Cannot start Windows Firewall

davel1234 · 02-01-2009, 04:46 PM

I have just cleaned my PC of malware with the help of 'Chemist' on the Spyware Forum thread:

http://www.techsupportforum.com/secu...ml#post1943292

I now cannot start windows firewall

Done method 1 and 2 at
http://support.microsoft.com/kb/920074

tried 'netsh winsock reset'
tried 'netsh firewall reset'

still cannot start the service.. any ideas

Thanks in advance

BoT · 02-01-2009, 04:59 PM

do you have any other firewall installed.
did you check the running services in the task manager for a hidden process that acts as a firewall?
did you try to start the service under "computer management"?

davel1234 · 02-02-2009, 12:32 PM

Hi

No other Firewall or anything acting as a Firewall as far as I can see. I run AVG anti virus.

When I try to start the service manually in computer/manage I receive the error:

Could not start the Windows Firewall/Internet Connection Sharing (ICS) service on Local Computer.
Error 126: The specified module could not be found

BoT · 02-02-2009, 10:40 PM

make sure that the dependent services are running as well and that the ics entry in the registry has the correct values.
you can find out about the dependentcies by right-clicking on the service in computer management and select properties, then go to the dependencies tab.
most likely network connection, wmi and rpc.
the registry entry is in HKLM\system\currentcontrolset\services\sharedaccess

davel1234 · 02-03-2009, 04:14 PM

Hi
Thanks for your reply

You are right about the dependent services. I have checked they match and they are all running.

What do I need to check in the registry. I have found registry entry HKLM\system\currentcontrolset\services\sharedaccess
What setting do I need to check?

Thanks

BoT · 02-03-2009, 11:26 PM

let me see if i can post a screeny next time i get my hands on an xp machine.
this is xp? which service pack?
btw, did you install or uninstall any SP's?

there should be a an actual file location in the reg key that points to the file
check that the file is actually in the location

davel1234 · 02-04-2009, 02:35 AM

XP SP3
SP3 recently installed but I think the problem was on before that.

**vladimirb** · 02-04-2009, 02:45 AM

Maybe you should try SFC /SCANNOW to replace missing or corrupted files...
Put XP CD, go
START > RUN... > type SFC /SCANNOW and hit Enter...
Restart PC after it finishes scan...

If this does not help, try System Repair...

Hope this will help you mate...

davel1234 · 02-07-2009, 07:33 AM

Quote:

Originally Posted by vladimirb

Maybe you should try SFC /SCANNOW to replace missing or corrupted files...
Put XP CD, go
START > RUN... > type SFC /SCANNOW and hit Enter...
Restart PC after it finishes scan...

If this does not help, try System Repair

Tried SCANNOW and XP repair

Still cannot start Firewall!

**vladimirb** · 02-07-2009, 09:04 AM

What anti-virus software you have???
Did you scan your PC????

davel1234 · 02-07-2009, 01:08 PM

Quote:

Originally Posted by vladimirb

What anti-virus software you have???
Did you scan your PC????

AVG anti-virus

The PC is clean now. Spent a lot of time and actions with user 'Chemist' on the other virus forum. Cleaned PC of malware. Running fine now. Just no Firewall.

Link:
http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/resolved-hjt-threads/339861-help-trojans.html

**bilbus** · 02-08-2009, 02:00 AM

net start sharedaccess

What error do you get?

davel1234 · 02-08-2009, 05:37 AM

Quote:

Originally Posted by bilbus

net start sharedaccess

What error do you get?

net start sharedaccess
The Windows Firewall/Internet Connection Sharing (ICS) service is starting.
The Windows Firewall/Internet Connection Sharing (ICS) service could not be started.

A system error has occurred.

System error 126 has occurred.

The specified module could not be found.

___________________________________________

sc query sharedaccess

SERVICE_NAME: sharedaccess
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 126 (0x7e)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

**vladimirb** · 02-08-2009, 09:10 AM

I found this possible solution, never tried it but it could work:

This problem occurs if the Srvsvc.dll file is missing. To resolve this problem, extract a new copy of the Srvsvc.dll file from the Windows XP disk to the %systemroot%\system32 folder on the computer's hard disk. To do this, follow these steps:

* Insert the Windows XP disk into the CD drive.
* Click Start, click Run, type cmd in the Open box, and then click OK
* At the command prompt, type the following command, and then press ENTER.

expand CD drive:\i386\srvsvc.dl_ %systemroot%\system32\srvsvc.dll

* Similarly, expand srv.sys file to the drivers folder. Use the following command:

expand CD drive:\i386\srv.sy_ %systemroot%\system32\drivers\srv.sys

Make sure that there is a character space between "srvsvc.dl_" and "%systemroot%."

davel1234 · 02-08-2009, 10:04 AM

Tried both commands on first command:

Error:
Can't open output file: c:\windows\system32\srvsvc.dll

I did a search for Srvsvc.dll on C and it is there in C:\WINDOWS\system32

**vladimirb** · 02-09-2009, 12:09 AM

Yeah, it is there but it is in some way corrupted or, as it is clearly stated on Microsoft support site, spaces are added in registry key...

