Windows Firewall - Advanced Tab - Problem

When I click on Windows Firewall's Advanced tab, I get the message, "The network connection settings have become corrupted. To fix this, click Restore Defaults. This will delete all of your settings for Windows Firewall and it may cause some programs to stop working ". I've resored the defaults and rebooted but the message remains the same.

I also downloaded and ran a utility called repairfirewall_xpsp2.vbs but it didn't help either.

Any suggestions?

 

Hi, dcfrazel.

Perhaps Windows XP's System File Checker (SFC) will help you resolve your issue.

• Have your Windows XP CD handy because you may be prompted to insert it into your CD drive during this process.
• Click Start > Run...
• Type [FONT= "Courier New"][SIZE= "3"]sfc /scannow[/SIZE][/FONT] in the "Open:" field.
• Click the OK button.

A "Windows File Protection" window will open and display its progress. If SFC runs successfully without any intervention from you, it will take approximately 15-25 minutes to complete. When SFC completes, the "Windows File Protection" window will simply disappear.

To see any changes that may have been made by SFC after it completes:

• Click Start > Run...
• Type [FONT= "Courier New"][SIZE= "3"]eventvwr.msc[/SIZE][/FONT] in the "Open:" field.
• Click the OK button.
• Click the "System" item on the left side of the "Event Viewer" window.

Any changes made by SFC will be displayed (in reverse order) as "Windows File Protection" events between Event ID 64016 (Windows File Protection started) and 64017 (Windows File Protection completed).

Double-click on an event (or right-click on the event and select "Properties ") to view details about the event. You can use the up/down arrow buttons on the right side of the event's "Properties" window to view details about adjacent events without having to close the event's "Properties" window.

If you want to copy event details to your clipboard (for pasting into Notepad or a forum message, for example), use the button immediately below the up/down arrow buttons in the event's "Properties" window.

 

Hi again Mailman:

Here's the info from SFC. I don't understand Event ID 107 - If it's referring to my hard drive, I have 218 GB of free space.

Also, after running SFC, I again checked Windows Firewall's advanced tab and got the same message I reported previously.

 

OOOOOOOOOOOPS!!

Might be nice if I actually included the info from SFC - here it is.


Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64017
Date: 8/11/2007
Time: 1:52:06 PM
User: N/A
Computer: DAVID-8B06329F0
Description:
Windows File Protection file scan completed successfully.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/11/2007
Time: 1:52:05 PM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\snchk.exe could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 8/11/2007
Time: 1:52:05 PM
User: N/A
Computer: DAVID-8B06329F0
Description:
The protected system file c:\windows\microsoft.net\framework\v1.0.3705\gacutil.exe could not be restored to its original, valid version. The file version of the bad file is 1.0.3705.0 The specific error code is 0x00000000 [The operation completed successfully.
].

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 8/11/2007
Time: 1:52:05 PM
User: N/A
Computer: DAVID-8B06329F0
Description:
Windows File Protection scan found that the system file c:\windows\microsoft.net\framework\v1.0.3705\gacutil.exe has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 1.0.3705.0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/11/2007
Time: 1:52:02 PM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\ehituner.dll could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/11/2007
Time: 1:52:02 PM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\ehiepg.dll could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/11/2007
Time: 1:51:56 PM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\ehcircl.dll could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: SRService
Event Category: None
Event ID: 107
Date: 8/11/2007
Time: 1:31:32 PM
User: N/A
Computer: DAVID-8B06329F0
Description:
The System Restore service has been suspended because there is not enough disk space available on the drive \\?\Volume{75fde64d-fd32-11d9-8802-806d6172696f}\. System Restore will automatically resume service once at least 200 MB of free disk space is available on the system drive.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64016
Date: 8/11/2007
Time: 1:23:46 PM
User: N/A
Computer: DAVID-8B06329F0
Description:
Windows File Protection file scan was started.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

 

Heh. I recognized your Event logs as ones I have seen in another thread recently. Turns out that thread was your "Cannot Start ICS Service" thread.

I don't have any ideas right now. If I discover something, I will post another follow-up.

 

Right - Once you folks helped me get the ICS issue squared away, Windows Firewall came back to life. That allowed me to look at it's settings, where I ran into the corruption problem. Funnny how one problem solved leads to other problems noticed.............I'm still confused, but at a much higher level.

 

After completing the comprehensive rebuild of WMI, did you go through the steps to re-register the components as outlined on Ramesh's site? Did you run the WMI Diagnosis Utility to verify the repository?

 

I am guessing you downloaded that repairfirewall_xpsp2.vbs script from winhelponline.com:

• Error "The network connection settings have become corrupted" when you configure Windows Firewall in Windows XP Service Pack 2

That appears to be one of Ramesh's utilities so it seems to me like a logical approach.


Did you try the manual steps Ramesh described in Comment #5 of that page?

NOTE: The http://windowsxp.mvps.org/repairwmi.htm link provided in that Comment #5 leads us right back to where we've been regarding your (seemingly resolved) ICS issue.

Your Windows File Protection Event errors and Event 107 error may or may not be related to your current issue but they sure bother me anyway. I will certainly be thinking about these and poking around for clues.

Let's hope someone familiar with your issue jumps in to help.


EDIT: Whew! Glad to see noahdfear is here.

 

Addressing the System Restore event, does your harddrive have more than 1 partition? Check the allocated disk space for System Restore by opening the System properties dialog>System Restore tab. If more than one partition, select each from the list and click Settings.

 

In regards to the Windows File Protection errors, here's quoting the MS article that we referenced in the ICS topic.

