[SOLVED] Windows Firewall not working

[dwalk1989]

I used Avira Anti-virus for a long time and didn't even bother with Windows Firewall until I decided to try to host games in Warcraft 3, which requires the port 6112 to be open. I'd open the port and it wouldn't allow me to host. My friend on the same router hosts fine. I figured it was software blocking it. I uninstalled with Revo Uninstaller and it still doesn't allow me to host, even with the port clearly open.

If you guys think you might know the issue with that problem, let me know, because that's all I really care about.

Anyway, Windows Firewall doesn't turn on (gives me an error 6801 when I try to start the service, w/ the dependencies running). This might be related to the hosting issue... I have no idea.

I've tried googling and honestly I can't figure this out for the life of me. I think it might be something registry-related but, again, I can't find anything relevant that helps me.

It seems a lot of people have this problem...Can anyone here help me?

[dwalk1989]

:( .

[polishpaul]

windows firewall being off would not prevent you from hosting as its not blocking anything. If your friend on the same router is hosting, then that port is only forwarded to him. Externally, to the world, you're both seen as the same IP. On you router, you most likely have port forwarding enabled so that any connection on 6112 is then routed to your friend's PC. There can only be one forward. So a connection comes in at xx.xx.xx.xx:6112 -> forwarded to -> 192.168.1.2:6112 (lets pretend that's your friend's IP).

To solve your issue, you have to change port forwarding so that it forwards to your PC (your IP).

As far as the windows firewall not turning on, you need to paste the exact error, or even better, look in the event viewer and copy (button under arrows) the even and paste it here. Even better, google that error :) see this for more help: http://www.modernstreet.com/windows/...-event-viewer/

[dwalk1989]

My friend actually told me the bit about how only one of us can be forwarded at a time.. I closed his ports and still couldn't host. idk, I think it's Vista..

[polishpaul]

how did you close his ports?

Did you readjust the port forwarding rule to use your IP instead of his? Are you sure your IP is not changing after you boot up? You simply need to change the IP in the router's port forwarding configuration (rule).

If windows firewall, and windows advanced firewall are off (i can't remember if they're the same service) and IPSEC service is off as well, then your windows firewalls are not blocking anything. Are you using any other security software or software firewalls?

When hosting, alt-tab, start command prompt and do the following:
netstat -an | find ":6112"
This should show you if your PC is actually listening on that port (game has to be running and you have to be setup for hosting).
if the above command does not work try
netstat -an
and search for an IP address:6112 (could be all 0's or something else)

this part is important to make sure your PC is actually "listening" on that port.

[dwalk1989]

Thanks for the reply.

I open the ports 6112-6119, which are necessary to host a WC3 game. They are open for my IP address only. I typed in that command you said while hosting a game and it for 6112 it said "LISTENING," but still, no one could join my game. When I run the PFPortChecker from portforwarding.com, it lists it as closed or unreachable..

The Windows Firewall service is "stopped," but I couldn't find those other two you mentioned.

[polishpaul]

Ok, so you system is listening, windows firewall is not blocking... so i wonder if the rule is setup correctly? is it enabled?

I'm not on my Vista box now, so i'd double check the windows firewall, but... once you turned off the windows firewall service, go to (i think) admin tools and windows firewall with advanced options. See if that's still working...

But anyway, once i check on my vista box i'll try to get that part figured out.

also, what exactly is the port forwarding rule? can you take a screenshot?

[dwalk1989]

Actually I found something called IPsec..when I disable it, my internet stopped working, so I turned it back on. :D

WC3 just specifies to open ports 6112-6119. On my old XP desktop, I could easily go into the router page and open the ports and be good to go, but I can't on this desktop.

And when I go to the advanced windows firewall security options under admin tools, it says:

"X There was an error opening the Windows Firewall with Advanced Security snap-in.

The Windows Firewall with Advanced Security snap-in failed to load. Restart the Windows Firewall service on the computer that you are managing. Error code: 0x6D9."

Except when I try to restart the service, it gives me error 6801.

[polishpaul]

stopping IPSEC turned off your internet? That's odd, that's actually the underlying layer that the firewall controls (the nuts and bolts)...

Are you sure you're not using any other protection/firewall software? Given everything we're going over and the firewall issue you're having, lets look there some more.

