Tech – for Everyone

Tech Tips and Tricks & Advice – written in plain English.

Windows Firewall Warning Balloon*

Reader Asks Why His Firewall Won’t Stay On After Boot

Q: About 5 times during every startup in Windows XP, I get the pop-up balloon that says my firewall is off.  Usually I just turn it back on.  Now when I go to control panel I’m unable to turn it on via the Firewall icon (asks me if I want to activate ICS, I say yes and it won’t load it) or via Security Center.  Any ideas? nofirewall

A: It is not terribly alarming to see the balloon message once, briefly, during the XP startup– but it should resolve itself quickly  and automatically (it has to do with the order in which things load). You should not have to go in and turn it on each time. You set XP to use the firewall (or not) one time.

Without looking at your machine, please understand I can only give you general answers: firewall behavior such as you described is typically caused by two things– a malware infection which is disabling the firewall so that it can accomplish its nefarious goals; and/or corrupted Windows system files.
(If your machine is taking a really long time to start, this can also be a clue that you are infected and/or it can also mean you have too many programs loading at boot. You might want to read,

You want to try to make certain you’re free of infection, and I have written many articles on removing malware, and also How To Cure A Malware Infection.

Modern malware is nasty stuff, and there’s no guarantees (short of reinstalling Windows), but here are some generic and general tips:
* Start by surfing to Trend Micro’s Housecall  and run an online scan of your machine (I suggest using the “try the new version” link).
* Make sure your antivirus hasn’t “expired” and is updated with the latest definitions.
* Download and install the free version of Spyware Doctor from the Google Pack and run it twice– a Full/Deep, and then a “quick/Intelligent.

Once you have all clean scans– if you still have the same problem, it is probably corrupted files (or, your infection is a bad one). You may need an XP Install disc (you may be able to use the disc that came with your computer, even if it isn’t an official Microsoft disc) for these next steps.
* Open a command prompt, Start >Programs >Accessories >Command Prompt, and launch the System File Checker by typing in sfc /scannow. Insert the disc when/if prompted (and close any windows that open.. you don’t want to run Setup, or launch a recovery).

* 99.9% of everybody has no use for ICS (Internet Connection Sharing) and you do not want this “enabled”.

* As much as I recommend having a firewall, I must also say XP’s firewall is not all that great. Please look at

Please note: Since this behavior is usually indicative of real problems, it is not a bad idea to have a qualified PC repair technician have a look at your system.

Today’s free download: (from site) “With DataCD you will be able to print simple CD jewel case labels (Back & Front Cover, Slim CD Front Cover, Pocket Slim CD Front Cover, SuperDisk 120mb, NeatO [68646] NeatO [68645]). This is the ideal software if you decide to create personalized labels for your CDs.”

* Originally published 9/08/08

Copyright 2007-9 © Tech Paul. All rights reserved. post to jaanix

Share this post :

March 15, 2009 - Posted by | advice, computers, firewall, how to, Internet, Microsoft, networking, PC, performance, security, tech, troubleshooting, Windows, XP


  1. TechPaul,

    A great answer to a perplexing question.

    I tend to lean toward a malware infection on this one, given the circumstances. The user being asked to activate ICS, in conjunction with the disabled Firewall, is just too cute and coincidental.


    Comment by Bill Mullins | March 15, 2009 | Reply

    • Mr. Mullins–
      As do I, but he doesn’t mention any other symptoms… I wouldn’t dare diagnose his problem with just the information provided, but this “general advice” can hopefully get him started down the right path.


      Comment by techpaul | March 15, 2009 | Reply

  2. TechPaul and Bill,

    Concur with you both on this one… Problems such as these, that especially affect the “security components” of the computer and are occurrences that are being auto generated (without user intervention), are probable signs that something has been introduced into the computer… Good advice there TechPaul!



    Comment by whatsonmypc | March 17, 2009 | Reply

  3. It is likely neither of those..more likely to do with dependencies of the firewall services such as Network Connections ..which can make sense as the purpose of the firewall is directly related to network communications, Wait for it, it will likely turn on once network connection does it’s thing


    Comment by couldaswore | January 4, 2013 | Reply

Post your Comment/Question

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: