XP always tells me Windows Firewall is disabled on bootup, but it's not

On my old Windows XP SP3 machine I always get a Security Center warning bubble telling me Windows Firewall is disabled for my network connection when I turn the PC on and Windows loads. After 30 seconds or so it goes away, likely because it realizes the firewall is indeed enabled - but why is it saying it isn't when it boots up? Is there any way to prevent this?

It started doing it a few weeks ago, not sure what I could've changed to make it think the firewall was disabled.

 

You probably have other background processes that take over precedent during start up. I would not be bothered with it as long as the warning goes away

cheers ...

 

There's next to nothing running at startup on the PC in question and definitely nothing new added since the problem began. I suspect it may have something to do with Malwarebyte Anti-Malware which I had just recently installed prior to the issue beginning. I remember the scan saying something about optimal registry settings for Security Center now.

Hm.

 

Clean up the junk and defrag your computer.

 

Please read the other posts in a thread and understand the problem being described before offering advice in the future, thanks.

 

As you eluded to in a previous post I suspect Malwarebytes. I recently installed it and looking for the free version and now it installs the full blown version that handles everything for you. After the trail period it disables all the pay features.

Others have complained regarding registry issues. Malwarebytes Anti-Malware - Free software downloads and software reviews - CNET Download.com

"Version: Malwarebytes Anti-Malware 1.51.1.1800

"Product Good Support Terrible"

by larrydits on August 4, 2011

Pros: This product cured the problem when nothing else would.

Cons: This product disrupted the registry on another program and when I contacted their support team, their reply was " not our problem". NOT GOOD

Summary: I would think again before I would purchase this product after the response I got from their alledged support staff. Not much support at all. I can get more help from the IRS."

 

The Windows firewall can be disabled by a number of things. His advice was not without merit, and was certainly well intentioned.

"Junk" and "fragmentation" are certainly possibilities. Assuming you don't have a variety of junk or programs starting, it could also be a dependent service that the firewall service is waiting on.

Depending on how confident you are in using the registry editor, take a look at the following key

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess

What is the data in the string DependOnGroup? DependOnService? What about the Dword "START"?

There may be even something else in there that is not common.

This would be a standard "clean" registry entry

Code:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"DependOnGroup"=hex(7):00,00
"DependOnService"=hex(7):4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,57,00,69,00,\
  6e,00,4d,00,67,00,6d,00,74,00,00,00,00,00
"Description"="Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network."
"DisplayName"="Windows Firewall/Internet Connection Sharing (ICS)"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"ObjectName"="LocalSystem"
"Start"=dword:00000002
"Type"=dword:00000020

(of course some of the entries are in hexidecimal)

 

Some background processes (or services) will not show up on task manager once the system has been started. I tend to agree with you that Malwarebyte could be the culprit here

cheers ...

 

There's absolutely no chance a fragmented or saturated hard disk would cause Windows XP to think Windows Firewall has been disabled. His response was useless, unhelpful and likely little more than an attempt to pad his post count.

Anyway, here's the registry data, it all looks normal to me:

DependOnGroup: (blank)
DependOnService: Netman WinMgmt
Start: 2

The only discrepancy I see is the value for Type, which is 32 on the affected PC.

 

I think he was suggesting that the firewall was starting, just slowly, and that the notice would occur, but then the firewall loaded late and then the firewall would show as working.

I've actually seen this occur.

"Type"=dword:00000020 in hexadecimal is 32 so that is OK.

Did you try removing malware (and making sure the malwarebytes service is not still there?

 

There's no malware on the PC and Malwarebytes doesn't have anything running in the background (I'm not using the trial version with real time protection, just the scanner). The issue with Malwarebytes is it detects some stuff about Windows Firewall in the registry as potential problems and can change them to incorrect values. Spybot does the same thing.

 

There is a malwarebytes service that loads with newer versions even in the trial version...I am not saying that is the case, I am just saying did you check?

Your problem is that it appears you are arguing with everyone, but you never really confirm what people are suggesting.

I say "appears" because your posts are a little combative, ala "Hey, I am a smart guy stop giving me stupid suggestions." It may not be your intention to come off that way, but you are.

Perhaps some screenshots of process explorer running may be useful.

 

Once again, I'm not using the trial version of Malwarebytes and even if I were their real time protection related service doesn't affect the Windows firewall. It clearly has something to do with what MBAM changes in the registry after manually scanning.

To repeat myself further, there isn't any ma ware or other unusual/unidentifiable stuff running in the background or launching when Windows starts. Since you seem pretty insistent I don't know what's running on a PC I've used every day for a decade, here's a screenshot of the task manager:



If you have nothing useful to contribute, stop replying. And you're right, I don't need stupid, unhelpful or flat out incorrect "advice."

 

Nemt, when you scanned with the latest version of MB - did you have all your settings as attached?
If you look at the log file, maybe you could undo the registry or other changes that messed with the firewall loading. Or if you have a recent backup of your registry you could try to restore it before the MB scan .

 

With your attitude I am surprised anyone is trying to help you.

Your original post did not include much information, so yes answers may appear to be stupid, but in reality your original post sucks.

If you are so smart fix it yourself.