Alternately you could go to Firewall will not start on Windows 7.

barlop · Accepted Answer · 2015-08-30 05:58:27Z

I see some deleted answers that mention some useful things

Apparently slhck suggested Bleeping Computer's Windows Repair (All In One)

http://www.bleepingcomputer.com/download/windows-repair-all-in-one/

That worked for the OP.

Somebody else suggested http://heresjaken.com/windows-firewall-service-is-missing-in-windows-7/

That has a reg fix that may be for a particular error, but it also mentioned another bleeping computer tool called far bar, of which there seem to be two..

http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

http://www.bleepingcomputer.com/download/farbar-service-scanner/

apesa · Accepted Answer · 2012-02-03 17:48:20Z

-1

I would not restore or reinstall just yet. You should be able to run the Malicious Software tool and go from there depending on the results. If it returns empty then go back to MS and look for a .MSC plugin for Firewall.

You want to make sure you have removed everything, it may be you just need to remove the virus/malicious code and restore Firewall.

answered Feb 3, 2012 at 17:48

apesa

3091 gold badge5 silver badges12 bronze badges

1

Question is, how to restore the firewall? Service is missing, msc snap-in wouldn't open (error 0x6D9)...
– haimg
Feb 3, 2012 at 18:04
If you are sure the system is clean, Run the System File Checker, at the command prompt type: sfc /scannow (space between c and /) and hit the enter key. When its done scanning and produces a report, restart see if the firewall service is back.
– Moab
Feb 3, 2012 at 21:17
A)you didn't state how to restore it B)There is no MSC blah blah, you mean MMC and I guess maybe you're trying to get at saying this sevenforums.com/tutorials/… I don't know if that will help
– barlop
Aug 30, 2015 at 5:49

Add a comment |

Stack Exchange Network

How to restore Windows Firewall after some malware deleted its service?

5 Answers 5

Not the answer you're looking for? Browse other questions tagged
windows-7
malware
windows-firewall
or ask your own question.

Linked

Hot Network Questions

How to restore Windows Firewall after some malware deleted its service?

5 Answers 5

Not the answer you're looking for? Browse other questions tagged windows-7malwarewindows-firewall or ask your own question.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
windows-7
malware
windows-firewall
or ask your own question.