Firewall Won't Stay Turned On

[stevewm]

Doesn't appear anyone has the answer at the moment.  Looks like those of us will have to junk the hard drives that contain this problem.

Steve

[Peacekeeper]

Did Jai arrange a call or did you give him what he wanted?

Also open serrvices.msc in the run command area and check the state of the windows firewall. It should show as started and autoatic. If not change it.

Have either you tried resetting teh firewall to defaults?

Another thought would be a clean reinstall bia

http://service.mcafee.com/FAQDocument.aspx?lc=1033&id=TS101331

reboot and run

http://download.mcafee.com/products/li censed/cust_support_patches/Mcpreinstall.exe

reinstall from your account

Just some thoughts till Jai returns

[stevewm]

Hi Tony,

Thanks for replying.  Never heard back from Jai after he said he wanted to call me about geting more information.  I gave him my availability times for a call but he never got back with me.

I guess the point that some of us, including myself, are relatively computer knowledgeable, and are totally unable to turn on the firewall, actually any firewall including Windows and McAfee.  As soon as attempts are made to reset the firewall, it shows on then immediately turns itself off.  And on top of that, the patch provided by McAfee tech support has caused internet access to be totally blocked.  Indications are that the computer is unable to obtain a valid IP address. All attempts to restore the connection through Windows fail as well.  The computer is still usable as a stand alone machine and it appears no data has been damaged but as the Trojan says, it is in a Zero Access mode.

I did find a manual procedure on YouTube for locating and finding the offending files but I can only find two out of three and the virus still continues to regenerate itself.  The characteristics are that the computer has full net access with a fully operational firewall for a few moments after bootup but as soon as an antivirus program begins a scan, it activates and turns the firewall off.  I think something is going on within McAfee that is keeping me off the web but I am not sure I want to get on the net with a firewall down.

I haven't tried turning off the auto scan within McAfee or alternately within Windows to keep from triggering the virus but I guess I really don't see the point in doing that.  My research indicates it also triggers on a timer that just turns itself on automatically.

I am wondering if reformatting and reinstalling Windows would fix things, but as clever as this one is, probably not.

As I mentioned, Googling for "Firewall won't stay turned on" gets 4,000,000 hits so it is getting to be an epidemic.  Norton and Kasparsky users have the problem as well.

Steve

[stevewm]

Also meant to say that I am unable to reset the firewall to defaults.  There are two places I have found where firewall settings can be changed. One is on general settings and just sets everything to default.  The other is on the firewall page where individual settings can be changed.  When the firewall is turned off, the settings are greyed out and can't be changed.  When I attempt to make a change during those brief times when the firewall is on, it simply turns itself off and the settings are inacessible.

I'd like to reinstall McAfee but this computer came with it pre-installed.  I may try to download it on one computer to a thumb drive and upload it to the infected one but I don't know if I can do it without an internet connection.  

[Peacekeeper]

No you need an internet connection sorry.

Have you tried stinger and the rootkit remover

https://community.mcafee.com/message/248273#248273

Have you tried a restore in safe mode?

[mokai]

Steve -

I feel your frustration buddy; hopefully I can help! I just spent the past several hours trying to solve this very problem myself, including talking to McAfee live chat support. I bet those poor reps get a bunch of hassle from a lot of people, so i can't really come down on them too hard, but their solution to the matter was to try to get me to dish out $85 bucks to purchase over-the-phone support. Not ready to spend that sort of cash on the issue, I kept looking.

http://malwaretips.com/Thread-How-to-completely-remove-ZeroAccess-Sirefef-rootkit-Removal-Guide

This site, so far, appears to have been my silver bullet. I only ever completed the two actions mentioned in Step 1; after that my PC is back to running regularly and my McAfee firewall is working beatifully. I hope you have similar luck.

I would be remiss, however, if I didn't note one side effect resulting of this - In the following hours I encountered a problem attempting to lauch a random program unrelated to the whole mess (a video game save editor). upon restarting I was greeted with another random error message upon startup. At this point, since the main issue of the tojan seemed done and over with, I went ahead and rebooted in safe mode and did a system restore to last week. Since doing this everything is back to normal so far.

Message was edited by: mokai on 7/29/12 6:34:35 AM CDT

[stevewm]

Done the restore in safe mode, stinger, and a rootkit remover.  The remover was for 32 bit machines and wouldn't run evenin safe mode.

Steve

[stevewm]

I will give it a shot.  Looks as if I will need to delete McAfee then restore it later if I can get on the Internet.  Thanks for the help!

Steve

[JaiPrakash · Accepted solution]

Hi stevewm,

Can you confirm whether your issue is resolved now?

[stevewm]

Jai,

Yes sir, I can confirm, that at this point, my computer seems to be back to normal.

Your guy was really great, patient and very informative.  Many kudos to him for a JOB WELL DONE.

Best regards,

Steve