Solved

Windows Firewall fails because ICS will not start

Posted on 2009-03-31
18
442 Views
Last Modified: 2013-11-16
In Control Panel when I try to access the Windows Firewall, I get a message that can't run because the associated Internet Connection Service (ICS) will not start. When I click OK to start ICS I get a message that it cannot start. I run Windows XP Home SP2 fully updated.

And yest, I used Start>Run>services.msc to manually start the service and that fails too.

Please reply as to how to get the Windows Firewall to work on my PC.

Please note the following
(1) STICK TO THE QUESTION, NO WORKAROUNDS. Please do not reply that I can install a free 3rd party firewall or Norton Internet Secuity or similar from other vendors.  I know that. (Established vendor SW is NOT free and I prefer not to use free SW for this purpose and just leave it at that). Please do not reply that Windows firewall is not as good as (whatever) because it only protects Inbound. (Hint: Inbound is most of what matters in protecting MY computer. "most" means not all but good enough for my pirpose.)

Note: I have Norton AV 2009 (not Norton Internet Security 2009 which includes a firewall) and Windows Defender for the rest. And at any REAL sign of a malware I run ComboFix (for those EE experts who know what that is) and ComboFix is very very effective at removing malware. And if not, I submit the log to a malware expert who tells me what else to do.

Also I have no interest whatsoever in using any feature of Internet Connection Sharing. I do not have a home network nor do I want to do sharing. I want the Windows Firewall to provide malware protection; sharing is not the goal.

Also regarding MS's directions on how to start ICS at http://support.microsoft.com/kb/314066
(a) See above, I do not want to use what ICS provides
AND
the above KB says (after directions to start ICS)
"When you enable Internet Connection Sharing, the network adapter that is connected to the home network .....receives a new static IP address of 192.168.0.1, with a subnet mask of 255.255.255.0. Existing TCP/IP connections on the network may be lost and must be reestablished. "

Well, THAT DOES NOT SOUND GREAT TO ME. That sounds like to get the Firewall working, I have to loose my internet connection and hope I can get it back. Plus given the 2nd sentence of this EE Question here where I clicked YES (OK) to starting ICS and then got an error, I have no confidence that the directions in that KB will work any better.

LOOK, ISN'T WINDOWS FIREWALL SUPPOSED TO JUST WORK ???

Google search for forum threads on this question show (a) No answer that works (b) Reset Winsock (works for Question poster) followed by another poster saying that did NOT work for me (c) poster says "I removed a piece of spyware and then the Firewall worked".  I.E. NO ONE SINGLE SOLUTION.
Which is strange because the WINDOWS FIREWALL IS SUPPOSED TO JUST WORK, RIGHT?

The only other piece of info that I have is this: Four years ago I moved files from an old PC to this PC by connecting them together with a ethernet patch cable (pins reversed relative to a normal ethernet cable) and setting up sharing etc etc to move data files from my old PC to my new PC. I WOULD NOT BE SURPRISED IT THAT HAS SOMETHING TO DO WITH THIS BECAUISE OF THE ICS REFERENCE IN THE ERROR MESSAGE I AM GETTING.

Please reply as to HOW to get Windows Firewall to run on this PC.

Regards,
  Mike
0
Comment
Question by:mgross333
  • 8
  • 5
  • 2
  • +2
18 Comments
 
LVL 14

Expert Comment

by:BigBadWolf_000
ID: 24028863
What is the exact error message u are getting?? Does the error provide a error number?
0
 
LVL 2

Expert Comment

by:ksmith247
ID: 24028921
Have you checked to see if any of the dependent services are stopped? Should be four of them.

1. Base filtering engine
2. Remote Procedure Call
3. DCOM Server Process Launcher
4. Windows Firewall authorization driver
0
 
LVL 16

Expert Comment

by:warturtle
ID: 24028934
First of all, download Microsoft Malicious Software Removal Tool and scan with it.

http://www.microsoft.com/security/malwareremove/default.mspx

Then, try to do it again and let us know, what you get.
0
 
LVL 14

Expert Comment

by:BigBadWolf_000
ID: 24028951
For WF/ICS service to start you need the following dependent services running.

Event Log
Remote Procedure Call (RPC)
Network Connections
Windows Management Instrumentation

I do not belive this is Optional

0
 
LVL 30

Assisted Solution

by:flubbster
flubbster earned 500 total points
ID: 24029655
Click Start, Run and type:

rundll32 setupapi,InstallHinfSection Ndi-Steelhead 132 %windir%\inf\netrass.inf

 After running the above command, restart Windows and then run the following:

CMD /K NETSH FIREWALL RESET

0
 

Author Comment

by:mgross333
ID: 24029810
Thanks to all for your quick responses.

ksmith247 and BigBadWolf_000,

Have you noticed that your two  lists of required dependent services are different except for RPC ?

Could you please put your heads together (or other EE expert) and come up with the ONE CORRECT list of required dependent services and THEN I will see if I can get them started or whatever is needed.

BigBadWolf_000 (re your first post), there is NO error number. Otherwise I believe my EE question provides enough information (i.e close enough to exact error message).

flubbster, Your solution is in a different direction then the other posters. Can you please provide me with a summary of (a) what those directions will achieve (b) the diagnosis behind your instructions and (c) WHY you think this will work (example I had the EXACT SAME problem and this fixed it or whatever).
I do not go runniing things like you suggest without knowing what the directions mean in PLAN ENGLISH and why they might fix this problem.

