Windows Firewall/Internet Connection Sharing (ICS) service is missing

Hello NoahVail =)

Read here >> http://www.theeldergeek.com/icf_and_ics.htm
Its not incluced in XP SP2! Instead of this SP2 has its own Firewall which has that Security Center service :)

I just ran a quick check on my SP2 systems and they all have it included and started.  

My problem is the "Windows cannot display windows firewall settings" error when I click the Network Connections -> Lan Properties -> Advanced tab -> Settings button.  
"Netsh firewall show state" shows service is not started and "sc query sharedaccess" shows service is not installed so I figured that not started and not installed might have something to do with WF/ICS (sharedaccess) being AWOL.

Uninstalling SP2 restores access to the firewall settings, but I'd like to know the solution for this.

Thanks.
NV

click Start > Control Panel and then click the Security Center icon. The first item listed in Security Center  will be Firewall. There you can enable/disable it and do several other configurations.

That gives me the same error as accessing it through the Network Connections -> Lan Properties -> Advanced tab -> Settings button.  "Due to an unidentified problem, Windows cannot display windows firewall settings"

I can't get past this point.
NV

>> Due to an unidentified problem, Windows cannot display windows firewall settings
ahaaaan...... then try this first,

goto Start>Run>type regsvr32 c:\windows\system32\atl.dll and hit enter
then type regsvr32 c:\windows\system32\hnetcfg.dll and hit enter
restart and now check if same error still ??

do a "netsh firewall reset" to reset default settings, then do a

Start -> Run: regsvr32 c:\windows\system32\hnetcfg.dll

Restart the Security Center service.

STOP here. is it working now? no? then continue.

First
regsvr32 c:\windows\system32\atl.dll

then
regsvr32 c:\windows\system32\hnetcfg.dll

This should solve your problem of not being able to open up Windows Firewall.

diagnose with
sc query sharedaccess
sc query ipnat

with these we will see if it is a dll/driver problem.
please deactivate any antivirus firewall module (if installed) and also deactivate any additional firewall present....

Hello NV..

I read about your problem, and i advice you to try something better then the SP2 firewall, and if you are using Home Edition it'll be better if you uninstall SP2 because The service pack 2 recently released by microsoft engages files and .dll files only found on the professional edition.

Or You just disable SP2
The security for SP2 can be easily turned off by clicking

>start
>run
>firewall.cpl

Hope this would help :)

>> goto Start>Run>type regsvr32 c:\windows\system32\atl.dll and hit enter
>> then type regsvr32 c:\windows\system32\hnetcfg.dll and hit enter
>> restart and now check if same error still ??

 Same Error Still.

>> do a "netsh firewall reset" to reset default settings

yields "The Specified Service does not exist as an installed service"

>> "regsvr32 c:\windows\system32\hnetcfg.dll "

Succeeds in registration, but error persists.
I am rebooting / restarting services as directed.

>> First
>> regsvr32 c:\windows\system32\atl.dll
>> then
>> regsvr32 c:\windows\system32\hnetcfg.dll

Succeeds but the error persists.

I have not tried the registry export/import yet.

Appreciate the input.  

NV

>> Or You just disable SP2
>> The security for SP2 can be easily turned off by clicking
>> >start
>> >run
>> >firewall.cpl

That gives me the "Due to an unidentified problem, Windows cannot display windows firewall settings" error.  

I want to disable the firewall as I have another in place.  Disabling the Security Service does not disable the firewall.
With that disabled, "Netsh firewall show config" shows

Lan firewall configuration:
------------------------------------------------------------------------------------
Operational mode                                 = Enable

And I cannot access the system remotely in any way.

NV

Noah..... just confirming...... did this problem started after removing some malwares\trojans from the system or is there from the time you loaded SP2 ??

Could be both.  The problem occurs when SP2 is installed and goes away when it is uninstalled.  Some months ago, this machine had an exploit that setup it's own service called Microsoft Firewall, among other things.  I don't know the full extent of the damage that caused.  I have a contained copy that I experiment on from time to time.

This problem is duplicated in another system that has the same history.  I was unable to solve the issue and left SP2 uninstalled.  I am trying again as I have 6 other systems (same exploit) that may be in the same boat once I let SP2 loose on them.

SFC /scannow WinXP Repair and reinstalling WinXP (over top) do not solve this problem.

Thanks for the input.

NV

hmmmm so are you sure that the systems are really clean now.... you know if system is having junks, and you apply Sp2... you can expect such errors and problems =\
can you do me a favour, goto Start>Run>msconfig>Services and tick Hide Microsoft Services...... can you see any unrelated or unknow service checked now ??

Also please Download HijackThis v1.98.2 from here, run it and Save the LOG file:
http://tools.radiosplace.com/HijackThis.exe

Then Post that log at this site >> http://www.hijackthis.de
hit analyse, scroll down, hit save analyse, a new page will open, please post here the address of that page :)

I have to leave till tomorrow.  

What I'd really like to try is to reinstall/restore the service
Windows Firewall/Internet Connection Sharing (ICS) (sharedaccess) .

Does anyone know how to do that?

Thanks..
NV

>> Does anyone know how to do that?
you cannot actually "reinstall" a service..... a service is not a program which can be installed or repaired...... its related to registry..... you can add or remove its information from registry..... and that method is i have told you already :)

HiJack This Log is here...
http://www.hijackthis.de/forum/showthread.php?p=3853#post3853

Everything running I am familiar with.  My tools and some user crud.

NV.

Woah, hold on there a minute.  You're registry import/export did the trick.  Dang.  I tried something similiar on the last one but went about it the hard/wrong way.  The points are all yours and I am grateful.  This is the first post I submitted that got a solution.

Much appreciated.

Noah Vail.

//  Below is the contents of the .reg file.
NV //



Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]
"Type"=dword:00000020
"Start"=dword:00000002
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
"DisplayName"="Windows Firewall/Internet Connection Sharing (ICS)"
"DependOnService"=hex(7):4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,57,00,69,00,\
  6e,00,4d,00,67,00,6d,00,74,00,00,00,00,00
"DependOnGroup"=hex(7):00,00
"ObjectName"="LocalSystem"
"Description"="Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network."

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]
"Epoch"=dword:00000d23

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
  00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  69,00,70,00,6e,00,61,00,74,00,68,00,6c,00,70,00,2e,00,64,00,6c,00,6c,00,00,\
  00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\
  00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup]
"ServiceUpgrade"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]
"{51F70032-BAFA-4F82-A8A5-6EC23B7B8F2C}"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum]
"0"="Root\\LEGACY_SHAREDACCESS\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

glad you got it fixed...... Cheers ^_^

Hello again  Noah

Try the following instruction to disable the Windows Firewall

Search this winnt.sif file in your windows directory, add the following entries anywhere in winnt.sif:

[WindowsFirewall]
Profiles = WindowsFirewall.TurnOffFirewall

[WindowsFirewall.TurnOffFirewall]
Mode = 0

If you want to leave the Windows Firewall enabled but also want to preset the settings, check ref.chm under Unattended.txt > [WindowsFirewall] for more information as it is too large to cover here.