Author Topic: Cannot turn firewall on or off (Read 45612 times)

ka6uup · « **on:** June 26, 2013, 05:05:06 pm »

I ran Tweaking.com Windows repair and now when I try to access the firewall to turn it off I
get a message "due to an unidentified problem windows cannot display firewall settings"
I have run the "NETSH FIREWALL RESET" and the "Rundll32 setupapi,InstallHinfSection Ndi-Steelhead 132 and run windows Fixit 50203 all per Microsoft but non have worked.
Help would be appreciated.
Chuck

Rick · « **Reply #1 on:** June 28, 2013, 11:18:52 am »

Have you checked event viewer for the error?

Is your option grayed out?

search google on how to disable firewall, it will help you to look at solving the problem...

Are your changing the settings as the administator or user?

Shane · « **Reply #2 on:** June 28, 2013, 12:09:27 pm »

Please dont double post.

A lot of rottkits kill the firewall. And if you still have one on your system that would explain why none of the repairs are working.

So lets cover all the bases.

Run Malwarebytes anti rootkit (This is different than their normal scanner)
http://www.malwarebytes.org/products/mbar/

and Tdsskilller
http://support.kaspersky.com/5350?el=88446

Let me know the results if they find anything.

Shane

ka6uup · « **Reply #3 on:** June 28, 2013, 03:50:58 pm »

Sorry for the double post. I was not getting an answer on the other forum and I didn't know how to delete the other posting.

I just ran both the Malwarebits Anti-rootkit and the TDSSKiller utilities and both came up clean.

Until I ran the "Windows Repair (all-in-one)," I had the Windows firewall turned off. After running it I discovered the Windows firewall was on. ( I don't need it. I have Comcast Norton Security running.)

I tried running "firewall.cpl" and also the "network connection properties" and in both cases, I receive the "due to an unidentified problem windows cannot display settings". The usual firewall settings window does not come up at all.

I Googled the message and found a lot of solutions which I tried with no success. Including Microsoft's "Fix It Center."
Also, I checked my "services" settings and the firewall is running.

I also tried all this with Norton Security completely disabled.

In addition, I now have a problem with the Volume Shadow Copy.
This also was running fine before, as I used it to back up my registry. But, now, when I try to back up the registry (using Tweaking Registry Backup) it comes on and immediately turns off. This is in spite of the fact it is running under "Services." I tried restarting it and also changing it from "manual" startup to "automatic" and it made no difference.
I have spent several hours trying to resolve this and am stumped.
Chuck

Willy2 · « **Reply #4 on:** June 28, 2013, 06:38:20 pm »

- Did you run "Repair WMI" and "Repair Volume Shadow copy" ? The Firewall requires WMI to function properly. The message "Can't display settings" clearly suggests a broken/faulty WMI. And WMI is used to pull up A LOT OF info from your computer.
- Did you run "Reset file & registry permissions" ?
- You can use WR to switch off the MS firewall and other Services.
http://www.tweaking.com/forums/index.php?topic=1195

ka6uup · « **Reply #5 on:** June 28, 2013, 07:38:45 pm »

Yes. I ran all of them in an attempt to fix the problem.
However, I will rerun them again just to be sure.

Thanks,
Chuck

ka6uup · « **Reply #6 on:** June 30, 2013, 04:20:17 pm »

I disconnected the network and disabled Norton Antivirus, Firewall and Tamper Protection.
I ran "Repair WMI" and "Repair Volume Shadow copy" without success.
Below are the error messages from "Event Viewer."
I hope they help.
Chuck

Event Type:   Error
Event Source:   PerfNet
Event Category:   None
Event ID:   2004
Date:      6/30/2013
Time:      9:22:54 AM
User:      N/A
Computer:   P5N2M7
Description:
Unable to open the Server service. Server performance data will not be returned. Error code returned is in data DWORD 0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000Event Type:   Error
Event Source:   PerfNet
Event Category:   None
Event ID:   2004
Date:      6/30/2013
Time:      9:22:54 AM
User:      N/A
Computer:   P5N2M7
Description:
Unable to open the Server service. Server performance data will not be returned. Error code returned is in data DWORD 0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À : 34 00 00 c0 4..À

Event Type:   Error
Event Source:   VSS
Event Category:   None
Event ID:   4099
Date:      6/30/2013
Time:      9:15:36 AM
User:      N/A
Computer:   P5N2M7
Description:
Volume Shadow Copy Service error: Cannot install the component C:\Program Files\Tweaking.com\Windows Repair (All in One)\SWPRV.DLL into the COM+ application 'MS Software Shadow Copy Provider' [0x80110401].

