Comments on: SP2… Great for security and protecting users but at what cost?

By: Michel Verbeken

Michel Verbeken — Mon, 03 Apr 2006 14:13:13 +0000

Noah,

many thanks for your answer. Creating the .reg file and double-clicking it to get entered in the registor (or open the .reg file with regedit) just did the job !!

I can again enable/disable the Windows XP firewall.

By: Michele

Michele — Tue, 28 Feb 2006 21:11:51 +0000

Noah,

For those of us who are well…'challenged'…could you please give me a step-by-step version of creating a .reg file, copy and past and merge the above?

Thanks.

By: Zsolesz

Zsolesz — Tue, 14 Feb 2006 23:52:29 +0000

I had the similar problem not able to turn on and off firewall with the same notification. This regisry merging solution from Noah Vail solved my problem Thanks Noah!, hope i didnt mixed up my registry files too much. But would be good to know the core problem. I think my problem was triggered by spyware winsysban8.exe or mssearch.exe and so. After cleaning computer I was left with this firewall shit.

By: betsy

betsy — Mon, 29 Aug 2005 23:53:19 +0000

I just used noah vail's .reg solution, and it worked!

I have been trying to fix this for a while, and wel, this worked. I hadn't created a .reg file before, but figured I would just copy and paste from the "#############" on down into the notepad. Then I saved it as ".reg" file type "all files". Next, I located the saved file, dbl-clicked it, said yes, and whala! anyway, I thought I would explain how it worked, for those non-tech saavy among us… Thanks Noah Vail!

By: Corey Gouker

Corey Gouker — Sat, 02 Apr 2005 22:41:10 +0000

[This comment was posted by Jeff but was never saved due to an error.]

I tried the using the .reg, and I stopped getting the error. However, I'm not able to turn my XP firewall on or off, the option is stuck on off and is no longer a clickable radio button, and the security center shows the firewall set as running, despite it being switched off.

By: Corey Gouker

Corey Gouker — Sat, 02 Apr 2005 22:37:55 +0000

So this post was actually referring to an unreleased beta build of XP SP2, hence the **** for the build number. If you're still getting this issue and you're running SP2 then something must be up. My suggestion would be to uninstall SP2 (especially if you've forgotten to uninstall any previous beta builds before installing the final release RTM). Then after all that waiting, install SP2 once more. I personally have not had this problem on any of my 5 machines (not to mention those at work) since XP SP2 went gold.

By: Noah Vail

Noah Vail — Tue, 21 Dec 2004 18:30:19 +0000

Found my solution. My exploit deleted the Firewall Service in leu of it’s own. The solution was to merge a registry entry from an uncorrupted system, which restores the windows firewall service and then reboot. The contents of the reg file are posted below the pound (###) signs. Copy and paste into a .reg file and merge into your registry.
Noah Vail
##################

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"DisplayName"="Windows Firewall/Internet Connection Sharing (ICS)"
"DependOnService"=hex(7):4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,57,00,69,00,\
6e,00,4d,00,67,00,6d,00,74,00,00,00,00,00
"DependOnGroup"=hex(7):00,00
"ObjectName"="LocalSystem"
"Description"="Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
"Epoch"=dword:00000d23

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
69,00,70,00,6e,00,61,00,74,00,68,00,6c,00,70,00,2e,00,64,00,6c,00,6c,00,00,\
00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"{51F70032-BAFA-4F82-A8A5-6EC23B7B8F2C}"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum]
"0"="Root\\LEGACY_SHAREDACCESS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

By: Noah Vail

Noah Vail — Mon, 20 Dec 2004 18:02:01 +0000

I spent most of a month trying to solve the same problem, including repairing WinXP. I finally had to uninstall SP2 until such a fix comes along. I now have this on a second system. I've tied this to either an exploit I received on both systems, or to drive cloning prior to installing SP2.

Does this jibe with anyone else?

By: Terry Edwards

Terry Edwards — Wed, 03 Nov 2004 12:43:01 +0000

I tried the above .dll commands to no avail.

I still get "Due to an unidentified problem, Windows cannot display Windows Firewall settings" when I try to open the Windows XP Firewall. Wow, I can't believe Microsoft have no answer to such a fundamental bug in their OS!!!

By: Tea _J

Tea _J — Thu, 27 May 2004 06:58:06 +0000

I just installed SP2 b 2096.. it's been great. i've had some problems here and there, but all in all it's wonderfull. things are faster.. windows open faster. etc etc. i dont know about your problems, but the only major OS related problem i got was that of the firewall settings not showing up.. (i've had problems with other softwares like stylexp and f-secure, but i fixed it and it's aite now).. with the "Undefined Firewall Problem", just do this:

You need to register 2 DLLs. Type the following in command prompt.

First

regsvr32 c:windowssystem32atl.dll

then

regsvr32 c:windowssystem32hnetcfg.dll

I hope this helps you and all your readers.

Peace

Tea

By: Jason Tsang

Jason Tsang — Tue, 04 May 2004 07:09:18 +0000

FWIW, I had the same error after the first run of this interim build.

It just as quickly disappeared after I grabbed some food…

sigh