Firewall Keeps Shutting Down

[Michael Dobony]

I have firewall enabled on 2 computers running WXP SP3. However, I often
(almost always) get a security message stating that the firewall is
disabled. When I follow the balloon to enable the firewall I get a message
that it is unable to enable the firewall and to use Control Panel to enable
it. Sometimes when I go there it is already enabled and other times it
refuses to enable it there. Both computers are acting the same. Any ideas
what is going on?

Mike D.

 

[Unknown]

Are you using a firewall other than Windows?

 

[DrewEh]

I'm guessing you're using Windows firewall. And from the sounds of
it, you get this message when your startup or log into your machine?
Or does the firewall turn off while you're logged in? If it happens
while logged in, you probably have some bad software (virus / adware /
spyware). If it happens during logon you may have some junk software
that loads during logon which is slowing the firewall service from
starting. I've seen this on older peoples PCs who install poker/slot
machine other 'free' adult software off the net.

 

[Jose]

I have firewall enabled on 2 computers running WXP SP3.  However, I often
(almost always) get a security message stating that the firewall is
disabled.  When I follow the balloon to enable the firewall I get a message
that it is unable to enable the firewall and to use Control Panel to enable
it.  Sometimes when I go there it is already enabled and other times it
refuses to enable it there.  Both computers are acting the same.  Anyideas
what is going on?

Mike D.

If you were malicious software, what a good trick to play on
somebody's computer. Turn off the firewall and then fix it so it
won't start up again.

Download and install Malwarebytes free software, update it, run a
complete scan and see if that turns up any ideas.

When the Windows firewall starts or stops (normally) there are some
events in the If the Windows Event log System section about what
happened. It would be interesting to see if you see anything there,
especially if it refuses to start up again.

A lot of folks here feel the Windows firewall is adequate by itself
and that it is generally not a good idea to run the Windows firewall
and some third party firewall at the same time. Pick one or the
other, but not both.

Of course, that is up to you. There are plenty of folks that will be
happy to argue about that.

What is your environment?

Please report back what you discover.

 

[Michael Dobony]

Are you using a firewall other than Windows?

No, Windows firewall.

 

[R. McCarty]

What Antivirus software are you using ? You should also use the
Services.Msc to verify that Windows Firewall service starts and is
set to Automatic at boot up. The reason I asked about AV is that
you may have infectors on the PC that are disabling/inhibiting the
Firewall.

 

[PA Bear [MS MVP]]

[Note to self: 40tude]

There is a very good chance that you are seeing the effects of a hijackware
infection!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware
http://aumha.net/viewtopic.php?f=30&t=4075
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://forums.spybot.info/forumdisplay.php?f=22,
http://www.dslreports.com/forum/cleanup, http://aumha.net/viewforum.php?f=30
or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
~~
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002