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 43 41 44 43 41 44 4d 43 CADCADMC
0008: 31 39 38 00 00 00 00 00 198.....
0010: 43 41 44 43 41 44 4d 43 CADCADMC
0018: 31 36 30 00 00 00 00 00 160.....

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:37 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\SYSTEM32\WBEM\WINDOWSSEARCHENGINE.MOF while recovering repository file.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:36 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MOF\SERVICEMODEL.MOF while recovering repository file.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:36 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODEL.MOF while recovering repository file.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:36 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CLR.MOF while recovering repository file.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:35 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET.MOF while recovering repository file.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.\

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:28 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V1.1.4322\ASPNET.MOF while recovering repository file.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Willy2 · « **Reply #7 on:** June 30, 2013, 07:00:39 pm »

Event viewer reports 5 problems with WMI. It can't load 5 *.mof files. If you want to back up the registry with Registry Backup then make sure you do it with an account with administrator rights. Then you don't need VSS.

ka6uup · « **Reply #8 on:** July 01, 2013, 01:00:48 pm »

No, one way or another, I have to fix it. VSS must run in order to use Macrium Reflect.
Looks like it is time for a system restore or repair if you can't help me.

Shane · « **Reply #9 on:** July 01, 2013, 07:45:27 pm »

VSS doesnt stay running at all times. It is meant to be put to manual startup and gets turned on when it is needed and off when it is done.

http://www.blackviper.com/windows-services/volume-shadow-copy/

I am concerned that the firewall cant even be opened. Since the system appears to be clean then we need to check for any bad sectors on the drive.

Do you know how to have chkdsk check for bad sectors?

Also another things that concerns me, in the log you posted "C:\Program Files\Tweaking.com\Windows Repair (All in One)\SWPRV.DLL" that file isnt part of my program.

The other errors are WMI saying it cant rebuild itself.

"Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET.MOF while recovering repository file."

You shouldnt have all these errors out of nowhere. Let me know on that bad sector check. If you tried to do a repair install with bad sectors you could be looking at a big mess. So lets make sure first.

Shane

ka6uup · « **Reply #10 on:** July 01, 2013, 08:23:42 pm »

I run chkdsk periodically and have never had a problem. I will do it again to be sure.

I went to the Macrium site and downloaded their "Vssfix.exe" utility and that fixed the vss problem.
I always run VSS on "Manual." I only tried doing "Automatic" to see if that would fix the problem. It didn't.

The firewall is running I just can't bring up the page that allows me to turn it off and on.
After a bit of research I turned it off in the registry. So, that isn't a problem.
I just don't understand why I cannot bring up the page that allows me to turn it off and on.
"Windows Security Suite" works fine. I can bring up that page without any problem.
That is how I know the firewall has been turned off.
I really hate it when the computer is smarter than I am ;-}}
Anyway, it is getting tedious so I think I will live with it.
Thanks For your help,
Chuck

ka6uup · « **Reply #11 on:** July 01, 2013, 11:15:19 pm »

OOPS I should have said Windows Security Center not Security Suite
Chuck

Rick · « **Reply #12 on:** July 02, 2013, 10:43:38 am »

Quote from: ka6uup on June 30, 2013, 04:20:17 pm

I disconnected the network and disabled Norton Antivirus, Firewall and Tamper Protection.
I ran "Repair WMI" and "Repair Volume Shadow copy" without success.
Below are the error messages from "Event Viewer."
I hope they help.
Chuck

