XP Firewall Disabled - Help!

  • Thread starter Thread starter Guest
  • Start date Start date
Steve - I just uninstalled SP2 and have run upgrade/repair. Will then go to
Windows Update and bring in all security settings.

This whole experience has been greuling. That this malware stuff can affect
this much time. I will get SP2 and all updates of web. Will advise.


Tom

--



Steven L Umbach said:
If you have an install disk that does not include SP2 and you currently have
SP2 on your computer you have a couple of options. One is to uninstall SP2,
and then do the upgrade/repair install and the other is to create an install
disk from your's that has SP2 slipstreamed into it as described by the
instructions at the links below.

Steve

http://www.winsupersite.com/showcase/windowsxp_sp2_slipstream.asp
http://www.helpwithwindows.com/WindowsXP/winxp-sp2-bootcd.html

sony654 said:
Steve - I will follow these directions. Whern I install the SP1 tonight
it
is on my original CD. What if I get the message "version on comp is newer
than version on CD"? Is there a way to proceed? It seems to me when I
tried
this before, original CDS couldn't proceed install because they were not
current versions. I;ll do SP1 and windows updates first to see if that
works. But will try the tcp/ip first as you recommned. Thanks for your
continued help. I do appreciate. Tom
--
Sony Luvy


Steven L Umbach said:
From what I can tell the registry setting you did should have configured
the
firewall to be enabled yet something else is still blocking it of which I
am
not sure what it is. When you first deleted the registry key under
policies
that should have cleared any Group Policy type restrictions and the one
you
just added should have configured a Group Policy type setting to enable
it.
Possibly some process is still doing changes to the registry. What you
might
want to consider is doing an upgrade/repair install which fixes a lot of
problems BUT requires that you first install your service pack [if not on
the install disk] and then going to Windows Updates to download and
install
all the needed critical security updates again which will be all of them
after an upgrade/repair install. This is somewhat of a pain for those
that
have high speed internet but can be very time consuming for those on dial
up. However an upgrade/repair install should preserve all your data and
applications and best practice is to always have backups of your
important
data/media files to DVD/cdrom/USB drive. The link below explains more.

http://www.michaelstevenstech.com/XPrepairinstall.htm

Something to try first is to reset tcp/ip with the netsh command as shown
in
the link below. If your computer is configured to obtain IP info
automatically then there will not be a problem but if you have a static
IP
then you will have to reconfigure again. You can use the command ipconfig
/all to view and document your current tcp/ip info. Unfortuneatly the
repair
options in XP Home are very limited compared to XP Pro.

Steve

http://support.microsoft.com/?kbid=299357

netsh int ip reset c:\resetlog.txt as a possible command

Steve - I just saw something unusual I think under firewall exceptions
in
security center. It says firewall is turned off. Your network
administrator
is using group policy to control these settings. It shows some
programs
and
services names below and "group policy" set to "no" for each. I don't
have a
network administrator, it's a standalone PC. (?) Thanks
--
Sony Luvy


:

Hmm. In the run box enter services.msc to open the services Management
Console. Find the Windows Firewall Service and make sure that the
startup
type is set to automatic and if it is the service should be started.
Check
the dependencies tab of the Windows Firewall service and make sure
those
services are also started.

Steve


Steve - I'm feeling more positive, please stay with me. I created
the
reg
file, clicked yes and OK to activate (buttons displayed and
disappeared
so
fast). But I think I did it OK. When I re-booted and clicked
security
center/firewall I got the following message "Windows firewall
setting
cannot
be displayed because the associated service is not running. Do you
want
to
start the Windows/firewall internet connection sharing (ICS)
service?
I
clicked yes, and it displayed "Starting ICS..."

When I go in the access to turn-on is still grayed. I wonder if
services
is
not staying on. I have worked in services before at work, but
cannot
recall
the syntax (not my normal job responsibility...). I just wonder now
if
services is the problem.

Also, please note that I did create the reg file under
administrator,
but
not in safe mode. I am still virus free as I have not connected the
comp
to
the net.

