XP Pro Firewall ALWAYS disabled after booting..

[anandtech2010]

I understand that running Windows XP Service Pack 2 (SP2), Windows Firewall is turned on by default. My Windows Firewall must be turned on each and every time I boot into XP Pro. The Firewall is thus disabled when I remove power to my PC. Is this a sign of insidious malware?

When I boot selecting "load all drivers", then the Firewall is active. "Selective booting" results in the firewall disabled. The PC used to boot showing the Windows firewall active until about 1 month ago. I do not download any files or use any P2P apps.

Any remedy for this puzzle?

Thank you gents.

 

[bruceb]

Look at the registry keys below:

Disabling the Windows Firewall

In order to turn off the Windows Firewall in the Registry Editor, the correct key must be amended.
Go to Start > Run and type regedit at the insertion point.
In the Registry Editor, go to Edit > Find and paste the following path (Windows XP SP3) then click OK

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile

The Reg_DWORD value EnableFirewall can be edited, with an amendment to the Value Data setting of 0. By changing this to 1, the Windows Firewall will be disabled.
For Windows XP SP2, the Reg_DWORD value EnableFirewall can be accessed via the following registry entries, depending upon your environment:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfiles

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfiles

Again as with the Service Pack 3 solution, the Value Data setting of 0 should be changed to 1 in the Reg_DWORD value EnableFirewall.

Value of 0 Enables Firewall ... Value of 1 Disables Firewall

You may also want to run some antivirus and malware scans.
Something may have gotten in your system.

 

[wheresmybacon]

If the registry is in order, I'd fire up your malware detection suite of choice. Spybot S&D has worked well for me, without the realtime stuff installed.

Also, what A/V software do you run? If it has its own firewall that would be another reason as Windows Firewall is reporting off.