BFE and Windows Firewall not starting

This is the SID for Eric

We need to the the permissions changed for below now

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root


This should work. We have tried it on Vista and Win 7 systems

 

Okay so keep Registrar Lite open and do the below.

Download the current version of MGtools and save it to your root folder or your Desktop ( whichever works for you ). Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator ) As soon as the black command prompt window opens, just hit CTRL-C in that window and say yes to Terminate batch job (y/n)

I just want to get the new version installed.

The with Registrar Lite, click File, Import and navigate to your C:\MGtools folder. Then select the fixW7BFE.reg file and click Open and allow it to be added to your registry. Did this work without any errors?

 

Let's see if it actually worked now.

Run the C:\MGtools\GetNetInf.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below log which should get updated:

• C:\MGlogs.zip

 

It did not fully work. The LEGACY key entries under the Root key did not get added which is what I expected since we have not been able to get the permissions changed.

I just asked a user in another thread this question and they cannot do it today. So I'll ask you.

Would you like to try a remote access program named TeamViewer? Perhaps I can get in and see what is going on.

I can only work with one person at a time when doing this and it is not something we would normally do. Typically we only work in the forums. But it would be nice to understand this newer malware better and to find out what is going on. Right now there are dozens of this exact same problem happening and there is no easy fix short of total reinstall or a full Windows Repair.

 

Okay once you have it setup post your ID and PWD in an attachment text file and then I will delete it from the thread after writing it down. You don't have enough posts to PM me yet.

I will open a notepad window where we can talk in.

 

Okay I have it and removed the attachment. Do you have Window Live Messenger or MSN Messenger installed and running?

 

Password is not valid

also ID should not have had a - in it.

 

Okay got it. It was do to the ID with the -

I think it is waiting for you to accept.

 

Nope! It fails to connect. It does not like that password.

 

Nope. And now it has block me from access fo a 90 seconds due to too many failed attempts to login.

What version of TV are you running. I have 7.0.12280

 

Okay that was it.

 

You're welcome.

I'm already thinking about a way to show the ownership and permissions on the keys to help us determine when non-standard modifications have been made as in your case with the SID number owning the Root key.

Your logs are good. Just get your protection software installed and work thru the below.


If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista or Win 7, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

You're welcome.

Actually we don't recommend the use of any registry cleaners as they can and do frequently cause more harm than good. Most of what they find are non-issues and in many cases are even needed entries. If you ran a registy cleaner on a brand new installation of Windows, it would give you several hundred "supposed" erorrs.

What we recommend is only using a registry cleaner when a real expert advises you to do so and then only fix what is advised to be fixed.

While in many cases, if you do not just blindly accept what a registry cleaner shows as a problem and fix but you instead, selectively fix things that you know for absolute certainty are problems this would be a better choice but still you must be careful. A good example of this is cleaning up left overs from some programs that you don't use any more that have already been uninstalled. You could selective remove items related to that program.

 

You have to research which drivers and other software are required to load in safe mode and whether they actually can work in safe boot mode because they may have dependencies on other things that also do not load in safe mode.