Again, please stay with me on this - Tom
--
Sony Luvy


:

All you have to do is copy and paste those lines into a notepad
file
and
save at as I showed. It will automatically modify the registry for
u. --- Steve


Steve - I reloaded SP2 on Saturday... to no avail. So for your
instructions
below, I want to clarify that I perform all steps in the notepad
file I
create (on the affected computer of course). And do not have to
copy
anything in the registry. Just follow the steps below. Please
confirm
and
thanks. Tom
--
Sony Luvy


:

Do you have any other software firewall installed on the
computer
as
that
can cause the Windows Firewall to be disabled?? What service
pack
are
you
using? You can enter winver in the run box and then select OK to
get
service
pack info.

If you are using Service Pack 2 you can try using a .reg file
that
will
modify the registry to enable the firewall. Simply copy the
lines
below
the
asterisks into notepad, save it with some name such as
firewall1.reg,
and
make sure you select all types for save as file type with
notepad.
Then
click that file, select yes when prompted, and see if it enables
your
firewall after a reboot. To disable the firewall delete that key
or
change
the value to 0.

Steve

***************************************************************************

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
"EnableFirewall"=dword:00000001



Steve - I was able to delete windows firewall using the
regedit
syntax
you
advised( in safe mode). Network connections did not display.
Also,
I
now
have the machine virus free. When I re-booted, firewall under
security
center is still not able to be turned on, it is still
grayed-out.
I
do
not
want to connect to internet for fear that viruses and malware
will
attack.
Your further advice appreciated. Thanks - Tom
--
Sony Luvy


:

Just enter regedit in the run box and the hit OK to open the
registry
editor. The in the upper left hand corner you will see
HKEY_LOCAL_MACHINE
and you can expand it to find the keys I am talking about.

Steve


message
Steve - Thanks. I'll try this evening. I apologize for
what
seems
elementary, but what is the path to regedit to open the
registry
editor?
Am I
going to search all files and folders on the hard drive to
find
the
HKEY
files? I apprecite your help and will try this evening Tom
--
Sony Luvy


:

Try this. Logon as an administrator and use regedit to
open
the
registry
editor. Go to
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\
and
if
you
see
a key under it for WindowsFirewall right click it and
select
delete.
The
go
to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\
and
if
you
see
a
key under it for Network Connections do the same. If you
did
make
any
 
sony654 said:
Steve - I just uninstalled SP2 and have run upgrade/repair. Will then go
to
Windows Update and bring in all security settings.

This whole experience has been greuling. That this malware stuff can
affect
this much time. I will get SP2 and all updates of web. Will advise.


Tom

--



Steven L Umbach said:
If you have an install disk that does not include SP2 and you currently
have
SP2 on your computer you have a couple of options. One is to uninstall
SP2,
and then do the upgrade/repair install and the other is to create an
install
disk from your's that has SP2 slipstreamed into it as described by the
instructions at the links below.

Steve

http://www.winsupersite.com/showcase/windowsxp_sp2_slipstream.asp
http://www.helpwithwindows.com/WindowsXP/winxp-sp2-bootcd.html

sony654 said:
Steve - I will follow these directions. Whern I install the SP1
tonight
it
is on my original CD. What if I get the message "version on comp is
newer
than version on CD"? Is there a way to proceed? It seems to me when I
tried
this before, original CDS couldn't proceed install because they were
not
current versions. I;ll do SP1 and windows updates first to see if that
works. But will try the tcp/ip first as you recommned. Thanks for
your
continued help. I do appreciate. Tom
--
Sony Luvy


:

From what I can tell the registry setting you did should have
configured
the
firewall to be enabled yet something else is still blocking it of
which I
am
not sure what it is. When you first deleted the registry key under
policies
that should have cleared any Group Policy type restrictions and the
one
you
just added should have configured a Group Policy type setting to
enable
it.
Possibly some process is still doing changes to the registry. What you
might
want to consider is doing an upgrade/repair install which fixes a lot
of
problems BUT requires that you first install your service pack [if not
on
the install disk] and then going to Windows Updates to download and
install
all the needed critical security updates again which will be all of
them
after an upgrade/repair install. This is somewhat of a pain for those
that
have high speed internet but can be very time consuming for those on
dial
up. However an upgrade/repair install should preserve all your data
and
applications and best practice is to always have backups of your
important
data/media files to DVD/cdrom/USB drive. The link below explains more.

http://www.michaelstevenstech.com/XPrepairinstall.htm

Something to try first is to reset tcp/ip with the netsh command as
shown
in
the link below. If your computer is configured to obtain IP info
automatically then there will not be a problem but if you have a
static
IP
then you will have to reconfigure again. You can use the command
ipconfig
/all to view and document your current tcp/ip info. Unfortuneatly the
repair
options in XP Home are very limited compared to XP Pro.

