Firewall Not Holding

I turn on the firewall protection in XP SP2 Home and the next time I turn my computer on the firewall protection is off. Any thoughts out there while you are opening gifts and drinking eggnog?

Merry Christmas

 

Hmmmmm.

Virus?

Have you tried from the start => run line

Code:

sfc /scannow

Any event log entries that look related and have some details?

New behavior or has it done this since SP2 was installed?

 

No Virus

 

Did scannow and no problems found

 

how did you determine the firewall was off?
Any related entries in the event log (like from SVCHOST)?
Is the security center service running?
After you turn it on, does it remain on until shutdown?
Does it turn off if you prune your startup services down with MSCONFIG?
If you disable your virus scanner and reboot does it turn off?

 

Good questions. I will work on them and let you know the results.

 

bmartin --What firewall are you using? Are you perhaps using two (or more)?
When you installed SP2, it installed Windows Firewall by default. If you were already using a third party firewall, like Zone Alarm, you are now using two. No one recommends running two firewalls. Suggest you disable the Windows Firewall since it monitors only incoming traffic and not outgoing.

 

Jim I am using Zone Alarm, but I have always used XP's firewall as a backup just for additional incoming security. I know it is over kill but I have had situation when zone alarm failed to start up. However, I guess now that I have a security center running I would be warn of a security breakdown.

Regardless, this is the first time I have ever experienced this problem. I tried Ben suggestions with no luck. Also, when I turn XP firewall on it stays until I shutdown. I have been able to determine that the firewall starts up with my other services when the computer starts up, but then for some reason it shuts down. Something is shutting it down after start up.

 

Just found the problem, Zone Alarm. With the security center running Zone Alarm takes over and turns off XP's Firewall, which will be ok, because when I turn ZA off the security center turns on XP's Firewall, which will provide the incoming backup I desire.

Thanks for the help in leading me to the source of the problem.

 

bmartin--Glad I could be of some help. However, I would just forget about the Windows Firewall and run Zone Alarm exclusively and all the time. (Unless you hit the rare situation where no firewall is required.)

 

Hello bmartin,

The system detects ZA and turns WF off.

If ZA is either knocked out or turned off, WF will startup up again as long as the WF service is not disabled. So if you want that backup situation to continue, don't disable XP's firewall service.

This BTW happens with the 5.x ZA versions.

Also turn WF's logging on by going into the advanced tab of WF > Security logging > settings > options and click on the "Save as" to save \WINDOWS\pfirewall.log - opens with notepad.

Regards - Charles

 

charlesvar--While, I am not sure why bmartin wants to turn ZA off from time to time and yet have another firewall still in place, are you advising to use two firewalls at the same time?
I would have thought the PC would function more efficiently with only one firewall running at anytime. bmartin could always turn WF on manually when he turns off ZA.

 

Hi Jim,

are you advising to use two firewalls at the same time?

No I'm not.

If the Security Center detects a 3rd party firewall, it will shut WF off. If that 3rd party firewall ceases to function, XP re-enables WF provided that the WF Service is not disabled.

Even though WF doesn't run in the situation where there is a 3rd party firewall running, the Firewall Service is still enabled unless disabled by the user.

You have ZA I think, go into XP's Services and check if WF Service is enabled, if you didn't shut it off, I suspect it's running. If it is and you shut ZA off, XP will start WF up.

The same situation exists here as with MS updates. If you turn off AU in the Security Center, the Service still runs.

Regards - Charles

 

Jim I am using Zone Alarm, but I have always used XP's firewall as a backup just for additional incoming security. I know it is over kill, but I have had situations when Zone Alarm failed to start up and before SP2 I was unaware and unprotected. Now that I know that security center will start XP's firewall if ZA fails I don't plan to run both. You just misunderstood my Posting.

 

charlesvar--I set WF to "Disabled" in Services because I found Services earlier had it as "Started" even though I had set WF to Off in Control Panel and was running ZA.

 

Hi Jim,

I set WF to "Disabled" in Services because I found Services earlier had it as "Started" even though I had set WF to Off in Control Panel and was running ZA.

Ok, which wasn't necessary to do. There is a distinction between what the SC shuts off and the Service. If you would have left the Service running, the WF would not run because ZA is present. The only way to tell aside from what SC says, is to see if WF is logging, which is why I went thru explaining how to turn logging on.

Again, the analogy is AU. If you shut AU off in the Security Center, that does not shut the AU Service off, it will show as Started and Running.

Regards - Charles

 

I run Norton's firewall together with XP's firewall with no conflicts. My XP firewall doesn't shut itself off.

Johanna

 

Hi Johanna,

Sygate v5.5 with XP and WF does not - but I had to work at it.

ZAP v5.5 with XP and WF does shut itself off. Maybe if I worked at it not shutting itself off, I could keep it on, but I'm going to leave it this way.

Wanted to add that what I meant by leaving this way is WF's Service running, and knowing that WF is not actually doing any "firewalling" because no log entries.

Regards - Charles

 

Tracked down the thread on this http://www.windowsbbs.com/showthread.php?t=34394&highlight=Sygate

Regards - Charles