Regards,
  Mike

0
 
LVL 30

Accepted Solution

by:
flubbster earned 500 total points
ID: 24030087
That command line re-installs windows firewall. It is straight from MS. As a matter of fact, there is actually another step in the process that you can do. Download and run the sharedaccess.reg file from the link below. It restores the registry entries for the firewall service.

http://windowsxp.mvps.org/reg/sharedaccess.reg

If you want to see the nuts and bolts of the file, or are interested in the exact functiopn of the command line, then look here:

http://support.microsoft.com/kb/920074

Finally, if you want up-to-the-minute info on any xp service and it's dependencies, look here:
http://www.blackviper.com/WinXP/Services/Windows_Firewall_Internet_Connection_Sharing_(ICS).htm

You can get the explanation of any service, see it's dependencies, what it is for, and whether it is needed on this site.
0
 
LVL 16

Expert Comment

by:warturtle
ID: 24030392
I suggested Microsoft Malicious Software Removal Tool because I am hoping that you don't have Conficker or any other MS bugs on your machine, because they can normally disable any firewall and/or antivirus to prevent themselves from being detected. I would also welcome a ComboFix log created by running in safe mode for analysis.
0
 
LVL 14

Expert Comment

by:BigBadWolf_000
ID: 24030429
I took the depandencies directly form WF/ISC service running on Windows XP PC
Have you tried with the services I mentioned running???

Regarding the other services mentioned by another author...
Base filtering engine
The Base Filtering Engine (BFE) is a service that manages firewall and Internet Protocol security (IPsec) policies and implements user mode filtering. Service in Vista
Does not apply to your case. I doubt you will even see it listed in your services.msc unless u use IPSEC for a vpn connection

Windows Firewall authorization driver
This is a service in Vista

DCOM Server Process Launcher
The DCOMLAUNCH service launches COM and DCOM servers in response to object activation requests. If this service is stopped or disabled, programs using COM or DCOM will not function properly.
I dont believe this has any connection with WF/ICS. But maybe author has reason.
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 14

Expert Comment

by:BigBadWolf_000
ID: 24030728
Could be also a winsock problem caused by malware..

you can try this tool to fix...
http://www.snapfiles.com/get/winsockxpfix.html
 
0
 

Author Comment

by:mgross333
ID: 24035365
BigBadWolf_000,

I will check your dependencies list services FIRST. If starting them (if not started) does NOT fix the problem THEN I will try flubbster's solution as that MS KB link matches my problem closesly (EXCEPT THE ERROR MESSAGE AT THAT LINK IS **NOT** MY ERROR MESSAGE. I get bothered by little details like that.) But everything else at that link's problem description DOES match. And the general drift of what is at that link is this is KNOWN PROBLEM AT MS. Which is very disappointing as the Windows Firewall is supposed to just work. WHAT,  the engineers who wrote the SP2 upgrade never tested whether Windows Firewall works after the SP2 upgrade is installed. LIKE THAT DOES NOT MATTER, HIUH ???

Yet that KB article strongly implies that is in fact the case.

Points will be assigned HERE after I try the two solutions above in this post (not the entire thread, but THIS post you are now reading).

Mike
0
 

Author Comment

by:mgross333
ID: 24035378
flubbster,

My post immediately above this one should have been addressed to you too. In fact most of it is about YOUR solution.

Mike
0
 
LVL 14

Expert Comment

by:BigBadWolf_000
ID: 24035514
There is a possibility that applying SP3 would fix the issue.
0
 

Author Comment

by:mgross333
ID: 24038338
BigBadWolf_000,

I had thought of that. I fix PCs for a living. A few customers of mine have had problems with SP3; like any recent change it has some bugs that were not noticed till it went out. Hence I am not crazy about upgrading to SP3 on my own PC; maybe in 6 months.

I prefer to try the approaches in my post above of 03.31.2009 at 08:34PM EST and keep SP2 for the moment.

Mike
0
 

Author Comment

by:mgross333
ID: 24237477
I have not had time to try the 2 ideas I identified above but will try to find time in the next 2 weeks.

Mike
0
 

Author Comment

by:mgross333
ID: 24536822
I STILL have not had time to try the 2 ideas I identified above, considering other priorities in my life,  but find time in the next 2 weeks BY JUNE 17, 2009 and post the results here. And assign points if the suggestions above work.

Mike
0
 

Author Closing Comment

by:mgross333
ID: 31564807
See my final post
0
 

Author Comment

by:mgross333
ID: 24748950
The 2nd link in the Accepted Solution, then use Method 1 at the link, solved the problem. The Assisted Solution is similar but I did not use it.

Mike
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Migration of Exchange mailbox can be done with the ExProfre.exe tool. But at times, when the ExProfre.exe tool migrates the Exchange Server user profile, it results in numerous synchronization problems. Synchronization error messages appear in the e…
Step by step guide to Clean and Sort your windows registry! Introduction: Always remember: A Clean registry = Better performance = Save your invaluable time In this article we're going to clear our registry manually! Yes, manually! The e…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now