Tweaking.com Support Forums
Main Forum => General Computer Support => Topic started by: ka6uup on June 26, 2013, 05:05:06 pm
-
I ran Tweaking.com Windows repair and now when I try to access the firewall to turn it off I
get a message "due to an unidentified problem windows cannot display firewall settings"
I have run the "NETSH FIREWALL RESET" and the "Rundll32 setupapi,InstallHinfSection Ndi-Steelhead 132 and run windows Fixit 50203 all per Microsoft but non have worked.
Help would be appreciated.
Chuck
-
Have you checked event viewer for the error?
Is your option grayed out?
search google on how to disable firewall, it will help you to look at solving the problem...
Are your changing the settings as the administator or user?
-
Please dont double post. :-)
A lot of rottkits kill the firewall. And if you still have one on your system that would explain why none of the repairs are working.
So lets cover all the bases. :-)
Run Malwarebytes anti rootkit (This is different than their normal scanner)
http://www.malwarebytes.org/products/mbar/
and Tdsskilller
http://support.kaspersky.com/5350?el=88446
Let me know the results if they find anything. :wink:
Shane
-
Sorry for the double post. I was not getting an answer on the other forum and I didn't know how to delete the other posting.
I just ran both the Malwarebits Anti-rootkit and the TDSSKiller utilities and both came up clean.
Until I ran the "Windows Repair (all-in-one)," I had the Windows firewall turned off. After running it I discovered the Windows firewall was on. ( I don't need it. I have Comcast Norton Security running.)
I tried running "firewall.cpl" and also the "network connection properties" and in both cases, I receive the "due to an unidentified problem windows cannot display settings". The usual firewall settings window does not come up at all.
I Googled the message and found a lot of solutions which I tried with no success. Including Microsoft's "Fix It Center."
Also, I checked my "services" settings and the firewall is running.
I also tried all this with Norton Security completely disabled.
In addition, I now have a problem with the Volume Shadow Copy.
This also was running fine before, as I used it to back up my registry. But, now, when I try to back up the registry (using Tweaking Registry Backup) it comes on and immediately turns off. This is in spite of the fact it is running under "Services." I tried restarting it and also changing it from "manual" startup to "automatic" and it made no difference.
I have spent several hours trying to resolve this and am stumped.
Chuck
-
- Did you run "Repair WMI" and "Repair Volume Shadow copy" ? The Firewall requires WMI to function properly. The message "Can't display settings" clearly suggests a broken/faulty WMI. And WMI is used to pull up A LOT OF info from your computer.
- Did you run "Reset file & registry permissions" ?
- You can use WR to switch off the MS firewall and other Services.
http://www.tweaking.com/forums/index.php?topic=1195
-
Yes. I ran all of them in an attempt to fix the problem.
However, I will rerun them again just to be sure.
Thanks,
Chuck
-
I disconnected the network and disabled Norton Antivirus, Firewall and Tamper Protection.
I ran "Repair WMI" and "Repair Volume Shadow copy" without success.
Below are the error messages from "Event Viewer."
I hope they help.
Chuck
Event Type: Error
Event Source: PerfNet
Event Category: None
Event ID: 2004
Date: 6/30/2013
Time: 9:22:54 AM
User: N/A
Computer: P5N2M7
Description:
Unable to open the Server service. Server performance data will not be returned. Error code returned is in data DWORD 0.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000Event Type: Error
Event Source: PerfNet
Event Category: None
Event ID: 2004
Date: 6/30/2013
Time: 9:22:54 AM
User: N/A
Computer: P5N2M7
Description:
Unable to open the Server service. Server performance data will not be returned. Error code returned is in data DWORD 0.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À : 34 00 00 c0 4..À
Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 4099
Date: 6/30/2013
Time: 9:15:36 AM
User: N/A
Computer: P5N2M7
Description:
Volume Shadow Copy Service error: Cannot install the component C:\Program Files\Tweaking.com\Windows Repair (All in One)\SWPRV.DLL into the COM+ application 'MS Software Shadow Copy Provider' [0x80110401].
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 43 41 44 43 41 44 4d 43 CADCADMC
0008: 31 39 38 00 00 00 00 00 198.....
