Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows7 firewall problem


  • Please log in to reply
20 replies to this topic

#1 JustinChase

JustinChase

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:11:42 AM

Posted 14 September 2014 - 11:48 PM

I've been struggling with this for a LONG time, on multiple computers, but all computers had the same (customized) windows7 install image used for the install.

 

THerefore, I suspect it's something to do with my customized image, but it's now on several computers I use, and it would be really un-fun to have to wipe them all and start from a new, full image on each machine.  So, I'm hoping someone can help me just 'fix' this issue, then I can fix it on all my machines.

 

Issue:  Clicking on "Windows Firewall" in Control panel does nothing.  it won't open the firewall.  Clicking "Check Firewall Status" and "Allow a program thru windows firewall" also has no effect.

 

I can see windows firewall service is started in Services, and is set to Automatic.  All it's dependencies are also running.  Windows Defender is started and set to Automatic.  It was set to Automatic (delayed), but I've changed it, trying to fix this issue.

 

I've tried several suggestions in the microsoft support forums, but nothing has helped.  One thing I did see there was that if I stop the service, I can 'get into' the Firewall settings, but everything is greyed out, and I cannot make any changes.

 

If I run Administrative tools from Control Panel, then r-click Windows Firewall with Advanced Security, run as administrator, I get this message...

 

"Windows Firewall with advanced Security snap-in failed to load. Restart the Windows Firewall service on the computer that you are managing.  Error Code 0x6D9"

 

restarting the service doesn't help.

 

I ran the Microsoft tool (MicrosoftFixit.WindowsFirewall.RNP.1334183720996.1.1.Run.exe) to fix problems, and it said it found and fixed something, but nothing has improved.

 

I've run FSS.exe, and the report is attached.  it's clean now, after changing Defender to Automatic from delayed.

 

I've also run ServicesRepair (as administrator), and that report is attached.

 

Finally, I ran ComboFix, and that report is attached.

 

I've ran Avast since the machine was built, but uninstalled it tonight to confirm it is not part of this issue.

 

I still have MalwareBytes installed, and run it occasionally.  I don't think I've every had any virus, or serious malware on this machine.

 

This problem has existed from day one.

 

I hope someone here is more clever than myself, and can help me fix this VERY annoying issue.  I need to forward a port on this machine (and others), and can't do it with this firewall issue.

 

Thank you in advance for any/all help!

Attached Files


Edited by hamluis, 17 September 2014 - 06:37 AM.
Moved from Win 7 to Malware Removal Logs - Hamluis.


BC AdBot (Login to Remove)

 


#2 JustinChase

JustinChase
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:11:42 AM

Posted 15 September 2014 - 09:32 AM

Hmmm, someone replied earlier and suggested I install and run an all-in-one repair tool, from here...

 

http://www.bleepingcomputer.com/download/windows-repair-all-in-one/

 

I installed and ran the tool, and didn't see any particular errors, or major repairs made.  Once it finished all repairs (including several restarts), I then tried again, and still cannot open Firewall :(

 

Any other ideas?



#3 JustinChase

JustinChase
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:11:42 AM

Posted 16 September 2014 - 06:49 PM

I started a post here the other day, and got one reply, but the reply was removed, and the post was moved to f_icon.png

Virus, Trojan, Spyware, and Malware Removal Logs

 

But I really don't think I'm infected by anything.  I think my issue is really just a settings issue/problem.  Either way, I've not gotten any response to my other post, so I'm hoping that by posting here again, someone might respond with some help/advice/suggestions on what I can do to 'fix' this issue.

 

Thanks

 

http://www.bleepingcomputer.com/forums/t/548356/unable-to-open-windows-7-firewall/?p=3478786



#4 hamluis

hamluis

    Moderator


  • Moderator
  • 55,556 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:42 AM

Posted 16 September 2014 - 07:15 PM

Your post was moved...because you attached ComboFix log, which is not permitted/used in this forum since it is a tool for dealing with malware.  Since the topic reflected a malware logs...it was moved to malware logs forum.

 

Which of these topics do you want me to close?

 

Louis


Edited by hamluis, 17 September 2014 - 06:40 AM.
Edited post to correct - Hamluis.


#5 JustinChase

JustinChase
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:11:42 AM

Posted 16 September 2014 - 07:19 PM

Okay.  I posted them mainly to show that there wasn't any malware :)

 

If you want to close/delete the other post, I'll update this post with the same information, but without the logs.

 

Thanks!



#6 sflatechguy

sflatechguy

  • BC Advisor
  • 2,200 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:42 AM

Posted 16 September 2014 - 10:35 PM

Reviewing your earlier post, you said restarting the Windows Firewall service didn't address the issue. The firewall service is dependant on two other services, the base filtering engine (BFE) and the Windows Firewall Authorization Driver (MPSDRV). Check to make sure those services are running as well, and are set to Automatic.