Event Type:   Error
Event Source:   PerfNet
Event Category:   None
Event ID:   2004
Date:      6/30/2013
Time:      9:22:54 AM
User:      N/A
Computer:   P5N2M7
Description:
Unable to open the Server service. Server performance data will not be returned. Error code returned is in data DWORD 0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I remember something about needing to rebuild the WMI registry
Please check here too for this error message;

http://www.microsoft.com/technet/support/ee/SearchResults.aspx?Type=0&Product=Windows%20Operating%20System&Message=Error%20code%20returned%20is%20in%20data%20DWORD%200

Data:
0000Event Type:   Error
Event Source:   PerfNet
Event Category:   None
Event ID:   2004
Date:      6/30/2013
Time:      9:22:54 AM
User:      N/A
Computer:   P5N2M7
Description:
Unable to open the Server service. Server performance data will not be returned. Error code returned is in data DWORD 0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À : 34 00 00 c0 4..À

Event Type:   Error
Event Source:   VSS
Event Category:   None
Event ID:   4099
Date:      6/30/2013
Time:      9:15:36 AM
User:      N/A
Computer:   P5N2M7
Description:
Volume Shadow Copy Service error: Cannot install the component C:\Program Files\Tweaking.com\Windows Repair (All in One)\SWPRV.DLL into the COM+ application 'MS Software Shadow Copy Provider' [0x80110401].

(for now, it would be a better idea to uninstall All in one)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 43 41 44 43 41 44 4d 43 CADCADMC
0008: 31 39 38 00 00 00 00 00 198.....
0010: 43 41 44 43 41 44 4d 43 CADCADMC
0018: 31 36 30 00 00 00 00 00 160.....

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:37 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\SYSTEM32\WBEM\WINDOWSSEARCHENGINE.MOF while recovering repository file.

(you need to re-install the WBEM services) perhaps shane can help you with that?

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:36 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MOF\SERVICEMODEL.MOF while recovering repository file.

(Uninstall and reinstall 4.0 frame work and get all the updates!
Also, Please download and run system readiness tool, the latest version as it will also fix many of these issues...)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:36 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODEL.MOF while recovering repository file.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:36 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CLR.MOF while recovering repository file.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:35 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET.MOF while recovering repository file.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.\

Event Type:   Error
Event Source:   WinMgmt
Event Category:   None
Event ID:   4
Date:      6/30/2013
Time:      9:12:28 AM
User:      N/A
Computer:   P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V1.1.4322\ASPNET.MOF while recovering repository file.

(You need to reinstall each framework version)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

ka6uup · « **Reply #13 on:** July 02, 2013, 11:49:18 am »

I will do this.
Thanks,
Chuck

Willy2 · « **Reply #14 on:** July 02, 2013, 04:22:44 pm »

Try this to fix the firewall problem:

Run these commands in a CMD.exe window (with admin rights):
- regsvr32 /s "C:\Windows\System32\FirewallControlPanel.dll"

If this doesn't help then run the second command as well.
- regsvr32 /s "C:\Windows\system32\FirewallAPI.dll"

(@Shane: Perhaps these 2 commands need to be included in "Repair Firewall" as well ?)

Yes, try to re-install MS Framework.
No, judging by the name of that one *.mof file, you need to re-install/repair/restart "Windows Search". But I haven't got a clue how to do that.

And let us/me know if it has helped you !

ka6uup · « **Reply #15 on:** July 02, 2013, 06:30:20 pm »

First of all I noticed I had not stated that this is on a Windows XP sp3 system. sorry about that. ( if it makes any difference)
I then uninstalled Windows Repair (all in one.)
Secondly, this is my wife's computer and although I am the one who maintains it, .net Framework 4.0
was not installed on it, which was my fault.
I installed .net 4.0 and also installed Windows Search 4.0.
I than ran the above commands, both with and without the quotation marks????? from the start/run window.
It has made no difference in the problem.

