Windows Firewall Hangs Bootup

[James H. Hansen]

I am working on a friend's computer that won't boot to normal mode with the
Windows Firewall service enabled. It hangs on the Windows XP splash screen
shortly after resetting the keyboard and before going to the logon screen.
I have used MSConfig to disable everything execpt the firewall and it still
hangs. If I enable everything except the firewall it boots fine. I can
boot to safemode OK. Once the system boots normally without the firewall, I
can enable the firewall without problems, but then when I reboot it with the
service enabled it again hangs.

Anybody got any suggestions where to go from here?

....Jim Hansen
CanyonCountryConsulting

Note: noydb is not my domain name. Please reply to the group.

 

[PA Bear]

Eliminate hijackware as a possible cause by doing a /thorough/ check for it.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

 

[James H. Hansen]

I will run HijackThis, but I expect nothing to be found. I have run
AdAware, eTrust AV, MS AntiSpyware deep scans several times with current
signature files from both normal and safe mode and found nothing. I have
reviewed all the startup items, services and win.ini and system.ini file
entries in MSConfig and there is nothing that I cannot identify. I have
never had HijackThis find anything new after all that. Also, please note
that the hang occurs while the splash screen is up, BEFORE the event service
can log its start, very shortly after the keyboard reset. The system
continues to scroll the "progress" bar forever (at least for an hour and a
half) with no observed disk activity (although I didn't watch every minute
for that long, I watched for over 5 minutes).

....Jim Hansen
Canyon Country Consulting

 

[Alias]

I will run HijackThis, but I expect nothing to be found. I have run
AdAware, eTrust AV, MS AntiSpyware deep scans several times with current
signature files from both normal and safe mode and found nothing. I have
reviewed all the startup items, services and win.ini and system.ini file
entries in MSConfig and there is nothing that I cannot identify. I have
never had HijackThis find anything new after all that. Also, please note
that the hang occurs while the splash screen is up, BEFORE the event service
can log its start, very shortly after the keyboard reset. The system
continues to scroll the "progress" bar forever (at least for an hour and a
half) with no observed disk activity (although I didn't watch every minute
for that long, I watched for over 5 minutes).

...Jim Hansen
Canyon Country Consulting

Sounds like a hardware problem to me.

Alias

 

[James H. Hansen]

That's what I thought, but what hardware problem would affect only the
Windows Firewall and only during bootup? Networking works fine without the
firewall, or if the firewall is started after bootup and login.

.....Jim

 

[Lem]

That's what I thought, but what hardware problem would affect only the
Windows Firewall and only during bootup? Networking works fine without the
firewall, or if the firewall is started after bootup and login.

....Jim

A shot in the dark ... but Windows Firewall tries to protect every possible
entry point into the system, even those that you aren't using for networking.
Check Network Connections to see if there is a Firewire or IR port that is noted
as "firewalled." If so, perhaps there's something amiss with that hardware.

 

[James H. Hansen]

An interesting idea, Lem, but there are no other adapters. (Other than the
UPNP one that pops up when it finds my ActionTec.) I tried disabling the
network card, rather than just unplugging it, but the hang persists.
Interesting, though, is that booting to safe mode with networking works OK.
The firewall starts up in safe mode without hanging.

....Jim

 

[Malke]

An interesting idea, Lem, but there are no other adapters. (Other
than the
UPNP one that pops up when it finds my ActionTec.) I tried disabling
the network card, rather than just unplugging it, but the hang
persists. Interesting, though, is that booting to safe mode with
networking works OK. The firewall starts up in safe mode without
hanging.

Then you know something is causing the problem in Regular Mode. Do
clean-boot troubleshooting to find out what it is.

Clean boot in Windows XP - http://support.microsoft.com/kb/310353

Clean-boot advanced troubleshooting in Windows XP -
http://support.microsoft.com/kb/316434

How to Troubleshoot By Using the Msconfig Utility in Windows XP -
http://support.microsoft.com/?id=310560

Malke

 

[James H. Hansen]

Thanks for the thought, Malke, but as I mentioned in my first post, I have
already done that. With everything disabled and only the Windows Firewall
re-enabled, bootup hangs. With everything enabled except the Windows
firewall, it boots fine.

....Jim

 

[James H. Hansen]

OK. I ran HijackThis and carefully inspected everything listed that was not
very obviously known (e.g. CA AntiVirus, WuickTime, RealPlayer, etc.) and
there is nothing there.

....Jim

 

[Lem]

An interesting idea, Lem, but there are no other adapters. (Other than the
UPNP one that pops up when it finds my ActionTec.) I tried disabling the
network card, rather than just unplugging it, but the hang persists.
Interesting, though, is that booting to safe mode with networking works OK.
The firewall starts up in safe mode without hanging.

...Jim

Well, now it sounds more like a software conflict than a hardware problem. You
may have already tried "clean boot troubleshooting" but if not, see
How to perform advanced clean-boot troubleshooting in Windows XP
http://support.microsoft.com/kb/316434/en-us
Also, I couldn't find an XP version, but you might be interested in this Win2k
MS White Paper on Safe Mode:
http://www.microsoft.com/windows2000/docs/_Toc487427359
It identifies the registry key that lists the services and drivers started in
SM.

 

[PA Bear]

Eliminate hijackware as a possible cause by doing a thorough check for

it...
Post your log to http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for
expert analysis

Can you supply us with the URL for your thread in the forum to which you'd
posted your log?