Try this:

This problem occurs when you have spaces added at the end of the Value specified in the TYPE Key in:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

1. Navigate to the following Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

2. Double click on the TYPE Value and remove the extra space after the value. Extra spaces entered after the Value are shown as a blue selected text.

3. Restart the computer.

Hope this will help you mate...
Keep us posted...

davel1234 · 02-09-2009, 11:07 AM

No space after value

value = NTP

Qjet · 10-22-2009, 03:08 PM

This is an old post but I'm convinced the OP is suffering from the same problem I was. The answer ended up being painfully obvious. A virus comes in, alters or replaced the windows firewall, antivirus removes it, and you get that error: Error 126: The specified module could not be found

SFC /scannow didn't seem to detect the problem, which is greatly confusing, so doing it manually will work.

The file you need is ipnathlp.dll (i think) double check your system32 folder to see if it is missing, If it is, grab it off the XP CD (this cd better have SP2 or greater on it) (methods mentioned above should work) Or off another working XP installation.

This was the problem on my machine. Sorry if this is a necro post, its just this thread turns up on google and I'm adding to possible solutions.

02-01-2009, 04:46 PM	#1 (permalink)
davel1234 Registered User Join Date: Jan 2009 Posts: 23 OS: XP SP3	Cannot start Windows Firewall I have just cleaned my PC of malware with the help of 'Chemist' on the Spyware Forum thread: http://www.techsupportforum.com/secu...ml#post1943292 I now cannot start windows firewall Done method 1 and 2 at http://support.microsoft.com/kb/920074 tried 'netsh winsock reset' tried 'netsh firewall reset' still cannot start the service.. any ideas Thanks in advance

02-01-2009, 04:59 PM	#2 (permalink)
BoT Registered User Join Date: Dec 2008 Location: earth Posts: 447 OS: Microsoft Windows Vista Ultimate x64 My System	Re: Cannot start Windows Firewall do you have any other firewall installed. did you check the running services in the task manager for a hidden process that acts as a firewall? did you try to start the service under "computer management"? __________________ MainStation: Q9450@3.6 \| ASUS P5Q-E \| OCZ Platinum 4x2Gb PC8500 \| eVGA GTX260 \| WD VRaptor

02-02-2009, 12:32 PM	#3 (permalink)
davel1234 Registered User Join Date: Jan 2009 Posts: 23 OS: XP SP3	Re: Cannot start Windows Firewall Hi No other Firewall or anything acting as a Firewall as far as I can see. I run AVG anti virus. When I try to start the service manually in computer/manage I receive the error: Could not start the Windows Firewall/Internet Connection Sharing (ICS) service on Local Computer. Error 126: The specified module could not be found

02-02-2009, 10:40 PM	#4 (permalink)
BoT Registered User Join Date: Dec 2008 Location: earth Posts: 447 OS: Microsoft Windows Vista Ultimate x64 My System	Re: Cannot start Windows Firewall make sure that the dependent services are running as well and that the ics entry in the registry has the correct values. you can find out about the dependentcies by right-clicking on the service in computer management and select properties, then go to the dependencies tab. most likely network connection, wmi and rpc. the registry entry is in HKLM\system\currentcontrolset\services\sharedaccess __________________ MainStation: Q9450@3.6 \| ASUS P5Q-E \| OCZ Platinum 4x2Gb PC8500 \| eVGA GTX260 \| WD VRaptor

02-03-2009, 04:14 PM	#5 (permalink)
davel1234 Registered User Join Date: Jan 2009 Posts: 23 OS: XP SP3	Re: Cannot start Windows Firewall Hi Thanks for your reply You are right about the dependent services. I have checked they match and they are all running. What do I need to check in the registry. I have found registry entry HKLM\system\currentcontrolset\services\sharedaccess What setting do I need to check? Thanks

02-03-2009, 11:26 PM	#6 (permalink)
BoT Registered User Join Date: Dec 2008 Location: earth Posts: 447 OS: Microsoft Windows Vista Ultimate x64 My System	Re: Cannot start Windows Firewall let me see if i can post a screeny next time i get my hands on an xp machine. this is xp? which service pack? btw, did you install or uninstall any SP's? there should be a an actual file location in the reg key that points to the file check that the file is actually in the location __________________ MainStation: Q9450@3.6 \| ASUS P5Q-E \| OCZ Platinum 4x2Gb PC8500 \| eVGA GTX260 \| WD VRaptor

02-04-2009, 02:35 AM	#7 (permalink)
davel1234 Registered User Join Date: Jan 2009 Posts: 23 OS: XP SP3	Re: Cannot start Windows Firewall XP SP3 SP3 recently installed but I think the problem was on before that.

