For the past few months whenever I boot Windows XP a balloon appears saying that my computer is at risk because the Windows Firewall is not enabled. I click the balloon to open the Windows Security Centre and it recommends that I enable the firewall, which I have been doing. However, when I shutdown the computer and startup the following day the same problem occurs. Has a virus crept into the computer which is turning off the firewall overnight?

The most likely reasons for this occurring are due to other security software running on your computer, a mis-configuration in Windows, or some virus or malware which has infected your computer. We will look at all these scenarios when attempting to narrow down the problem.

The first possible reason for the firewall becoming disabled is you have other network security software running on your computer. It is not advisable to be running multiple firewalls on one computer, as they can conflict which causes more harm than good. As such, when you install a third-party firewall on the computer (such as Norton or McAfee) these will generally disable the Windows Firewall. So, if you have other firewall software on your computer which is running then having the Windows Firewall disabled is normal behaviour. That said, from your description of the problem Windows is alerting you to the fact there is no firewall enabled on the computer. This is strange, since if another firewall is operating on the computer Windows should detect that firewall within the Windows Security Centre and give a green light that the firewall is enabled, so it doesn’t continually harass you about having no firewall enabled. In your case, you are not getting any such indication. So, I am not particularly hopeful that this scenario applies in your case.

The next scenario is a misconfiguration in Windows causing the firewall to stop every time the computer is rebooted. The Windows Firewall relies on a back-end service within Windows. Services are processes which run in the background and perform tasks which do not require user interaction or intervention. An example of a common service is the print spooler, which temporarily holds (buffers) print jobs for printing. In this case, we are interested in the Windows Firewall service. If this has become disabled, or is not loading automatically on startup, it could be resulting in the firewall not starting when Windows boots. Go to the “Start” menu > “Run” and type “services.msc” (without the quotes) and click OK. This will open the Windows Services manager, listing all the services running in Windows. Scroll down to near the bottom and select “Windows Firewall/Internet Connection Sharing (ICS)”. Right-click on this process and select “Properties”. Make sure the service is started and the “Startup type” has been set to “Automatic”. If the startup type was not automatic this was most likely your problem. Once it has been corrected, click “Apply” and then OK to save and close. Make sure the Windows Firewall is enabled and then restart the computer to check whether the problem persists.

Should the firewall service appear to be in order, the next possibility is a piece of malware (e.g. spyware) or a virus has installed itself on your computer and is disabling the Windows Firewall, in an attempt to make your computer more vulnerable to attack. In order to determine whether this is the cause you should do a complete scan of your computer for viruses. If you do not already have a virus scanner I suggest that you download and install AVG Free (free.grisoft.com) which is an excellent free antivirus package. Once you have scanned for viruses and removed any infections which have been found, you should also scan the computer for spyware and adware. Download and install Ad-Aware Free (www.lavasoft.com), Spybot Search & Destroy (www.safer-networking.org), and Windows Defender (www.microsoft.com/downloads). These three utilities are free and between them should detect and remove most malware threats which may have infected your computer. Once you have installed the software, conduct a scan of your computer using each utility (make sure you conduct the scans separately and not simultaneously, otherwise you may find that the utilities conflict against each other). Remove any identified threats and restart the computer after each scan has completed. I also suggest that you run each scan twice, to remove any threats which may not have been completely removed on the first pass of the scan. Once you have scanned the computer twice using each utility check whether the problem persists.