Solved Cannot Activate Windows Firewall, No Internet Connectivity

epodowski · Oct 28, 2012

I have a Windows Vista Home Premium 32bit Toshiba Laptop and I think I removed a virus which I originally thought Norton 360 became corrupted. I have multiple issues.

I have removed Norton 360 which was not working any longer after the virus. I successfully used the Norton Removal tool to remove it completely.

I have no Internet access. I re-installed the network drivers but it did not change. I know the network works, because when I used the Kaspersky Rescue Disk to remove the virus, it was able to access the Internet. KRD is a bootable disk using Linux to install and scan the hard drive for viruses.

Cannot start DHCP Client Service. I am having this problem with different services.

I have also used Malwarebytes which found two Trojan.FakeAlert Registry Keys and removed them.

I cannot start the Windows Firewall.

I have been reading several things in this forum and one of the suggestions was to run sfc /scannow. I think it fixed several issues, but it could not fix all of them.

I would like to ask if someone could interrupt the CBS.log file and give me some suggestion how I might resolve the issues it could not fix.

Thank you!

pengipete · Oct 29, 2012

Sounds to me like your permissions have been corrupted or altered. (Permissions are security "flags" that are attached to files and folders to restrict who or what can make alterations to those files).

It is possible to reset the permissions to their default settings but it's not really an easy thing to do with Vista - and doing it wrong can cause major instability or leave your pc wide-open to other malware.

To be honest, after any serious malware infection, the best thing to do is to reinstall Windows and then install all of the applications that you know are safe from the original source - anything else is taking a chance. Reinstalling may seem liek a chore but it's probably a lot quicker and easier than trying to dig through logs and track-down what may be a well-buried problem - plus you'll have the benefit of a lean, fresh version of Windows to work with.

epodowski · Oct 29, 2012

Thank you pengipete for your reply.

I am not sure, if you reviewed the CBS.log file which is extensive. I found a way to search for just the errors which "cannot" [be] "repaired" by sfc /scannow and I only found two files which cannot be repaired. The "rtffilt.dll" and the "settings.ini" files. The settings file does not appear to be related to security and I am still looking for information on the "rtffilt.dll" file.

I am still at a loss for a real solution to correct these issues and I am continuing my research.

If anyone else has any suggestions, please do not hesitate to let me know. I appreciate your help.

richc46 · Oct 29, 2012

If you want us to look at your log, upload it to us.

epodowski · Oct 29, 2012

Thank you for taking a look at the CBS.log file for me. I am on the east coast [USA] om the mid-Atlantic region and we are being pounded by hurricane Sandy's 90 mile an hour winds, so we may lose power and I may not be able to respond for a period of time.

Thank you again for your help!

tom982 · Oct 29, 2012

Hello epodowski and welcome to the forums :party:

SFC has done a lot of work and there's a lot to read through in your CBS log. Would you mind rebooting then running SFC again and uploading the log as before please? That way, we'll only be left with the things that SFC couldn't fix the first time round.

No worries about any delays, hope you stay safe!

Tom

pengipete · Oct 30, 2012

I believe that rtffilt.dll is a rich text format filter/indexer used by apps like Word. I can't find any reference to it causing any problems like yours.

Settings.ini is just a text file used to store settings for Vista's sidebar - that file can be deleted or renamed if necessary - a new one will be created automatically the next time you run Windows. (Always best to just rename a file by adding "old" or similar to the name - that ways it's easy to restore if necessary)

Oddly enough, I found other reports of a corrupt sidebar settings.ini file causing bizarre behaviour in windows - like this one Windows Vista freezes and SFC cannot repair Settings.ini file - Microsoft Community - in which the person couldn't even even move or resize ordinary windows or scroll the contents. That post also contains some useful advice on how to "clean boot" Windows - which may help you.

Just to clarify one thing - when I said "security" in reference to permissions, I'm not talking about security in the "Anti-virus" sense of the word - permissions are there to stop unauthorised changes to files. The "security" angle is not related to the original purpose of the file but the protection of it.

tom982 · Oct 30, 2012

pengipete said:
I believe that rtffilt.dll is a rich text format filter/indexer used by apps like Word. I can't find any reference to it causing any problems like yours.