02-04-2009, 02:45 AM	#8 (permalink)
vladimirb Mentor Hardware Team Join Date: Mar 2008 Location: Banja Luka, Serb Republic Posts: 3,669 OS: xp pro sp3, Server 2003, Windows 7 Professional x64bit My System	Re: Cannot start Windows Firewall Maybe you should try SFC /SCANNOW to replace missing or corrupted files... Put XP CD, go START > RUN... > type SFC /SCANNOW and hit Enter... Restart PC after it finishes scan... If this does not help, try System Repair... Hope this will help you mate... __________________ MCP - MCSA Cisco SMB Account Manager

02-07-2009, 09:04 AM	#10 (permalink)
vladimirb Mentor Hardware Team Join Date: Mar 2008 Location: Banja Luka, Serb Republic Posts: 3,669 OS: xp pro sp3, Server 2003, Windows 7 Professional x64bit My System	Re: Cannot start Windows Firewall What anti-virus software you have??? Did you scan your PC???? __________________ MCP - MCSA Cisco SMB Account Manager

02-08-2009, 02:00 AM	#12 (permalink)
bilbus TSF Enthusiast Join Date: Aug 2006 Posts: 949 OS: OS2 Warp	Re: Cannot start Windows Firewall net start sharedaccess What error do you get?

02-08-2009, 09:10 AM	#14 (permalink)
vladimirb Mentor Hardware Team Join Date: Mar 2008 Location: Banja Luka, Serb Republic Posts: 3,669 OS: xp pro sp3, Server 2003, Windows 7 Professional x64bit My System	Re: Cannot start Windows Firewall I found this possible solution, never tried it but it could work: This problem occurs if the Srvsvc.dll file is missing. To resolve this problem, extract a new copy of the Srvsvc.dll file from the Windows XP disk to the %systemroot%\system32 folder on the computer's hard disk. To do this, follow these steps: * Insert the Windows XP disk into the CD drive. * Click Start, click Run, type cmd in the Open box, and then click OK * At the command prompt, type the following command, and then press ENTER. expand CD drive:\i386\srvsvc.dl_ %systemroot%\system32\srvsvc.dll * Similarly, expand srv.sys file to the drivers folder. Use the following command: expand CD drive:\i386\srv.sy_ %systemroot%\system32\drivers\srv.sys Make sure that there is a character space between "srvsvc.dl_" and "%systemroot%." __________________ MCP - MCSA Cisco SMB Account Manager

02-08-2009, 10:04 AM	#15 (permalink)
davel1234 Registered User Join Date: Jan 2009 Posts: 23 OS: XP SP3	Re: Cannot start Windows Firewall Tried both commands on first command: Error: Can't open output file: c:\windows\system32\srvsvc.dll I did a search for Srvsvc.dll on C and it is there in C:\WINDOWS\system32 Last edited by davel1234; 02-08-2009 at 10:09 AM.

02-09-2009, 12:09 AM	#16 (permalink)
vladimirb Mentor Hardware Team Join Date: Mar 2008 Location: Banja Luka, Serb Republic Posts: 3,669 OS: xp pro sp3, Server 2003, Windows 7 Professional x64bit My System	Re: Cannot start Windows Firewall Yeah, it is there but it is in some way corrupted or, as it is clearly stated on Microsoft support site, spaces are added in registry key... Try this: This problem occurs when you have spaces added at the end of the Value specified in the TYPE Key in: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters 1. Navigate to the following Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters 2. Double click on the TYPE Value and remove the extra space after the value. Extra spaces entered after the Value are shown as a blue selected text. 3. Restart the computer. Hope this will help you mate... Keep us posted... __________________ MCP - MCSA Cisco SMB Account Manager

02-09-2009, 11:07 AM	#17 (permalink)
davel1234 Registered User Join Date: Jan 2009 Posts: 23 OS: XP SP3	Re: Cannot start Windows Firewall No space after value value = NTP

10-22-2009, 03:08 PM	#18 (permalink)
Qjet Registered User Join Date: Jul 2007 Posts: 6 OS: XP Professional	Re: Cannot start Windows Firewall This is an old post but I'm convinced the OP is suffering from the same problem I was. The answer ended up being painfully obvious. A virus comes in, alters or replaced the windows firewall, antivirus removes it, and you get that error: Error 126: The specified module could not be found SFC /scannow didn't seem to detect the problem, which is greatly confusing, so doing it manually will work. The file you need is ipnathlp.dll (i think) double check your system32 folder to see if it is missing, If it is, grab it off the XP CD (this cd better have SP2 or greater on it) (methods mentioned above should work) Or off another working XP installation. This was the problem on my machine. Sorry if this is a necro post, its just this thread turns up on google and I'm adding to possible solutions.