XP Firewall Disabled - Help!

[sony654]

Some malware or virus has shut off my firewall; start.., all programs...,
accessories..., system tools..., security center. The firewall is "checked"
off, not on which is recommended (and how I have it set). But somthing
turned it off. I almost have the viruses and malware under control. Can
some one please advise how I can get the necessary sections of my XP program
updated. If I have to do something with my original CD's, please be specific
on which one to use, and how to properly load. Thanks... Please help - Tom
--
Sony Luvy

[Steven L Umbach]

Are you able to turn the Windows Firewall back on?? If not what happens or
what exact error message do you get. Malware and spyware commonly disable
the Windows Firewall or other software firewalls which is why I consider it
an absolute MUST that those that have DSL/cable internet connections use an
internet router or firewall appliance as their first line of defense. An
internet router costs less then taking the family to McDonalds these days
and can be purchased at Best Buy, Amazon, etc with names like Netgear,
Linksys, and D-Link.

As you work on your malware problem be sure to also boot into Safe Mode and
scan for both viruses and spyware in Safe mode. Also be sure that you are
using the latest definitions for any program you scan with. If you currently
are not using a spyware detection and removal program I recommend trying the
free for personal use AdAware SE. Make sure you read the link below on
Protect Your PC which will explain basics of security your computer and has
further links on how to deal with viruses and spyware. Also I STRONGLY
recommend that you do NOT use an account that is also an administrator
account for routine activities and especially for browsing the internet,
opening email, or using chat programs. --- Steve

http://www.microsoft.com/athome/security/protect/windowsxpsp2/Default.mspx
--- Protect Your PC
http://www.lavasoft.nu/software/adaware/ --- AdAware SE
http://support.microsoft.com/kb/315222/ --- using Safe Mode

"sony654" <son...@discussions.microsoft.com> wrote in message
news:5B805331-AF45-4285...@microsoft.com...

[sony654]

Steve Thanks. When I go to security center I am not able to lick firewall
on. It won't let me. I am down to 1 virus and will scan next in safe mode.
Thanks for the insight I'll update you - Tom
--
Sony Luvy

[Steven L Umbach]

Do you get an error message or is it just grayed out?? Are you using XP Home
or XP Pro? --- Steve

"sony654" <son...@discussions.microsoft.com> wrote in message

news:37321A8F-E7E8-4F2B...@microsoft.com...

[sony654]

Steve - XP Home, The firewall on/off is grayed-out. Thanks - Tom

[sony654]

Steve - I am now cleaning by my virus program i safe mode. Any advice on how
to re-instate firewall? Thanks

[Steven L Umbach]

Try this. Logon as an administrator and use regedit to open the registry
editor. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\ and if you see
a key under it for WindowsFirewall right click it and select delete. The go
to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ and if you see a
key under it for Network Connections do the same. If you did make any
changes reboot your computer to see if that then helps.

Steve

"sony654" <son...@discussions.microsoft.com> wrote in message

news:86A23BD4-3E9B-4A64...@microsoft.com...

[sony654]

Steve - Thanks. I'll try this evening. I apologize for what seems
elementary, but what is the path to regedit to open the registry editor? Am I
going to search all files and folders on the hard drive to find the HKEY
files? I apprecite your help and will try this evening Tom

[Steven L Umbach]

Just enter regedit in the run box and the hit OK to open the registry
editor. The in the upper left hand corner you will see HKEY_LOCAL_MACHINE
and you can expand it to find the keys I am talking about.

Steve

"sony654" <son...@discussions.microsoft.com> wrote in message

news:1E2F3A1C-5E21-4DCA...@microsoft.com...

[sony654]

Steve - I was able to delete windows firewall using the regedit syntax you
advised( in safe mode). Network connections did not display. Also, I now
have the machine virus free. When I re-booted, firewall under security
center is still not able to be turned on, it is still grayed-out. I do not
want to connect to internet for fear that viruses and malware will attack.
Your further advice appreciated. Thanks - Tom

[Steven L Umbach]

Do you have any other software firewall installed on the computer as that
can cause the Windows Firewall to be disabled?? What service pack are you
using? You can enter winver in the run box and then select OK to get service
pack info.

If you are using Service Pack 2 you can try using a .reg file that will
modify the registry to enable the firewall. Simply copy the lines below the
asterisks into notepad, save it with some name such as firewall1.reg, and
make sure you select all types for save as file type with notepad. Then
click that file, select yes when prompted, and see if it enables your
firewall after a reboot. To disable the firewall delete that key or change
the value to 0.

Steve

***************************************************************************

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
"EnableFirewall"=dword:00000001

"sony654" <son...@discussions.microsoft.com> wrote in message

news:8341EE94-CB22-4DBE...@microsoft.com...

[sony654]

Steve - I reloaded SP2 on Saturday... to no avail. So for your instructions
below, I want to clarify that I perform all steps in the notepad file I
create (on the affected computer of course). And do not have to copy
anything in the registry. Just follow the steps below. Please confirm and
thanks. Tom

[Steven L Umbach]

All you have to do is copy and paste those lines into a notepad file and
save at as I showed. It will automatically modify the registry for
u. --- Steve

"sony654" <son...@discussions.microsoft.com> wrote in message

news:7547541B-108B-4D1F...@microsoft.com...