0010: 43 41 44 43 41 44 4d 43 CADCADMC
0018: 31 36 30 00 00 00 00 00 160.....
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:37 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\SYSTEM32\WBEM\WINDOWSSEARCHENGINE.MOF while recovering repository file.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:36 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MOF\SERVICEMODEL.MOF while recovering repository file.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:36 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODEL.MOF while recovering repository file.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:36 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CLR.MOF while recovering repository file.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:35 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET.MOF while recovering repository file.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.\
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:28 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V1.1.4322\ASPNET.MOF while recovering repository file.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-
Event viewer reports 5 problems with WMI. It can't load 5 *.mof files. If you want to back up the registry with Registry Backup then make sure you do it with an account with administrator rights. Then you don't need VSS.
-
No, one way or another, I have to fix it. VSS must run in order to use Macrium Reflect.
Looks like it is time for a system restore or repair if you can't help me.
-
VSS doesnt stay running at all times. It is meant to be put to manual startup and gets turned on when it is needed and off when it is done.
http://www.blackviper.com/windows-services/volume-shadow-copy/
I am concerned that the firewall cant even be opened. Since the system appears to be clean then we need to check for any bad sectors on the drive.
Do you know how to have chkdsk check for bad sectors?
Also another things that concerns me, in the log you posted "C:\Program Files\Tweaking.com\Windows Repair (All in One)\SWPRV.DLL" that file isnt part of my program.
The other errors are WMI saying it cant rebuild itself.
"Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET.MOF while recovering repository file."
You shouldnt have all these errors out of nowhere. Let me know on that bad sector check. If you tried to do a repair install with bad sectors you could be looking at a big mess. So lets make sure first.
Shane
-
I run chkdsk periodically and have never had a problem. I will do it again to be sure.
I went to the Macrium site and downloaded their "Vssfix.exe" utility and that fixed the vss problem.
I always run VSS on "Manual." I only tried doing "Automatic" to see if that would fix the problem. It didn't.
The firewall is running I just can't bring up the page that allows me to turn it off and on.
After a bit of research I turned it off in the registry. So, that isn't a problem.
I just don't understand why I cannot bring up the page that allows me to turn it off and on.
"Windows Security Suite" works fine. I can bring up that page without any problem.
That is how I know the firewall has been turned off.
I really hate it when the computer is smarter than I am ;-}}
Anyway, it is getting tedious so I think I will live with it.
Thanks For your help,
Chuck
-
OOPS I should have said Windows Security Center not Security Suite
Chuck
-
I disconnected the network and disabled Norton Antivirus, Firewall and Tamper Protection.
I ran "Repair WMI" and "Repair Volume Shadow copy" without success.
Below are the error messages from "Event Viewer."
I hope they help.
Chuck
Event Type: Error
Event Source: PerfNet
Event Category: None
Event ID: 2004
Date: 6/30/2013
Time: 9:22:54 AM
User: N/A
Computer: P5N2M7
Description:
Unable to open the Server service. Server performance data will not be returned. Error code returned is in data DWORD 0.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
I remember something about needing to rebuild the WMI registry :(
Please check here too for this error message;
http://www.microsoft.com/technet/support/ee/SearchResults.aspx?Type=0&Product=Windows%20Operating%20System&Message=Error%20code%20returned%20is%20in%20data%20DWORD%200
Data:
0000Event Type: Error
Event Source: PerfNet
Event Category: None
Event ID: 2004
Date: 6/30/2013
Time: 9:22:54 AM
User: N/A
Computer: P5N2M7
Description:
Unable to open the Server service. Server performance data will not be returned. Error code returned is in data DWORD 0.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 34 00 00 c0 4..À : 34 00 00 c0 4..À
Event Type: Error
Event Source: VSS
Event Category: None
Event ID: 4099
Date: 6/30/2013
Time: 9:15:36 AM
User: N/A
Computer: P5N2M7
Description:
Volume Shadow Copy Service error: Cannot install the component C:\Program Files\Tweaking.com\Windows Repair (All in One)\SWPRV.DLL into the COM+ application 'MS Software Shadow Copy Provider' [0x80110401].