 

I forgot about that MS KB909059 article. Thanks for reminding me.

I guess I'm just not willing to accept MS describing a "workaround" instead of fixing SFC to properly handle the MCE 2005 OS (so SFC can run unattended).

Thanks again, Dave. Looks like I won't be poking around on that issue.

 

I think the real problem is not with SFC or MS, but lies with the manufacturer.

 

Once again, I stand corrected.

My eye for details (and sense of caution) is slipping in recent days. I usually read articles (and re-read them) in detail but lately I'm a little preoccupied and I have been glossing over some of the articles.

dcfrazel, for everyone's convenience, I quoted the point where noahdfear left off in this thread before I started jumbling it.

I think I'd better take a break. Good luck!

 

Mailman, you are one of the most thorough members of this board, be it in your research or in preparing your posts. A real asset to this community IMO. Make it a very short break! (please)

 

I don't think it could be said much better than that. Mailman, don't even think about taking a break - we all need you. You are an invaluable resource and do an excellent job of helping others resolve their problems. Heck, none of us can keep up with the "New Bremen Bulldog" - what he doesn't know today, he will by tomorrow. I sense a lot of those same genes in your makeup.

 

I must have read and re-read that MS article a dozen times. As with many things MS, there is conflicting and confusing information, from both the article and the event logs.

Event log

Article

It wasn't even until I was re-reading it yet again last night that some semblance of comprehension finally began to sink in. Yet, that comprehension relates only to what the article is telling us ......... and in a nutshell, if I am interpreting it correctly, is that the required files aren't on the cd, or at least not in the location that the SFC expected them to be. Since the location may vary according to the manufacturer, MS can't adjust the SFC utility to work around those variances and find the files.

I cannot say that clears up all of the confusion here though. The SFC has determined that those files need to be replaced. The article tells us those files are not required. Huh???

As I type this, maybe yet a bit more comprehension sinks in.

We know that the SFC will not attempt to replace any files unless it detects a problem. That in mind, we must assume the SFC detected a problem with those files.

We know that the SFC reports those files as required. We must assume that they are required.

We know that MS reports that those installation files are not required by MCE. We must assume that MCE will function without them.

We know from the article that 'manufacturer may have customized the installation with unique components such as specific device drivers and optional settings to maximize the performance of that manufacturer's hardware'.

I may be wrong, but I believe what all of this is telling us is that the files are required, not by MCE, but by the customized installation. Me thinks we first need to take a closer look at each of the files referenced and determine it's function. Then maybe we can also determine where those required files might reside, so that SFC can be customized to look in that place.

Mailman, I had one heck of a time sleeping last night. Collective effort man ...... that's what solves many of the problems we face, and I need you on this one for sure!

 

May be way off base with that statement. What if the SFC, as part of it's routine, checks the dllcache for a copy of system files, and whether the system file is good or bad, if the dllcache lacks a copy it tries to get one? If so, and IF the files in question above are provided by the manufacturer, and have been given a system attribute by the manufacturer, then it's possible that the only real problem is that the manufacturer failed to put a copy in the dllcache. Lets look at the files.

c:\windows\ehome\snchk.exe
c:\windows\ehome\ehituner.dll
c:\windows\ehome\ehiepg.dll

David, would you check the properties of each of those files, version tab, and get whatever info is provided please?

I would be willing to bet that if David copied those files to the dllcache and ran SFC again, those errors would not return. Sound feasible?

 

First, I'll second the good words directed to Mailman and second, I'll thank Noahdfear, and PeteC for the help the've provided on this thread and on others I've started.............now, to answer your questions:
-----------------------------------------------------------

To Noahdfear:

Yes, I've re-registered the components using the three commands Ramesh lists but that didn't help.

No, I haven't run the WMI diagnosis Utility. I tried downloading it from the link Ramesh provides but nothing appeared to happen, or if it did, I couldn't find the downloaded file.
-------------------------------------------------------------

To Mailman:

Yes, that's the script I ran and since it seemed to execute OK, I didn't go any further.

When I checked System Restore, I discovered disc space was set to the minimum value (0%, 200MB). I set it to 2% (5.8GB) and ran SFC again. That got rid of the disc space error. The results of the new scan are below:
----------------------
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64017
Date: 8/12/2007
Time: 10:07:40 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
Windows File Protection file scan completed successfully.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/12/2007
Time: 10:07:40 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\snchk.exe could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64004
Date: 8/12/2007
Time: 10:07:40 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
The protected system file c:\windows\microsoft.net\framework\v1.0.3705\gacutil.exe could not be restored to its original, valid version. The file version of the bad file is 1.0.3705.0 The specific error code is 0x00000000 [The operation completed successfully.
].

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64020
Date: 8/12/2007
Time: 10:07:40 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
Windows File Protection scan found that the system file c:\windows\microsoft.net\framework\v1.0.3705\gacutil.exe has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 1.0.3705.0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/12/2007
Time: 10:07:36 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\ehituner.dll could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/12/2007
Time: 10:07:35 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\ehiepg.dll could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64021
Date: 8/12/2007
Time: 10:07:29 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
The system file c:\windows\ehome\ehcircl.dll could not be copied into the DLL cache. The specific error code is 0x00000000 [The operation completed successfully.
]. This file is necessary to maintain system stability.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64016
Date: 8/12/2007
Time: 9:38:20 AM
User: N/A
Computer: DAVID-8B06329F0
Description:
Windows File Protection file scan was started.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
--------------------------
To Noahdfear again:

I searched c:\windows\ehome for the files you listed.....None are present.
I also searched the entire c:\.............They're nowhere to be found.