[sony654]

Steve - I'm feeling more positive, please stay with me. I created the reg
file, clicked yes and OK to activate (buttons displayed and disappeared so
fast). But I think I did it OK. When I re-booted and clicked security
center/firewall I got the following message "Windows firewall setting cannot
be displayed because the associated service is not running. Do you want to
start the Windows/firewall internet connection sharing (ICS) service? I
clicked yes, and it displayed "Starting ICS..."

When I go in the access to turn-on is still grayed. I wonder if services is
not staying on. I have worked in services before at work, but cannot recall
the syntax (not my normal job responsibility...). I just wonder now if
services is the problem.

Also, please note that I did create the reg file under administrator, but
not in safe mode. I am still virus free as I have not connected the comp to
the net.

Again, please stay with me on this - Tom

[Steven L Umbach]

Hmm. In the run box enter services.msc to open the services Management
Console. Find the Windows Firewall Service and make sure that the startup
type is set to automatic and if it is the service should be started. Check
the dependencies tab of the Windows Firewall service and make sure those
services are also started.

Steve

"sony654" <son...@discussions.microsoft.com> wrote in message

news:65ABD21C-5819-4731...@microsoft.com...

[sony654]

Steve - Firewall/IC turn-on in security center still grayed-out. I did check
services as directed.

- Changed Windows Firewall/Internet service to "started"
- changed dependency Network Connection startup to automatic

Once all services checked and verified started (status)/automatic (startup),
I restarted the comp and tried to access firewall through security center.
The message appeared "Windows firewall settings cannot be displayed because

the associated service is not running. Do you want to start the

windows/firewall/internet connection (ICS) service?" Of course I clicked yes
and it said starting, but "turn-on" box still grayed-out.

It seems as though firewall is not recognizing the settings.

FYI - I did verify SP2 is installed last evening before I created the reg
file. I reloaded SP2 from CD on Saturday, in case it means anything.

Please let me know if there are additional diagnostics/ routes we can follow.

Your continued help is appreciated. Tom

[sony654]

Steve - I just saw something unusual I think under firewall exceptions in
security center. It says firewall is turned off. Your network administrator
is using group policy to control these settings. It shows some programs and
services names below and "group policy" set to "no" for each. I don't have a
network administrator, it's a standalone PC. (?) Thanks

[Steven L Umbach]

From what I can tell the registry setting you did should have configured the
firewall to be enabled yet something else is still blocking it of which I am
not sure what it is. When you first deleted the registry key under policies
that should have cleared any Group Policy type restrictions and the one you
just added should have configured a Group Policy type setting to enable it.
Possibly some process is still doing changes to the registry. What you might
want to consider is doing an upgrade/repair install which fixes a lot of
problems BUT requires that you first install your service pack [if not on
the install disk] and then going to Windows Updates to download and install
all the needed critical security updates again which will be all of them
after an upgrade/repair install. This is somewhat of a pain for those that
have high speed internet but can be very time consuming for those on dial
up. However an upgrade/repair install should preserve all your data and
applications and best practice is to always have backups of your important
data/media files to DVD/cdrom/USB drive. The link below explains more.

http://www.michaelstevenstech.com/XPrepairinstall.htm

Something to try first is to reset tcp/ip with the netsh command as shown in
the link below. If your computer is configured to obtain IP info
automatically then there will not be a problem but if you have a static IP
then you will have to reconfigure again. You can use the command ipconfig
/all to view and document your current tcp/ip info. Unfortuneatly the repair
options in XP Home are very limited compared to XP Pro.

Steve

http://support.microsoft.com/?kbid=299357

netsh int ip reset c:\resetlog.txt as a possible command

"sony654" <son...@discussions.microsoft.com> wrote in message

news:52201F0D-9109-453A...@microsoft.com...

[sony654]

Steve - I will follow these directions. Whern I install the SP1 tonight it
is on my original CD. What if I get the message "version on comp is newer
than version on CD"? Is there a way to proceed? It seems to me when I tried
this before, original CDS couldn't proceed install because they were not
current versions. I;ll do SP1 and windows updates first to see if that
works. But will try the tcp/ip first as you recommned. Thanks for your
continued help. I do appreciate. Tom

[Steven L Umbach]

If you have an install disk that does not include SP2 and you currently have
SP2 on your computer you have a couple of options. One is to uninstall SP2,
and then do the upgrade/repair install and the other is to create an install
disk from your's that has SP2 slipstreamed into it as described by the
instructions at the links below.

Steve

http://www.winsupersite.com/showcase/windowsxp_sp2_slipstream.asp
http://www.helpwithwindows.com/WindowsXP/winxp-sp2-bootcd.html

"sony654" <son...@discussions.microsoft.com> wrote in message

news:A7EA5426-4872-4D19...@microsoft.com...

[sony654]

Steve - I just uninstalled SP2 and have run upgrade/repair. Will then go to
Windows Update and bring in all security settings.

This whole experience has been greuling. That this malware stuff can affect
this much time. I will get SP2 and all updates of web. Will advise.

Tom

--

[SDGreen]

"sony654" <son...@discussions.microsoft.com> wrote in message

news:010F48D1-60DE-4937...@microsoft.com...

======================

Any resolution to this issue?