Removing a Trojan That Disables Windows Firewall and Opens Network Ports

When a piece of malware silently turns off the Windows firewall and punches open TCP ports, your PC becomes a wide-open target on whatever network it joins. The attacker behind that backdoor can pull down additional payloads, harvest saved credentials, or rope the machine into a botnet used for further intrusions. The behaviour is common among trojan families built for financial theft and remote access, which is why understanding how to remove a trojan that disables the Windows firewall and opens ports matters for anyone running Windows 10 or 11 at home or in a small office.

This walkthrough focuses on what to do once you suspect your machine is already leaking traffic. It assumes a standard consumer setup rather than a managed enterprise environment, and the steps are written to be safe enough for a Sydney home user with a Telstra-supplied router, a Perth freelancer relying on the NBN, or anyone in between.

How the Trojan Breaks Down the Firewall and Opens Backdoors

The infection usually starts with a deceptive installer, a cracked activator, or a malicious email attachment. Once it has local privileges, the payload executes commands that target specific Windows services. The classic approach is to stop MpsSvc, modify its startup type through the registry, and disable tamper protection in Windows Security. With the firewall neutered, the trojan opens ports such as 3389, 4444, 5900, or random high-numbered TCP ports so a remote operator can reach the system directly.

Many of these trojans are themselves distributed through potentially unwanted program bundles hiding inside free downloaders, fake PC optimisers, or pirated media tools. Attackers frequently pair the backdoor with credential stealers, so a single compromise often means banking logins, email passwords, and saved browser cookies are already exposed to a third party somewhere overseas.

Warning Signs on a Compromised Windows Machine

You can often catch this category of malware before serious damage is done. Sudden fan ramp-ups on a laptop sitting idle, unfamiliar processes listed under Windows Task Manager, and outbound network traffic in Resource Monitor that points to unfamiliar IPs are early red flags. Brisbane-based users have also reported pop-ups from Telstra or AGL-branded scams that only appear after the firewall is off, which is a strong hint that something has rearranged the security stack.

In a household where multiple devices share one router, a trojanised PC can also drag down the entire connection. Routers in fibre-to-the-premises suburbs around Melbourne and Adelaide sometimes log thousands of blocked connection attempts per hour once one machine on the LAN starts probing other residents' IP ranges. If your router admin panel shows unusual outbound sessions, treat that as a cue to check the Windows machine immediately.

Safe Preparation Before You Start Cleaning

Before touching the infected system, isolate it. Disconnect from Wi-Fi and unplug any Ethernet lead, but leave the power cable connected so battery-saving states do not interrupt a system scan. Boot into Safe Mode with Networking so the trojan cannot auto-start, and create a backup of any irreplaceable documents onto a clean USB drive that you will never plug back into the same machine.

Choosing a scanner at this stage is easier when you compare options side by side:

Tool	Type	Strength	Caveat
Windows Defender Offline Scan	Built-in	Already present, runs outside Windows	May not catch packed trojans
Kaspersky Virus Removal Tool	Free on-demand	Strong heuristic detection	Requires fresh signature updates
Malwarebytes Premium Trial	Commercial	Good at removing PUPs and backdoors	Conflicts with some real-time shields
ESET Online Scanner	Free on-demand	Lightweight, no install needed	Limited to browser-session protection
HitmanPro	Second-opinion scanner	Excellent follow-up pass	Paid for full real-time use

Whichever scanner you choose, download it on a different clean device if possible and transfer the installer via USB.

Step-by-Step Removal of the Backdoor Trojan

Start by booting into Safe Mode with Networking. Open Command Prompt as Administrator and run netsh advfirewall set allprofiles state on to re-enable the firewall before any further changes are made. Then run sc query MpsSvc to confirm the service status, and if it is still stopped, run sc config MpsSvc start= auto followed by net start MpsSvc. This blocks the trojan outbound communications while you clean.

Next, run the offline scanner you prepared earlier and let it quarantine everything it finds. Restart into normal mode, open Registry Editor, and navigate to HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall to delete any policy keys the malware may have left behind. Review Task Scheduler and the Run keys under HKCU and HKLM for scheduled jobs tied to unknown executables.

If a webcam light flickered on unexpectedly during the infection, the payload may behave similarly to the intrusions covered in the webcam hijack guide, so follow its camera-permission checks after the scan. Finally, change every password that was typed on the machine after the suspected infection date, starting with email, then banking, then social logins, using a clean phone or a separate computer.

Restoring the Firewall and Hardening the System

With the trojan removed, restore the Windows firewall baseline by resetting its policy. Open Windows Security, switch Firewall and network protection to the recommended settings, and enable Tamper Protection so future malware cannot flip the firewall off again. If a managed antimalware product from your employer or university was disabled, reconnect through your normal channel rather than reinstalling a personal copy.

Run a full offline scan one more time to confirm the system is clean, then check for Windows updates and install everything pending. Report the incident to the support team if you need guided help, and consider lodging a report with Scamwatch or the ACSC so Australian threat trackers can correlate the campaign with similar activity elsewhere.

Hardening tips worth making into routine:

• Set Windows Update to automatic and leave it alone.
• Enable multi-factor authentication on email and banking logins.
• Keep at least one offline backup of critical files.
• Avoid "lifetime" licences shared through torrents or file hosts.
• Review the list of installed apps monthly and remove anything unused.
• Disable the built-in Administrator account if you never use it.
• Use a standard user account for daily work, reserving admin rights for installs.