Settings.ini is just a text file used to store settings for Vista's sidebar - that file can be deleted or renamed if necessary - a new one will be created automatically the next time you run Windows. (Always best to just rename a file by adding "old" or similar to the name - that ways it's easy to restore if necessary)

Oddly enough, I found other reports of a corrupt sidebar settings.ini file causing bizarre behaviour in windows - like this one Windows Vista freezes and SFC cannot repair Settings.ini file - Microsoft Community - in which the person couldn't even even move or resize ordinary windows or scroll the contents. That post also contains some useful advice on how to "clean boot" Windows - which may help you.

Just to clarify one thing - when I said "security" in reference to permissions, I'm not talking about security in the "Anti-virus" sense of the word - permissions are there to stop unauthorised changes to files. The "security" angle is not related to the original purpose of the file but the protection of it.

settings.ini always comes up and is nothing to worry about. If someone adds a custom sidebar gadget in Vista, settings.ini gets modified accordingly. Then when SFC checks the file hash, it sees it as different to what the default is and thinks it's corrupt

pengipete · Oct 30, 2012

The only side-bar I use is the one at the Red Lion - cos you get served faster there

tom982 · Oct 30, 2012

pengipete said:
The only side-bar I use is the one at the Red Lion - cos you get served faster there

epodowski · Oct 30, 2012

tom982 said:
Hello epodowski and welcome to the forums

SFC has done a lot of work and there's a lot to read through in your CBS log. Would you mind rebooting then running SFC again and uploading the log as before please? That way, we'll only be left with the things that SFC couldn't fix the first time round.

No worries about any delays, hope you stay safe!

Tom

Tom,

Thanks for your input. I cleared the log files and re-ran the SFC again. Please see the attached file.

Aside from not being able to turn on several key services, Windows Firewall, Automatic Updates, DHCP Client [says starting and never changes], accessing any network or Internet, the laptop is functioning very well. It is faster than it has been in for a very long time. I did notice something that has changed. I can no longer see anything in "Turn Windows features on or off.

On the hurricane front... Fortunately, we did not lose power overnight, but there are a lot of people who have suffered severe damages up and down the east coast [USA]. I am still laughing about the side-bar comments.

Thanks again for everyone's help. It is much appreciated. I have learned a lot from reading the different tutorials on the Vista Forums.

tom982 · Oct 30, 2012

Hi epodowski,

Glad to hear you've dodged the storm! We've seen some quite bad pictures of it over here in the UK.

Could you copy this file:

C:\Windows\WinSxS\x86_microsoft-windows-content-filter-rtf_31bf3856ad364e35_7.0.6001.16503_none_485964bf76e0570a\rtffilt.dll

To this location:

C:\Windows\System32\rtffilt.dll

Overwrite the existing file!

Then follow these instructions:

Set permissions to TrustedInstaller

Download Se7en File Replacer from this link: http://www.xptsp.com/fixit/get.php?url=programs/Se7en_File_Replacer_v1.5.4.7z

If you can't extract this, open it with 7zip
In Se7ven File Replacer, click the Extra tab, then click Restore Trusted Installer
Click Yes when prompted to continue
You will be asked to select a file, navigate to the following file and select it:

%SYSTEMROOT%\Windows\System32\rtffilt.dll

Where %SYSTEMROOT% is the root folder of your system drive - usually C:\

Then reboot, run SFC again, and upload your CBS log please

The tutorials section is a great reference and it's good to hear that you use it. Although some of us helpers write the occasional tutorial, the majority of the work there was done by one of the Admins: Brink.

Tom

epodowski · Nov 1, 2012

Tom,

I apologize for the delay in getting back to you. First I had electric then I don't. Then I have Internet access then I don't. The effects of Sandy is still being felt.

I followed the instructions in your previous post. Please see attach CBS.log

Thank you again!
Ed

Solved Cannot Activate Windows Firewall, No Internet Connectivity

My Computer

My Computer

My Computer

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

My Computer

٩(͡๏̯͡๏)۶

My Computer

Attachments

My Computer

٩(͡๏̯͡๏)۶

My Computer

Attachments

My Computer