Author Topic: snap-in failed to load with error code 0x6D9 at windows 7 firewall (Read 47369 times)

peterpanx · « **on:** February 17, 2013, 03:48:46 pm »

Hi. i have a problem few days now.i try to open my windows 7 firewall but nothing happen's.i'm trying then to open the windows firewall advanced security but i get an error that the 'snap-in failed to load with error code 0x6D9 .i'm searching for a solution for hours,i try a several tips but i get no results.I also did a full scan with security essentials,super antispyware,Malware bytes,Eset on line scanner,TDSS rootkit removing tool but the computer seems to be clean.Also i have run Tweaking.com - Windows Repair (All in One) to repair the firewall,with no luck.
always when i restart i take message on start up that the " the windows could not connect to the group policy client service" and when i open a program after some resets on the firewall i did while try various tips from forum's,i get the message if i want to allow on the firewall the each connection of specific program,seems that the firewall is working but i cant lunch the window to edit it.
Can somebody help me ?thanks

Shane · « **Reply #1 on:** February 17, 2013, 04:05:26 pm »

What repairs did you run in my Windows Repair tool?

Shane

peterpanx · « **Reply #2 on:** February 17, 2013, 05:48:27 pm »

thanks for your reply.
I repair the windows 7 ultimate with this option enable:
Reset Registry Permissions,Reset File Permissions,Register System Files,Repair WMI,Repair Windows Firewall,Repair MDAC/MS Jet,Remove policies Set By Infections,Repair Winsock % Dns cache,Repair CD/DVD Missing/Not Working/Repair File Associations

Shane · « **Reply #3 on:** February 17, 2013, 06:07:24 pm »

OK lets make sure some services got put back.

In the registry see if you have these keys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc

My repair tool puts these back, but lets check to make sure they are there

Shane

peterpanx · « **Reply #4 on:** February 17, 2013, 06:12:40 pm »

yes i have this keys

Shane · « **Reply #5 on:** February 17, 2013, 06:15:09 pm »

Ok good, now go and see if those services are running, and if they are not if they will start.

Shane

peterpanx · « **Reply #6 on:** February 17, 2013, 06:21:53 pm »

how i can do this?

Shane · « **Reply #7 on:** February 17, 2013, 06:34:33 pm »

Right click on computer and go to manage.

IN there you will see services on the left.

Shane

peterpanx · « **Reply #8 on:** February 18, 2013, 12:01:02 am »

ok,i found BFE (Based filter Engine) but i cant find SharedAccess or MpsSvc or something similar,

Shane · « **Reply #9 on:** February 19, 2013, 02:17:47 pm »

MpsSvc is Windows Firewall service.

And sharedaccess is Internet Connection Sharing (ICS)

Shane

peterpanx · « **Reply #10 on:** February 19, 2013, 02:25:57 pm »

Windows Firewall is running (started)
Internet Connection Sharing (ICS) is not running and when i try to start the service i get this message: "the Internet Connection Sharing (ICS) service on local computer started and then stopped.Some services stop automatically if they are not in use by other services or programs. "

Shane · « **Reply #11 on:** February 19, 2013, 02:27:11 pm »

Thats a normal error and it should do that.

So no problems with the services that I can see. DO you get any errors opening anything else in Windows or is the firewall the only one?

Shane

peterpanx · « **Reply #12 on:** February 19, 2013, 02:29:55 pm »

the firewall seems to be the only one.No error messages

Shane · « **Reply #13 on:** February 19, 2013, 02:34:05 pm »

Lets check this, let me know if you have this folder and file on your system

Quote

This firewall issue is commonly found on vista and windows 7 (64 BIT OS)

This is symptom for rootkit on 64 bit systems

if you find a folder called system64

C:/WINDOWS/SYSTEM64(not the sysWOW64)

and a file called consrv.dll

C:/WINDOWS/SYSTEM32/CONSRV.DLL

You're infected by zero access rootkit.It is recommended to contact malware removal forums to remove it

Shane

peterpanx · « **Reply #14 on:** February 19, 2013, 02:35:37 pm »

i have 32 bit version of windows 7 ultimate.

Shane · « **Reply #15 on:** February 19, 2013, 02:36:45 pm »

Ok but let me know if you have this file or not
C:/WINDOWS/SYSTEM32/CONSRV.DLL

Also do you know how to check permissions on reg keys?

Shane

peterpanx · « **Reply #16 on:** February 19, 2013, 02:41:19 pm »

no,i dont have this file,and no i dont know how to check permissions on reg keys

Shane · « **Reply #17 on:** February 19, 2013, 02:44:34 pm »

Quote

Now,Press Windows+ R key and type

regedit and click ok

go to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE

Right click on it-permissions

Post a screen shot of the permissions tab for me

Shane

peterpanx · « **Reply #18 on:** February 19, 2013, 02:48:04 pm »

here is the screenshot

Shane · « **Reply #19 on:** February 19, 2013, 02:51:46 pm »

Ok all services are installed and working, all permissions seem to be fine as well.

I wonder if there is other services it needs. See if you have these.

Security center - wscsvc

Windows defender - windefend

Shane

peterpanx · « **Reply #20 on:** February 19, 2013, 02:58:56 pm »

Security center - wscsvc is running in automatic (delayed start)
Windows defender (ι did not find any word as "windefend") is running at manual mode and whei i try to start it i take the same error message as before

Shane · « **Reply #21 on:** February 19, 2013, 03:01:21 pm »

Ok Windows defender shouldnt be giving an error.

Extract this zip file and apply the reg file and see if you can get that service to start.

Shane

peterpanx · « **Reply #22 on:** February 19, 2013, 03:08:20 pm »

i cant import it .the error message says:
cannot import windefend.reg.No all data was successfully written to the registry.Some keys are open by the system or other processes

Shane · « **Reply #23 on:** February 19, 2013, 03:12:18 pm »

Permissions problem then.

Run my repair tool again, this time only run the reg permissions repair. When it is done try the reg file again and let me know.

In fact go check the reg location in the reg and post a screen shot of the permissions for me before you run the repair

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend

Shane

peterpanx · « **Reply #24 on:** February 19, 2013, 03:18:15 pm »

here is the capture
shall i proceed to repair the permissions with the repair tool ?