Firewall issues

NotAGolf · 1 Jul 2012 at 16:38

Looks like a I got a virus the other day and it has affected my firewall. I'm not sure the name of the virus, but I booted into safe mode and run MSE, malware antibytes and spy bot. They've all come back clean now. However, I still can't turn on the windows firewall. (Win 7 btw) When I try I get the error:

Windows could not start the Windows Firewall on Local computer. For more information, reviews the system event log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 5.

I've spent the best part of half a day reading troubleshooting guides and changing/downloading registry keys but still no luck. I've got 3 choices:
1 - Run without a firewall
2 - Use a 3rd party firewall
3 - Fresh install of windows

Seeing as I don't use the computer that much, I don't really want to do 3. How risky is it to go with option 1? Any recommendations for option 2?

Thanks for any help.

theheyes · 1 Jul 2012 at 16:48

Option 3 is your best bet. If you don't use your computer that much I'm guessing you don't have that much to reinstall or back up. You could have a fresh install up and running in less than an hour.

KIA · 1 Jul 2012 at 20:00

Clean install is always the way to go after system compromise.

ecksmen · 1 Jul 2012 at 23:48

I have a hunch that you'll have a service or two that are disabled / stopped by the infection.

Check that the following are dependencies are running: Windows Firewall needs Base Filtering Engine, which requires remote procedure call, which in turn needs DCOM Server process launcher and endpoint mapper.

Re-installing is overkill IMO and somewhat pointless, if you re-install you can still get re-infected unless you change the AV to something more comprehensive considering it's already given you a clean bill of health.

Edit

Running without a firewall isn't the end of the world if you are behind a NAT / firewall as with most broadband packages.

Shadz · 2 Jul 2012 at 02:36

I don't know if this will work or not to be honest but why dont you run a windows install
on boot and when it comes to the option repair the Windows install instead of installing
it agian, this might correct any issues that you are having with services not working
that run your firewall. Im not saying that it will work im just saying that you could try it
but for the 10-15 minutes it will take to do it you really have nothing to loose by trying.

Purgatory · 2 Jul 2012 at 07:30

3 - Fresh install of windows

Atleast you will know 100% you are clear from it, but as others have said make sure you don't have any of the services disabled that are required for windows firewall to run correctly. If you have tried registry hacks and have you tried the MS FixIt centre ?

http://support.microsoft.com/fixit/

Try option 3 there and type in the Filter Solutions "Firewall" there are some fixes there that will try bring back your firewall to life too.

Diagnose and fix Windows Firewall service problems automatically

http://support.microsoft.com/mats/windows_firewall_diagnostic/en-us

Fix security issues to protect and secure Windows automatically

http://support.microsoft.com/mats/windows_security_diagnostic/en-us

Automatically fix Windows security settings to keep your PC safe

http://support.microsoft.com/mats/Malware_Prevention/en-us

theheyes · 2 Jul 2012 at 16:47

ecksmen said:
Re-installing is overkill IMO and somewhat pointless, if you re-install you can still get re-infected unless you change the AV to something more comprehensive considering it's already given you a clean bill of health.

You can't know for sure whether or not a rootkit is running, especially if the system is still behaving odd even when the health check comes up clean. With a clean install at least you can be almost certain that it will fix the issue, is pretty straightforward and will take a reasonable amount of time to complete.