# Cannot start Windows Firewall



## davel1234

I have just cleaned my PC of malware with the help of 'Chemist' on the Spyware Forum thread:

http://www.techsupportforum.com/f100/help-with-trojans-339861.html#post1943292

I now cannot start windows firewall

Done method 1 and 2 at
http://support.microsoft.com/kb/920074

tried 'netsh winsock reset'
tried 'netsh firewall reset'

still cannot start the service.. any ideas

Thanks in advance


----------



## BoT

do you have any other firewall installed.
did you check the running services in the task manager for a hidden process that acts as a firewall?
did you try to start the service under "computer management"?


----------



## davel1234

Hi

No other Firewall or anything acting as a Firewall as far as I can see. I run AVG anti virus.

When I try to start the service manually in computer/manage I receive the error:

Could not start the Windows Firewall/Internet Connection Sharing (ICS) service on Local Computer.
Error 126: The specified module could not be found


----------



## BoT

make sure that the dependent services are running as well and that the ics entry in the registry has the correct values.
you can find out about the dependentcies by right-clicking on the service in computer management and select properties, then go to the dependencies tab.
most likely network connection, wmi and rpc.
the registry entry is in HKLM\system\currentcontrolset\services\sharedaccess


----------



## davel1234

Hi
Thanks for your reply

You are right about the dependent services. I have checked they match and they are all running.

What do I need to check in the registry. I have found registry entry HKLM\system\currentcontrolset\services\sharedaccess
What setting do I need to check?

Thanks


----------



## BoT

let me see if i can post a screeny next time i get my hands on an xp machine.
this is xp? which service pack?
btw, did you install or uninstall any SP's?

there should be a an actual file location in the reg key that points to the file
check that the file is actually in the location


----------



## davel1234

XP SP3
SP3 recently installed but I think the problem was on before that.


----------



## vladimirb

Maybe you should try SFC /SCANNOW to replace missing or corrupted files...
Put XP CD, go
START > RUN... > type SFC /SCANNOW and hit Enter...
Restart PC after it finishes scan...

If this does not help, try System Repair...

Hope this will help you mate...


----------



## davel1234

vladimirb said:


> Maybe you should try SFC /SCANNOW to replace missing or corrupted files...
> Put XP CD, go
> START > RUN... > type SFC /SCANNOW and hit Enter...
> Restart PC after it finishes scan...
> 
> If this does not help, try System Repair


Tried SCANNOW and XP repair

Still cannot start Firewall!


----------



## vladimirb

What anti-virus software you have???
Did you scan your PC????


----------



## davel1234

vladimirb said:


> What anti-virus software you have???
> Did you scan your PC????


AVG anti-virus

The PC is clean now. Spent a lot of time and actions with user 'Chemist' on the other virus forum. Cleaned PC of malware. Running fine now. Just no Firewall.

Link:
http://www.techsupportforum.com/f100/help-with-trojans-339861.html


----------



## bilbus

net start sharedaccess

What error do you get?


----------



## davel1234

bilbus said:


> net start sharedaccess
> 
> What error do you get?


net start sharedaccess
The Windows Firewall/Internet Connection Sharing (ICS) service is starting.
The Windows Firewall/Internet Connection Sharing (ICS) service could not be started.

A system error has occurred.

System error 126 has occurred.

The specified module could not be found.

___________________________________________

sc query sharedaccess

SERVICE_NAME: sharedaccess
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 126 (0x7e)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0


----------



## vladimirb

I found this possible solution, never tried it but it could work:

This problem occurs if the Srvsvc.dll file is missing. To resolve this problem, extract a new copy of the Srvsvc.dll file from the Windows XP disk to the %systemroot%\system32 folder on the computer's hard disk. To do this, follow these steps:

* Insert the Windows XP disk into the CD drive.
* Click Start, click Run, type cmd in the Open box, and then click OK
* At the command prompt, type the following command, and then press ENTER. 

expand CD drive:\i386\srvsvc.dl_ %systemroot%\system32\srvsvc.dll

* Similarly, expand srv.sys file to the drivers folder. Use the following command:

expand CD drive:\i386\srv.sy_ %systemroot%\system32\drivers\srv.sys


Make sure that there is a character space between "srvsvc.dl_" and "%systemroot%."


----------



## davel1234

Tried both commands on first command:

Error:
Can't open output file: c:\windows\system32\srvsvc.dll



I did a search for Srvsvc.dll on C and it is there in C:\WINDOWS\system32


----------



## vladimirb

Yeah, it is there but it is in some way corrupted or, as it is clearly stated on Microsoft support site, spaces are added in registry key...

Try this:

This problem occurs when you have spaces added at the end of the Value specified in the TYPE Key in:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

1. Navigate to the following Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Parameters

2. Double click on the TYPE Value and remove the extra space after the value. Extra spaces entered after the Value are shown as a blue selected text.

3. Restart the computer. 

Hope this will help you mate...
Keep us posted...


----------



## davel1234

No space after value

value = NTP


----------



## Qjet

This is an old post but I'm convinced the OP is suffering from the same problem I was. The answer ended up being painfully obvious. A virus comes in, alters or replaced the windows firewall, antivirus removes it, and you get that error: Error 126: The specified module could not be found

SFC /scannow didn't seem to detect the problem, which is greatly confusing, so doing it manually will work. 

The file you need is ipnathlp.dll (i think) double check your system32 folder to see if it is missing, If it is, grab it off the XP CD (this cd better have SP2 or greater on it) (methods mentioned above should work) Or off another working XP installation.

This was the problem on my machine. Sorry if this is a necro post, its just this thread turns up on google and I'm adding to possible solutions.


----------