Rick · « **Reply #16 on:** July 03, 2013, 12:51:57 am »

Have you tried these?

http://support.microsoft.com/mats/windows_security_diagnostic/

http://support.microsoft.com/mats/windows_firewall_diagnostic/

Willy2 · « **Reply #17 on:** July 03, 2013, 07:57:58 am »

Windows XP ? Yes, it ABSOLUTELY DOES make a difference !!! The two files mentioned before are Win 7 files. See if you got a file called "c:\windows\system32\Firewall.cpl". If not, then a copy of that file could be in the "c:\windows\servicepackfiles\i386\" subfolder and copy that to the system32 subfolder.

Did you do a system file check ? (step 3) in "Windows Repair" (sfc /scannow) ? Perhaps more files are missing.

ka6uup · « **Reply #18 on:** July 03, 2013, 08:29:20 am »

Yes, firewall.cpl is in system32.
I did both chkdsk and system file checker day before yesterday.
Both showed no problems.
Chuck

Willy2 · « **Reply #19 on:** July 03, 2013, 11:14:20 pm »

Some last suggestions:
- Event viewer showed two errors with "Perfnet", "event ID 2004", "Server Service", "Performance info couldn't be returned". Some GOOGLE-ing revealed that this is a "networking" problem. You could do more research with these keywords. For me, it suggests once more that WMI could be faulty/broken, fails to pull up the required info for the firewall. Or perhaps the firewall fails to pull up info from the performance counters/monitors.
- Does XP have a process/service "Services" (as well) ?
- Did you recently install some new drivers for e.g. the network(ing) hardware ? Those drivers could contain some faulty program code.
- Try to re-install the drivers for the network hardware. Those drivers also register info Windows needs. Some think Windows is very smart but the info Windows pulls up, is provided by software/drivers. I wouldn't be surprised that WMI info (*.mof) is installed by software (drivers) as well.

Willy2 · « **Reply #20 on:** July 04, 2013, 12:08:02 pm »

Quote from: Shane on July 01, 2013, 07:45:27 pm

Also another things that concerns me, in the log you posted "C:\Program Files\Tweaking.com\Windows Repair (All in One)\SWPRV.DLL" that file isnt part of my program.

Shane

Perhaps WR tries to update the registry with the wrong "swprv.dll" reg info ?

ka6uup · « **Reply #21 on:** July 04, 2013, 12:27:33 pm »

Just an update.
This morning I booted the computer and tried to access the firewall control panel.
It gave me the same message.
However, Event Viewer shows no errors or warnings?????
Chuck

Willy2 · « **Reply #22 on:** July 04, 2013, 01:02:10 pm »

BTW: "Repair VSS" contains a bug. The VSS service is not being turned on (again) after the repair has finished.

Shane · « **Reply #23 on:** July 05, 2013, 03:39:14 pm »

With so many odd things, I wonder if doing a repair install is worth the next step instead of a fresh install.

Something to consider
http://michaelstevenstech.com/XPrepairinstall.htm

It is possible it is a .net problem since you did have erros with it.

Try the .net removal tool, reboot then install .net again
http://blogs.msdn.com/b/astebner/archive/2008/08/28/8904493.aspx

Shane

Willy2 · « **Reply #24 on:** July 05, 2013, 06:31:30 pm »

I am curious what that Macrium VSS repair tool adds to the registry. Because Macrium offers a procedure to "repair VSS" that's very similar to what WR's "repair VSS" does.
http://kb.macrium.com/KnowledgebaseArticle50010.aspx

What I consider to be the main difference is that WR's "Repair VSS" doesn't start two services at the end ("net start vss" & "net start swprv") and perhaps the sequence of a number of commands. When I run WR's "Repair VSS" on my Win 7 system then nothing goes wrong. When I run Registry Backup afterwards then VSS does properly function, absolutely no problems.

@Ka6uup:
- when you run the text file (see attachment) as a *.bat file with admin rights, does VSS function properly afterwards ? Or is then VSS "broken" again ?
- Can you post the content of the following two keys (and all sub keys) in the registry:
"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS]" and
"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\swprv]"