(for now, it would be a better idea to uninstall All in one)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 43 41 44 43 41 44 4d 43 CADCADMC
0008: 31 39 38 00 00 00 00 00 198.....
0010: 43 41 44 43 41 44 4d 43 CADCADMC
0018: 31 36 30 00 00 00 00 00 160.....
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:37 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\SYSTEM32\WBEM\WINDOWSSEARCHENGINE.MOF while recovering repository file.
(you need to re-install the WBEM services) perhaps shane can help you with that?
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:36 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MOF\SERVICEMODEL.MOF while recovering repository file.
(Uninstall and reinstall 4.0 frame work and get all the updates!
Also, Please download and run system readiness tool, the latest version as it will also fix many of these issues...)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:36 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODEL.MOF while recovering repository file.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:36 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CLR.MOF while recovering repository file.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:35 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET.MOF while recovering repository file.
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.\
Event Type: Error
Event Source: WinMgmt
Event Category: None
Event ID: 4
Date: 6/30/2013
Time: 9:12:28 AM
User: N/A
Computer: P5N2M7
Description:
Failed to load MOF C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V1.1.4322\ASPNET.MOF while recovering repository file.
(You need to reinstall each framework version)
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
-
I will do this.
Thanks,
Chuck
-
Try this to fix the firewall problem:
Run these commands in a CMD.exe window (with admin rights):
- regsvr32 /s "C:\Windows\System32\FirewallControlPanel.dll"
If this doesn't help then run the second command as well.
- regsvr32 /s "C:\Windows\system32\FirewallAPI.dll"
(@Shane: Perhaps these 2 commands need to be included in "Repair Firewall" as well ?)
Yes, try to re-install MS Framework.
No, judging by the name of that one *.mof file, you need to re-install/repair/restart "Windows Search". But I haven't got a clue how to do that.
And let us/me know if it has helped you !
-
First of all I noticed I had not stated that this is on a Windows XP sp3 system. sorry about that. ( if it makes any difference)
I then uninstalled Windows Repair (all in one.)
Secondly, this is my wife's computer and although I am the one who maintains it, .net Framework 4.0
was not installed on it, which was my fault.
I installed .net 4.0 and also installed Windows Search 4.0.
I than ran the above commands, both with and without the quotation marks????? from the start/run window.
It has made no difference in the problem.
-
Have you tried these?
http://support.microsoft.com/mats/windows_security_diagnostic/
http://support.microsoft.com/mats/windows_firewall_diagnostic/
-
Windows XP ? Yes, it ABSOLUTELY DOES make a difference !!! The two files mentioned before are Win 7 files. See if you got a file called "c:\windows\system32\Firewall.cpl". If not, then a copy of that file could be in the "c:\windows\servicepackfiles\i386\" subfolder and copy that to the system32 subfolder.
Did you do a system file check ? (step 3) in "Windows Repair" (sfc /scannow) ? Perhaps more files are missing.
-
Yes, firewall.cpl is in system32.
I did both chkdsk and system file checker day before yesterday.
Both showed no problems.
Chuck
-
Some last suggestions:
- Event viewer showed two errors with "Perfnet", "event ID 2004", "Server Service", "Performance info couldn't be returned". Some GOOGLE-ing revealed that this is a "networking" problem. You could do more research with these keywords. For me, it suggests once more that WMI could be faulty/broken, fails to pull up the required info for the firewall. Or perhaps the firewall fails to pull up info from the performance counters/monitors.
- Does XP have a process/service "Services" (as well) ?
- Did you recently install some new drivers for e.g. the network(ing) hardware ? Those drivers could contain some faulty program code.
- Try to re-install the drivers for the network hardware. Those drivers also register info Windows needs. Some think Windows is very smart but the info Windows pulls up, is provided by software/drivers. I wouldn't be surprised that WMI info (*.mof) is installed by software (drivers) as well.
-
Also another things that concerns me, in the log you posted "C:\Program Files\Tweaking.com\Windows Repair (All in One)\SWPRV.DLL" that file isnt part of my program.
Shane
Perhaps WR tries to update the registry with the wrong "swprv.dll" reg info ?
-
Just an update.