 

If that doesn't fix it, open a command prompt by typing cmd in the search bar, right click the command window icon and select Run as administrator. Run the following commands:

netsh advfirewall reset

net start mpsdrv

net start bfe

net start mpssvc

regsvr32 firewallapi.dll

 

Click OK on any dialog boxes that open up. The result of the last command should say it succeeded. Reboot the computer, and try to turn on Windows Firewall.

 

If there are any errors from any of these commands, then the drivers/files are probably corrupt or there are registry errors.



#7 hamluis

hamluis

    Moderator


  • Moderator
  • 55,556 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:10:42 AM

Posted 17 September 2014 - 06:35 AM

Note:  I've merged posts after removing malware log attachment.

 

Louis


Edited by hamluis, 17 September 2014 - 06:40 AM.


#8 JustinChase

JustinChase
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:11:42 AM

Posted 17 September 2014 - 06:59 AM

The firewall service is dependant on two other services, the base filtering engine (BFE) and the Windows Firewall Authorization Driver (MPSDRV). Check to make sure those services are running as well, and are set to Automatic.

 

The Base Filtering Engine is running and is set to automatic.  I cannot find the Windows Firewall Authorization Driver (MpsDrv) either in the services dialog, nor in task manager services.

 

Perhaps this is the problem.

 

How do I (re)install this service, since it appears to be missing?  I've run a couple of programs that are supposed to restore missing services/programs/drivers, but I'm still not seeing this one.



#9 JustinChase

JustinChase
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:11:42 AM

Posted 17 September 2014 - 07:11 AM

Note:  I've merged posts after removing malware log attachment.

 

Louis

 

 

Thank you!



#10 sflatechguy

sflatechguy

  • BC Advisor
  • 2,200 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:42 AM

Posted 17 September 2014 - 01:44 PM

If you navigate to the C:\Windows\System32\drivers file, is the mpsdrv.sys file located there?

If so, run the commands I listed earlier.

 

If the file is not there or the commands don't work, try running sfc /scannow from the command prompt as the administrator.



#11 JustinChase

JustinChase
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:11:42 AM

Posted 17 September 2014 - 06:01 PM

If you navigate to the C:\Windows\System32\drivers file, is the mpsdrv.sys file located there?

If so, run the commands I listed earlier.

 

If the file is not there or the commands don't work, try running sfc /scannow from the command prompt as the administrator.

 

mpsdrv.sys is in the folder, so I started running the commands in your previous post.

 

netsh advfirewall reset  =>  resulted in "Ok."

 

net start mpsdrv  =>  resulted in "The requested service has already been started.  More help is available by typing NET HELPMSG 2182."

 

So, I rechecked the Task Manager, and mpsdrv is still not showing in the list.  I'm attaching a screenshot to show it's not in there.  I wonder why windows seems to think it's running, but doesn't show it in the list.

 

net start bfe  =>  resulted in "The requested service has already been started.  More help is available by typing NET HELPMSG 2182."

 

net start mpssvc  =>  resulted in "The requested service has already been started.  More help is available by typing NET HELPMSG 2182."

 

regsvr32 firewallapi.dll  =>  resulted in a popup window telling me it was successful.

 

 

Any more ideas/suggestions?

Attached Files



#12 sflatechguy

sflatechguy

  • BC Advisor
  • 2,200 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:42 AM

Posted 17 September 2014 - 06:51 PM

Check the services.msc snapin to determine whether these services are running. Type services.msc into the search bar, and make sure the Windows Firewall and it's dependent services are running there.

 

If not, try these commands again:

 

net start mpsdrv

net start bfe

net start mpssvc

 

It appears your system was still processing the netsh advfirewall reset command when you typed in the net start commands, and that's why you got that message.



#13 JustinChase

JustinChase
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:11:42 AM

Posted 17 September 2014 - 07:01 PM

The Windows Firewall Authorization Driver still isn't running.  In fact, I don't recall ever seeing it running before.

 

re-running the commands gives the same results, they all say they are already started.



#14 sflatechguy

sflatechguy

  • BC Advisor
  • 2,200 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:42 AM

Posted 17 September 2014 - 07:05 PM

Just to be sure, try

 

net stop mpsdrv

net stop bfe

net stop mpssvc

 

Wait a bit, then enter

 

net start mpsdrv

net start bfe

net start mpssvc

 

Post back with the results.



#15 JustinChase

JustinChase
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:11:42 AM

Posted 17 September 2014 - 07:21 PM

screenshot attached showing results.

 

The first command warned me about the firewall having to stop.

 

the next command stopped the firewall, and showed a message in the notification window that firewall was turned off.

 

Running all the start commands gave success messages.

 

I suspect that the firewall is running, and it has been running fine, I just can't open the firewall control dialog to make any adjustments to the firewall.  That is still the case, I still can't open the firewall dialog, or make any adjustments. The Windows Firewall Authorization Driver is still not showing in the services dialog.

Attached Files






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users