某些恶意软件删除了Windows防火墙的服务，如何恢复？

Question

2012-02-03 17:34:23 +0000 2012-02-03 17:34:23 +0000

7

某些恶意软件删除了Windows防火墙的服务，如何恢复？

昨天我访问了某个网站，显然是通过某个Flash漏洞被感染了。Microsoft Security essentials立即启动，并显示了四个项目的警告。

> Trojan:Win64/Sirefef.B 
> DDoS:Win32/Fareit.gen!A 
> Rogue:Win32/FakeRean
> PWS:Win32/Karagany.A

我把它们都删了，我以为安全要领能在它造成任何伤害之前就抓住了感染。但今天发现Windows防火墙服务完全消失了，在控制面板中无法访问防火墙，"基础过滤引擎 “服务被标记为禁用。在进程资源管理器中看了一下，没有看到任何可疑的东西。额外的杀毒软件扫描也没发现什么。

问题：

-如何才能让我的防火墙重获新生？

-这些病毒还会破坏什么，我可以检查一下我是否受到影响？

我知道最好的办法是重新安装Windows或从备份中恢复。我想知道是否还有其他选择…

来源

haimg http://superuser.stackexchange.com/users/37440

答案 (5)

2

2012-11-24 07:54:49 +0000

方法1：调用 “Setup API InstallHinfSection "函数安装Windows Firewall 要安装Windows Firewall，请按照以下步骤进行。

Click Start, click Run, type cmd, and then click OK.
At the command prompt, type the following command line, and then press ENTER:
Rundll32 setupapi,InstallHinfSection Ndi-Steelhead 132 %windir%\inf\netrass.inf
Restart Windows,
Click Start, click Run, type cmd, and then click OK.
At the command prompt, type the following command, and then press ENTER:
Netsh firewall reset
Click Start, click Run, type firewall.cpl, and then press ENTER. In the Windows Firewall dialog box, click On (recommended), and then click OK.

方法2：将Windows Firewall条目添加到注册表中重要的是本节、方法或任务包含了告诉你如何修改注册表的步骤。但是，如果您不正确地修改注册表，可能会出现严重的问题。因此，请确保您仔细遵循这些步骤。为了加强保护，在修改注册表之前，请先备份注册表。然后，如果出现问题，您可以恢复注册表。有关如何备份和恢复注册表的更多信息，请单击以下文章编号查看微软知识库中的文章。322756 如何在Windows中备份和恢复注册表

要将Windows防火墙条目添加到注册表中，请按照以下步骤操作。

Copy the following text into Notepad, and then save the file as Sharedaccess.reg:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"DependOnGroup"=hex(7):00,00
"DependOnService"=hex(7):4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,57,00,69,00,\
  6e,00,4d,00,67,00,6d,00,74,00,00,00,00,00
"Description"="Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network."
"DisplayName"="Windows Firewall/Internet Connection Sharing (ICS)"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
"Epoch"=dword:00002cd0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
  00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  69,00,70,00,6e,00,61,00,74,00,68,00,6c,00,70,00,2e,00,64,00,6c,00,6c,00,00,\
  00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"All"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum]
"0"="Root\LEGACY_SHAREDACCESS\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Double-click Sharedaccess.reg to merge the contents of this file into the registry and to create the Windows Firewall entry.
Restart Windows.
Click Start, click Run, type cmd, and then click OK.
At the command prompt, type the following command, and then press ENTER:
Netsh firewall reset
Click Start, click Run, type firewall.cpl, and then click OK.
Configure the Windows Firewall settings that you want to use.

如果这些方法不起作用，请重新安装Windows XP SP2。

来源

Ganesh http://superuser.stackexchange.com/users/37440

1