Steve

http://support.microsoft.com/?kbid=299357

netsh int ip reset c:\resetlog.txt as a possible command

Steve - I just saw something unusual I think under firewall
exceptions
in
security center. It says firewall is turned off. Your network
administrator
is using group policy to control these settings. It shows some
programs
and
services names below and "group policy" set to "no" for each. I
don't
have a
network administrator, it's a standalone PC. (?) Thanks
--
Sony Luvy


:

Hmm. In the run box enter services.msc to open the services
Management
Console. Find the Windows Firewall Service and make sure that the
startup
type is set to automatic and if it is the service should be
started.
Check
the dependencies tab of the Windows Firewall service and make sure
those
services are also started.

Steve


Steve - I'm feeling more positive, please stay with me. I
created
the
reg
file, clicked yes and OK to activate (buttons displayed and
disappeared
so
fast). But I think I did it OK. When I re-booted and clicked
security
center/firewall I got the following message "Windows firewall
setting
cannot
be displayed because the associated service is not running. Do
you
want
to
start the Windows/firewall internet connection sharing (ICS)
service?
I
clicked yes, and it displayed "Starting ICS..."

When I go in the access to turn-on is still grayed. I wonder if
services
is
not staying on. I have worked in services before at work, but
cannot
recall
the syntax (not my normal job responsibility...). I just wonder
now
if
services is the problem.

Also, please note that I did create the reg file under
administrator,
but
not in safe mode. I am still virus free as I have not connected
the
comp
to
the net.

Again, please stay with me on this - Tom
--
Sony Luvy


:

All you have to do is copy and paste those lines into a notepad
file
and
save at as I showed. It will automatically modify the registry
for
u. --- Steve


Steve - I reloaded SP2 on Saturday... to no avail. So for
your
instructions
below, I want to clarify that I perform all steps in the
notepad
file I
create (on the affected computer of course). And do not have
to
copy
anything in the registry. Just follow the steps below.
Please
confirm
and
thanks. Tom
--
Sony Luvy


:

Do you have any other software firewall installed on the
computer
as
that
can cause the Windows Firewall to be disabled?? What service
pack
are
you
using? You can enter winver in the run box and then select OK
to
get
service
pack info.

If you are using Service Pack 2 you can try using a .reg file
that
will
modify the registry to enable the firewall. Simply copy the
lines
below
the
asterisks into notepad, save it with some name such as
firewall1.reg,
and
make sure you select all types for save as file type with
notepad.
Then
click that file, select yes when prompted, and see if it
enables
your
firewall after a reboot. To disable the firewall delete that
key
or
change
the value to 0.

Steve

***************************************************************************

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
"EnableFirewall"=dword:00000001



message
Steve - I was able to delete windows firewall using the
regedit
syntax
you
advised( in safe mode). Network connections did not
display.
Also,
I
now
have the machine virus free. When I re-booted, firewall
under
security
center is still not able to be turned on, it is still
grayed-out.
I
do
not
want to connect to internet for fear that viruses and
malware
will
attack.
Your further advice appreciated. Thanks - Tom
--
Sony Luvy


:

Just enter regedit in the run box and the hit OK to open
the
registry
editor. The in the upper left hand corner you will see
HKEY_LOCAL_MACHINE
and you can expand it to find the keys I am talking about.

Steve


message
Steve - Thanks. I'll try this evening. I apologize for
what
seems
elementary, but what is the path to regedit to open the
registry
editor?
Am I
going to search all files and folders on the hard drive
to
find
the
HKEY
files? I apprecite your help and will try this evening
Tom
--
Sony Luvy


:

Try this. Logon as an administrator and use regedit to
open
the
registry
editor. Go to
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\
and
if
you
see
a key under it for WindowsFirewall right click it and
select
delete.
The
go
to
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\
and
if
you
see
a
key under it for Network Connections do the same. If
you
did
make
any


======================

Any resolution to this issue?
 
Back
Top