This morning I booted the computer and tried to access the firewall control panel.
It gave me the same message.
However, Event Viewer shows no errors or warnings?????
Chuck
-
BTW: "Repair VSS" contains a bug. The VSS service is not being turned on (again) after the repair has finished.
-
With so many odd things, I wonder if doing a repair install is worth the next step instead of a fresh install.
Something to consider
http://michaelstevenstech.com/XPrepairinstall.htm
It is possible it is a .net problem since you did have erros with it.
Try the .net removal tool, reboot then install .net again
http://blogs.msdn.com/b/astebner/archive/2008/08/28/8904493.aspx
Shane
-
I am curious what that Macrium VSS repair tool adds to the registry. Because Macrium offers a procedure to "repair VSS" that's very similar to what WR's "repair VSS" does.
http://kb.macrium.com/KnowledgebaseArticle50010.aspx
What I consider to be the main difference is that WR's "Repair VSS" doesn't start two services at the end ("net start vss" & "net start swprv") and perhaps the sequence of a number of commands. When I run WR's "Repair VSS" on my Win 7 system then nothing goes wrong. When I run Registry Backup afterwards then VSS does properly function, absolutely no problems.
@Ka6uup:
- when you run the text file (see attachment) as a *.bat file with admin rights, does VSS function properly afterwards ? Or is then VSS "broken" again ?
- Can you post the content of the following two keys (and all sub keys) in the registry:
"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS]" and
"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\swprv]"
-
There could be another good reason why Ka6uup isn't able to restore/repair the firewall (& the Firewall info in the registry). When the user runs WR's "Restore Important Services" then WR doesn't stop those Services ("net stop .......") before restoring and WR doesn't restart ("net start ......") those Services after restoring.
Time to issue an (Emergency) Update ?
-
Even if a service is running you can still restore the regkeys to it. No need to stop them. Only reason to stop them is if you needed to replace a file that was in use by them :wink:
Shane
-
@Ka6uup: You still can use Windows Repair (WR) to solve a number of problems in Windows XP and keep the MS firewall disabled/turned off at the same time. To do this in XP requires a different approach than in Win 7 (Vista ??) and higher.
For XP, add the line (including all spaces)
"Sc config SharedAccess start= disabled"
to the file "Services_start.txt" (in a subfolder of WR) and run the "Set Services to Default Start" option, everytime you run WR. Then WR disables the MS firewall at the end of the program.
-
Thanks.
I appreciate your help.
Chuck
-
@Ka6uup: Take the file in the attachment and place it in the "files" subfolder of WR. Change the extension from ".txt" to ".bat". Turn off the internet & Norton and then run the file with admin rights.
If this helps to solve the "unidentified" error, then it's - IMO - a good clue where WR needs to be improved.
-
It may take me a couple of days to get to this but I will try it and let you know.
Chuck
-
@Ka6uup: I found another reason why your firewall may be corrupted. Unzip the files in the attachment, place the files in the "files" subfolder of WR, run the *.bat file with admin rights. Perhaps now your "unidentified error" is solved.
-
Been busy, did you guys get this fixed?
-
@Rick: I am waiting for an answer from Ka6uup
@Ka6uup: I have one more question. do you have a file called "c:\windows\system32\ipnathlp.dll" ? The Firewall in XP ("Sharedaccess") needs this file. If you don't, you can copy the file from the "C:\windows\system32\dllcache" directory.
-
Yes, it is there
Chuck
-
Not the answer I was hoping for but it - at least - removes one question mark.
-
I cant remember, have you ran combofix.exe yet?
Shane
-
No. Where would one find it?
Chuck
-
http://www.bleepingcomputer.com/download/combofix/
Shane
-
@Ka6uup: I am curious what the content is of the registry for a number of services. Download the FARBAR service tool.
http://www.bleepingcomputer.com/download/farbar-service-scanner/
1. Tick all the boxes and hit "Scan". Perhaps some of the driver files are missing.
2. Type "SharedAccess", "Wscsvc" in the "Search:" box and hit "Export Service".
Then post both results in the attachment of your next post.
-
@Ka6uup: Did you try the latest WR version ? It has a number of improvements that could fix your Firewall problem.