You'll need to try to start the Windows Firewall service to generate that error, then go to the event viewer, look in the application or system logs, and find the error message there. Copy it and paste it here. There's a copy button when you look at the details of the event (double click the event, gray box pops up, has button on it).

[dwalk1989]

I tried to start it and found this message in the event viewer under the system tab in Window logs:

The Windows Firewall service terminated with service-specific error 6801 (0x1A91).

When I press the copy button and paste it here, it shows all of this:

Log Name: System
Source: Service Control Manager
Date: 8/24/2009 5:44:03 PM
Event ID: 7024
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: Derek-PC
Description:
The Windows Firewall service terminated with service-specific error 6801 (0x1A91).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Service Control Manager" Guid="{555908D1-A6D7-4695-8E1E-26931D2012F4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="49152">7024</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2009-08-24T22:44:03.000Z" />
<EventRecordID>60228</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>Derek-PC</Computer>
<Security />
</System>
<EventData>
<Data Name="param1">Windows Firewall</Data>
<Data Name="param2">6801 (0x1A91)</Data>
</EventData>
</Event>

[dwalk1989]

In fact, on the log, it has that error many times. Like in one sequence it has a log for the same error every 2 seconds for roughly 4 minutes, and they were dated to 8/14/2009. dunno.

[polishpaul]

so you're not running any firewall software? anti virus? Noroton by any chance...

Try this (biting off another froum)
Step 1: Reset Windows Firewall
========
1. Click Start->All Programs->Accessories.
2. Right click "Command Prompt" and select "Run as administrator".
3. Type the following commands and press Enter after each one:

netsh firewall reset
exit

Then, restart the computer to test the issue.

If the issue persists, please proceed with the next step:

Step 2: Clean Boot
========
1. Click Start, type msconfig in the Start Search box and press Enter.
2. Switch to the Startup tab and click "Disable all".
3. Switch to the Services tab, check the "Hide all Microsoft services"
option and click "Disable all".
4. Click OK.

if none of this helps, download hijackthis (http://download.cnet.com/Trend-Micro...-10227353.html) and install it. MAKE SURE to rename the executable (not the shortcut) to something else without the hijackthis in it.. like TMHJT.exe Then make a new shortcut for yourself to this newly named exe. This is to hide this program from certain baddies. Anyway, run the scan and paste it here.

[dwalk1989]

No, no firewall software at all. Here's the log from HJT:

can saved at 7:59:34 PM, on 8/24/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Windows Live\Toolbar\wltuser.exe
C:\Program Files (x86)\Ventrilo\Ventrilo.exe
C:\Program Files (x86)\Trend Micro\HijackThis\23151323123.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - .DEFAULT User Startup: Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (User 'Default user')
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.systemrequirementslab.com...reqlab_srl.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/ca..._2.3.9.113.cab
O16 - DPF: {4E218431-2F07-40BD-A9D3-035324C1F13F} (DyynoX Class) - http://webserver.dyyno.com/tng/dyyno...B.1.0.0.26.CAB
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{89BF5D41-9B7C-40B4-B1C1-9B23B7AF39F8}: NameServer = 68.94.156.1,68.94.157.1
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Remote Procedure Call (RPC) Locator (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 6303 bytes

[polishpaul]

hmmmmmmmmm...

try this, from another computer on your network telnet your IP on port 6112 (once its listening on it):
telnet 192.168.1.x 6112

if it doesn't connect, something on your PC is still blocking....

[dwalk1989]

I dunno what you mean by "telnet your IP on 6112 from another computer."

[dwalk1989]

Is it possible remnants of the program "Advanced System Care" could be doing something? I uninstalled it with revo uninstaller but I still see the option to "Boost with Advanced System Care" when I right click a program, and it also gives me an error at the bootup that tells me it can't open.

Heh..I was thinking about upgrading to Service Pack 2 (hoping it might fix it), but I've read benchmarks and read peoples comments saying the HDD performance is slower w/ SP2 (i.e. bootup/load times).

:(

[dwalk1989]

So I downloaded the firewall "Zone Alarm," then disabled it.

Now I can host wc3 games.

...

[polishpaul]

hah! Glad to hear you got it working. did you have it installed before? Could it have been a incomplete uninstall? I've had mad problems with that software...

[dwalk1989]

Nope, never installed it. I just read that it worked for someone, and it worked for me too..hmm