Tweaking.com Support Forums
Main Forum => General Computer Support => Topic started by: peterpanx on February 17, 2013, 03:48:46 pm
-
Hi. i have a problem few days now.i try to open my windows 7 firewall but nothing happen's.i'm trying then to open the windows firewall advanced security but i get an error that the 'snap-in failed to load with error code 0x6D9 .i'm searching for a solution for hours,i try a several tips but i get no results.I also did a full scan with security essentials,super antispyware,Malware bytes,Eset on line scanner,TDSS rootkit removing tool but the computer seems to be clean.Also i have run Tweaking.com - Windows Repair (All in One) to repair the firewall,with no luck.
always when i restart i take message on start up that the " the windows could not connect to the group policy client service" and when i open a program after some resets on the firewall i did while try various tips from forum's,i get the message if i want to allow on the firewall the each connection of specific program,seems that the firewall is working but i cant lunch the window to edit it.
Can somebody help me ?thanks
-
What repairs did you run in my Windows Repair tool?
Shane
-
thanks for your reply.
I repair the windows 7 ultimate with this option enable:
Reset Registry Permissions,Reset File Permissions,Register System Files,Repair WMI,Repair Windows Firewall,Repair MDAC/MS Jet,Remove policies Set By Infections,Repair Winsock % Dns cache,Repair CD/DVD Missing/Not Working/Repair File Associations
-
OK lets make sure some services got put back.
In the registry see if you have these keys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SharedAccess
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MpsSvc
My repair tool puts these back, but lets check to make sure they are there :wink:
Shane
-
yes i have this keys
-
Ok good, now go and see if those services are running, and if they are not if they will start.
Shane
-
how i can do this?
-
Right click on computer and go to manage.
IN there you will see services on the left. :wink:
Shane
-
ok,i found BFE (Based filter Engine) but i cant find SharedAccess or MpsSvc or something similar,
-
MpsSvc is Windows Firewall service.
And sharedaccess is Internet Connection Sharing (ICS)
Shane
-
Windows Firewall is running (started)
Internet Connection Sharing (ICS) is not running and when i try to start the service i get this message: "the Internet Connection Sharing (ICS) service on local computer started and then stopped.Some services stop automatically if they are not in use by other services or programs. "
-
Thats a normal error and it should do that.
So no problems with the services that I can see. DO you get any errors opening anything else in Windows or is the firewall the only one?
Shane
-
the firewall seems to be the only one.No error messages :undecided:
-
Lets check this, let me know if you have this folder and file on your system
This firewall issue is commonly found on vista and windows 7 (64 BIT OS)
This is symptom for rootkit on 64 bit systems
if you find a folder called system64
C:/WINDOWS/SYSTEM64(not the sysWOW64)
and a file called consrv.dll
C:/WINDOWS/SYSTEM32/CONSRV.DLL
You're infected by zero access rootkit.It is recommended to contact malware removal forums to remove it
Shane
-
i have 32 bit version of windows 7 ultimate.
-
Ok but let me know if you have this file or not
C:/WINDOWS/SYSTEM32/CONSRV.DLL
Also do you know how to check permissions on reg keys?
Shane
-
no,i dont have this file,and no i dont know how to check permissions on reg keys :shy:
-
Now,Press Windows+ R key and type
regedit and click ok
go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE
Right click on it-permissions
Post a screen shot of the permissions tab for me :-)
Shane
-
here is the screenshot
-
Ok all services are installed and working, all permissions seem to be fine as well.
I wonder if there is other services it needs. See if you have these.
Security center - wscsvc
Windows defender - windefend
Shane
-
Security center - wscsvc is running in automatic (delayed start)
Windows defender (ι did not find any word as "windefend") is running at manual mode and whei i try to start it i take the same error message as before
-
Ok Windows defender shouldnt be giving an error.
Extract this zip file and apply the reg file and see if you can get that service to start.
Shane
-
i cant import it .the error message says:
cannot import windefend.reg.No all data was successfully written to the registry.Some keys are open by the system or other processes
-
Permissions problem then.
Run my repair tool again, this time only run the reg permissions repair. When it is done try the reg file again and let me know.
In fact go check the reg location in the reg and post a screen shot of the permissions for me before you run the repair :wink:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend
Shane
-
here is the capture
shall i proceed to repair the permissions with the repair tool ?
-
Odd, permissions look fine.
Try apply the reg file in safe mode for me :-)
Shane
-
after a problem that didn't let me boot up in safe mode,finally i did it.I tried to start the windows defender (that in the desc tab says:fail to read desc") but i get the same error message .... :undecided:
-
Something isnt right that is for sure. We are pretty sure your system doesnt have an infection, so it looks like it is just damage that has been done that needs fixed.
We have all the other services and repairs working. Have you ran a system file check on the system yet?
Open a cmd.exe window and put in
sfc /scannow
Shane
-
i have did this many times with no luck,but i'll run once more now
-
Normally I would have you try a repair reinstall so you can keep all your programs and settings. But I would really like to find the fix to this so I can add it to the repair tool.
Every single fix I find on Google for it is already in the Windows repair tool.
I just put out v1.9.9. Grab it, have it do a reg backup on the step 4 tab and then I want you to run every repair. Make sure your antivirus is off (Also which one do you have installed? Want to make sure it isnt causing the problem)
Once done reboot and lets see how it goes :-)
Shane
-
i have microsoft security essentials,malware anti malware and super antispyware
-
Disable them all while running the repairs, if any of them get int he way it will keep repairs from working. :wink:
Shane
-
ok,o have bad news,the problems is still here and the
the message at start up - " Windows could not connect to the Group Policy Client service. The problem prevents standard users from logging on to the system.
As an administrative user, you can review the System Event Log for details about why the service didn't respond" - is still too
-
There are some bad regkeys in the system which would explain a lot of things. Try the fix on this page and let me know if it fixes that error.
http://answers.microsoft.com/en-us/windows/forum/windows_vista-security/after-logging-on-get-error-message-windows-could/bbfe3246-0ceb-4899-bfba-7a98e642c009
Shane
-
the problem is gone!i have my firewall back!i want to thank you a lot for the time you spend to make my windows safe again!I really appreciate your software and your's technically knowledge about windows os.I'm sure i'll return to this forum for the next unsolved windows problem.
-
Glad to hear it is fixed :-)
Couple of questions though.
1. Did you test the firewall after the new error? Or did it still not work and you got the new error?
2. Which repair on that page did the trick for you so I can add it to the program :-)
Shane
-
i dont have yet a new error,i'm sure i'll get (thats how the windows works) :artist:
I repair the registry manually follow the instructions below
There are two places to look in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services this path should contain gpsvckey (a folder), which is responsible for service parameters and configuration. I found that the key was intact, so, you do not touch anything here - just check that the key exists.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SVCHOST This is the most important path you should look into, as it must contain the keys and values referred in the key #1. Below are descriptions what must be present there.
There must be Multi-String value called GPSvcGroup. My laptop was missing it. So, you should create multi-string value named GPSvcGroup and assign it value GPSvc.
Next, you must create a key (a folder) and name it GPSvcGroup - this key normally should be there, but, again, it was missin on my laptop.
Then open newly-created GPSvcGroup folder and create 2 DWORD values:
First called AuthenticationCapabilities and you must give it a value of 0x00003020 (or 12320 in decimal)
Second is called CoInitializeSecurityParam and it must have value of 1.
-
Ok I did some testing. And removing that key does break the firewall. So I checked and xp, 2003 and Windows 8 dont use those keys. Seems only vista and 7 do. So I will add these keys to the next update for vista and 7 to the repair firewall :-)
Shane