[DoctorScience]

MalWareBytes found nothing:


Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org

Database version: v2012.01.14.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 7.0.6002.18005
Mary Ellen :: GALADRIEL [administrator]

1/14/2012 6:35:14 PM
mbam-log-2012-01-14 (18-35-14).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 216366
Time elapsed: 18 minute(s), 24 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

[Advertisements]

I figure you've probably gone off to your richly-deserved rest, but: Windows Security Center reports that:

- it cannot turn on the Firewall, no matter how hard I try

- it cannot turn on Windows Defender

- "AVG Anti-Virus Free Edition 2012 reports that it is turned off."

Yet when I go to AVG itself, it claims to be running.

I am going to disconnect this computer from the Internet again, and see what you tell me to do in the morning.

[DoctorScience]

I figure you've probably gone off to your richly-deserved rest, but: Windows Security Center reports that:

- it cannot turn on the Firewall, no matter how hard I try

- it cannot turn on Windows Defender

- "AVG Anti-Virus Free Edition 2012 reports that it is turned off."

Yet when I go to AVG itself, it claims to be running.

I am going to disconnect this computer from the Internet again, and see what you tell me to do in the morning.

[Essexboy]

I thought the we might have some residual damage so lets check that out now

run farbar service scanner


Tick "Internet services" and "Windows Firewall" options.
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

[DoctorScience]

Results:

Farbar Service Scanner
Ran by Mary Ellen (administrator) on 15-01-2012 at 07:15:19
Microsoft® Windows Vista™ Business Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.


Windows Firewall:
=============
MpsSvc Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open MpsSvc registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open MpsSvc registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open MpsSvc registry key. The service key does not exist.
Checking LEGACY_MpsSvc: Attention! Unable to open LEGACY_MpsSvc\0000 registry key. The key does not exist.

bfe Service is not running. Checking service configuration:
Checking Start type: Attention! Unable to open bfe registry key. The service key does not exist.
Checking ImagePath: Attention! Unable to open bfe registry key. The service key does not exist.
Checking ServiceDll: Attention! Unable to open bfe registry key. The service key does not exist.
Checking LEGACY_bfe: Attention! Unable to open LEGACY_bfe\0000 registry key. The key does not exist.

mpsdrv Service is not running. Checking service configuration:
The start type of mpsdrv service is OK.
The ImagePath of mpsdrv service is OK.


Firewall Disabled Policy:
==================


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

[DoctorScience]

also, AVG is running its initial scan.

[Essexboy]

OK let me know the result of that please

OK to do some repairs. Initially we will use the MS Fixit centre as this is a really usefull tool to have and keep

Download and install the MSFixit centre

When the programme starts run the following fixits :

Windows Security Trouble Shooter
Windows Firewall Trouble Shooter



Let me know how that goes plus any other anomolies that you are experiencing

[DoctorScience]

Windows Firewall Troubleshooter Publisher details

Issues found
Windows Vista could not start Windows Firewall

Windows Vista could not start Windows Firewall
On a computer that is running Windows Vista, you find that the Windows Firewall service is not running. When you try to manually start the service, you get "Windows could not start the Windows Firewall on Local Computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code 5." error message. This can occur if the "MpsSvc" account does not have the necessary permissions for the related registry keys. Not fixed

Set permissions for the related registry keys Succeeded

Windows

[Essexboy]

OK so does the firewall work now ?

If not I will reset the registry for that

Also any other anomolies surfaced yet, does windows updates work ?

[DoctorScience]

The Firewall doesn't work.

When I tried to check for Windows Updates, I got "Windows could not search for new updates. Error code 80096001"

[Essexboy]

Run the fixit centre and select the windows updates fixit

Run it first in the normal mode, if that does not work then run in the aggressive mode

[DoctorScience]

Report:
--------------------
Windows Update Publisher details

Issues found
Windows Update components must be repaired
Windows Update components must be repaired
One or more Windows Update components are configured incorrectly Fixed
Repair Windows Update components Succeeded

Issues checked
Default Windows Update data locations have changed
Default Windows Update data locations have changed
The location where Windows Update stores data has changed and must be repaired Checked

Issues found Detection details

6 Windows Update components must be repaired Fixed

One or more Windows Update components are configured incorrectly
Repair Windows Update components Succeeded

Repairing Windows Update components frequently resolves common Windows Update errors


Issues checked Detection details

5 Default Windows Update data locations have changed Checked

The location where Windows Update stores data has changed and must be repaired
Repair default Windows Update locations Not Run

Change Windows Update locations to Windows default settings
--------------------------

But when I try to search for new updates again, I get the same error.

[Essexboy]

Download the attached zip file to your desktop
Extract the mpssvc.reg file
Right click the file and select merge
Reboot and retry the firewall

[DoctorScience]

Still can't turn it on.

[Essexboy]

OK progessing onward and upward I hope

All these small programmes and reg fixes can be deleted from the desktop as soon as you have used them

Windows Updates:
Download this zip file and extract all the files to your desktop
Run the fixwu.exe file
This will re-register all dll's and ocx files


I will now reset the BFE registry entries:

Download the attached BFE.zip file to your desktop
Extract BFE.reg to the desktop
Right click bfe.reg and select merge
Accept the warnings


Then let me know if they have worked

[DoctorScience]

Still can't search for updates, still can't turn on firewall.