Firewall disable

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

This keeps happening:

Event Type: Success Audit
Event Source: Security
Event Category: Policy Change
Event ID: 853
Date: 03/05/2006
Time: 9:07:24 PM
User: NT AUTHORITY\SYSTEM
Computer: 3CREEKS
Description:
The Windows Firewall operational mode has changed.

Policy origin: Local Policy
Profile changed: Standard
Interface: All interfaces
New Setting:
Operation mode: Off
Old Setting:
Operation mode: On

My firewall keeps getting shut off, also the HKLM values change back soon
after I reset them to =0
Also the other settings below:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

Registry changes back to =0 I made under administrator-

OS passes several different virus scans, and malicious software remover tool.
Also passes spyware scans.

If I open the security center, the firewall status button will show green,
but if I open the firewall, it will be disabled.

OS is XP Home edition with SP2

What is causing this, and what should I do? Thanks, John
 
Are you using a 3rd party firewall program? If so, and Windows recognizes it as a valid firewall, the built in firewall is automatically disabled.
 
Thanks for replying
No, I only have the firewall that came with XP.

Doug Knox MS-MVP said:
Are you using a 3rd party firewall program? If so, and Windows recognizes it as a valid firewall, the built in firewall is automatically disabled.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

John H said:
This keeps happening:

Event Type: Success Audit
Event Source: Security
Event Category: Policy Change
Event ID: 853
Date: 03/05/2006
Time: 9:07:24 PM
User: NT AUTHORITY\SYSTEM
Computer: 3CREEKS
Description:
The Windows Firewall operational mode has changed.

Policy origin: Local Policy
Profile changed: Standard
Interface: All interfaces
New Setting:
Operation mode: Off
Old Setting:
Operation mode: On

My firewall keeps getting shut off, also the HKLM values change back soon
after I reset them to =0
Also the other settings below:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

Registry changes back to =0 I made under administrator-

OS passes several different virus scans, and malicious software remover tool.
Also passes spyware scans.

If I open the security center, the firewall status button will show green,
but if I open the firewall, it will be disabled.

OS is XP Home edition with SP2

What is causing this, and what should I do? Thanks, John
Click to expand...
Click to expand...
 
My reply is at the bottom of your message :


John H said:
Thanks for replying
No, I only have the firewall that came with XP.

Doug Knox MS-MVP said:
Are you using a 3rd party firewall program? If so, and Windows recognizes it as a valid firewall, the built in firewall is automatically disabled.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

John H said:
This keeps happening:

Event Type: Success Audit
Event Source: Security
Event Category: Policy Change
Event ID: 853
Date: 03/05/2006
Time: 9:07:24 PM
User: NT AUTHORITY\SYSTEM
Computer: 3CREEKS
Description:
The Windows Firewall operational mode has changed.

Policy origin: Local Policy
Profile changed: Standard
Interface: All interfaces
New Setting:
Operation mode: Off
Old Setting:
Operation mode: On

My firewall keeps getting shut off, also the HKLM values change back soon
after I reset them to =0
Also the other settings below:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

Registry changes back to =0 I made under administrator-

OS passes several different virus scans, and malicious software remover tool.
Also passes spyware scans.

If I open the security center, the firewall status button will show green,
but if I open the firewall, it will be disabled.

OS is XP Home edition with SP2

What is causing this, and what should I do? Thanks, John
Click to expand...
Click to expand...
Click to expand...



This part of your message ...
If I open the security center, the firewall status button will show green,
but if I open the firewall, it will be disabled
Click to expand...

makes me think you have another firewall protection .

Most popular products that have firewall protections in them :

Norton (Symantec)
McAfee
Zone Alarm
Kerio
Sygate
Outpost
Panda
Kaspersky
Trend Micro

When you open Windows Security Center , what exactly is written there about
the firewall :
Something like that or
Firewall ON
The firewall XXXYYYZZZ is currently on bla-bla .

Please , quote the exact message .


Panda_man
 
Is this a stand alone computer, or part of a domain? If its part of a domain, group policies may be overriding the firewall settings. If its a stand alone computer, you have issues with some type of malware which is turning the firewall off, and setting the policies to not notify you of this.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

John H said:
Thanks for replying
No, I only have the firewall that came with XP.

Doug Knox MS-MVP said:
Are you using a 3rd party firewall program? If so, and Windows recognizes it as a valid firewall, the built in firewall is automatically disabled.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

John H said:
This keeps happening:

Event Type: Success Audit
Event Source: Security
Event Category: Policy Change
Event ID: 853
Date: 03/05/2006
Time: 9:07:24 PM
User: NT AUTHORITY\SYSTEM
Computer: 3CREEKS
Description:
The Windows Firewall operational mode has changed.

Policy origin: Local Policy
Profile changed: Standard
Interface: All interfaces
New Setting:
Operation mode: Off
Old Setting:
Operation mode: On

My firewall keeps getting shut off, also the HKLM values change back soon
after I reset them to =0
Also the other settings below:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

Registry changes back to =0 I made under administrator-

OS passes several different virus scans, and malicious software remover tool.
Also passes spyware scans.

If I open the security center, the firewall status button will show green,
but if I open the firewall, it will be disabled.

OS is XP Home edition with SP2

What is causing this, and what should I do? Thanks, John
Click to expand...
Click to expand...
Click to expand...
 
It is a stand alone computer. I have a screenshot, but I see there is no
means to attach a file here. Can you suggest a malware program? I checked
with HijackThis, Spybot S&D MS malware tool and ewido. Clean...

Doug Knox MS-MVP said:
Is this a stand alone computer, or part of a domain? If its part of a domain, group policies may be overriding the firewall settings. If its a stand alone computer, you have issues with some type of malware which is turning the firewall off, and setting the policies to not notify you of this.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

John H said:
Thanks for replying
No, I only have the firewall that came with XP.

Doug Knox MS-MVP said:
Are you using a 3rd party firewall program? If so, and Windows recognizes it as a valid firewall, the built in firewall is automatically disabled.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

This keeps happening:

Event Type: Success Audit
Event Source: Security
Event Category: Policy Change
Event ID: 853
Date: 03/05/2006
Time: 9:07:24 PM
User: NT AUTHORITY\SYSTEM
Computer: 3CREEKS
Description:
The Windows Firewall operational mode has changed.

Policy origin: Local Policy
Profile changed: Standard
Interface: All interfaces
New Setting:
Operation mode: Off
Old Setting:
Operation mode: On

My firewall keeps getting shut off, also the HKLM values change back soon
after I reset them to =0
Also the other settings below:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

Registry changes back to =0 I made under administrator-

OS passes several different virus scans, and malicious software remover tool.
Also passes spyware scans.

If I open the security center, the firewall status button will show green,
but if I open the firewall, it will be disabled.

OS is XP Home edition with SP2

What is causing this, and what should I do? Thanks, John
Click to expand...
Click to expand...
Click to expand...
 
Back
Top