Windows Firewall switching off

I'm using Windows XP Home Edition version 2000 SP3. My antivirus program is
AVG Free 8.0.237.
A week ago Spyware Protect 2009 pop-ups appeared repeatedly. After
unsuccessfully trying to fix this with AVG I downloaded the MSRT from
Microsoft which found it & got rid of it.
However Windows Firewall now turns itself off once or twice a day and it
seems to coincide with AVG Resident Shield reporting two simultaneous
threats. One is always Trojan horse Generic 12.AZMV. The other is usually
C:\Windows\System32\ntos.exe but I've also seen Backdoor.Agent.ZQV.
I've run 2 AVG scans (which picked up several Generic 12 instances), the
MSRT twice (which found nothing), the Clean-up tool, and I keep checking
Windows Defender, which reports nothing found. Windows Firewall, Automatic
Updates & Virus Protection are all turned on. However, the firewall still
periodically turns itself off.
Please can someone advise - I'm wondering if a virus or spyware is hidden
somewhere and is causing the firewall issue.

--
MikeK02

Download, install, run, update and perform a full scan (separately) with the
following two applications (freeware versions are the ones to use for this):

SuperAntiSpyware
http://www.superantispyware.com/

MalwareBytes
http://www.malwarebytes.com/

After performing a full scan with one and then the other and removing
whatever they both find completely, you may uninstall these products,
if you wish.

Reboot.

Start button --> RUN and type in:
%SystemRoot%\system32\net stop wuauserv
--> Click OK.

Start button --> RUN and type in:
%SystemRoot%\system32\regsvr32 %SystemRoot%\system32\wups2.dll
--> Click OK.

Start button --> RUN and type in:
%SystemRoot%\system32\net start wuauserv
--> Click OK.

Download the latest version of the Windows Update agent from here (x86):
http://go.microsoft.com/fwlink/?LinkID=91237
.... and save it to the root of your C:\ drive. After saving it to the root
of the C:\ drive, do the following:

Close all Internet Explorer windows and other applications.

Start button --> RUN and type in:
%SystemDrive%\windowsupdateagent30-x86.exe /WUFORCE
--> Click OK.

(If asked, select "Run.) --> Click on NEXT --> Select "I agree" and click on
NEXT --> When it finishes installing, click on "Finish"...

Reboot.

Download/Install the latest Windows Installer:
http://www.microsoft.com/downloadS/d...displaylang=en

Reboot.

Log on as an user with administrative rights and open Internet Explorer and
visit http://windowsupdate.microsoft.com/ and select to do a CUSTOM scan...
(Every time you are about to click on something while at these web pages -
first press and hold down the CTRL key while you click on it. You can
release the CTRL key after clicking each time.)

Once the scan is done, select just _ONE_ of the high priority updates
(deselect any others) and install it.

Reboot again.

If it did work - try the web page again - selecting no more than 3-5 at a
time.

The Optional Software updates are generally safe - although I recommend
against the "Windows Search" one. I would completely avoid the Optional
Hardware updates.

Come back - let us know if that worked.
.... Really - come back and let everyone know if that worked.

If it seemed to have failed, do this:

Click Start, and then click Run.
In the Open box, type: %windir%\windowsupdate.log
and then click OK.

Scroll down towards the bottom for the latest entries to locate any error
code(s) or explanation as to why the page cannot be displayed.

You can copy/paste the last 50 or so lines here...

How to read the Windowsupdate.log file:
http://support.microsoft.com/kb/902093

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/ma...e/default.mspx

2. Run the Windows Live Safety Center's 'Protection' scan (only!) in Safe
Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting the requested
logs in an appropriate forum, not here.

Checking for/Help with Hijackware

**Seek expert assistance in

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

I may finally have got this sorted by following steps:
1. Disable internet connection
2. Turn off System Restore
3. Run Superantispyware and Malwarebytes full scans
4. Reinstall Service Pack 3 from CD
5. Reverse 1 & 2 above

Disabling net access prevented reinfection while scans were running, since
changing firewall settings only worked until next attack. Attacks were
intercepted by AVG but not before wsnpoem and/or ntos.exe got through. SP3
reinstallation seems to have been crucial stage in getting Windows Firewall
to work properly again without switching off. I can't tell if firewall switch
off allowed virus attack or if virus already present on PC caused firewall
settings to alter periodically.

Thanks for your help - maybe this experience will assist someone else. Hope
my relief is not premature!

I followed all the instructions, but still had problems. Then I noticed that
windows firewall was only turning off when I used my wireless connection and
not the wired connection. I have a Thinkpad and use AccessConnections to
manage my settings. I noticed that one of the buried settings was set NOT to
use Windows firewall with the wireless connection on. The setting is here:

1. From ThinkVantage Access Connections, select Manage.
2. Select the profile you're problems with.
3. Select Edit.
4. Select the Additional Settings tab.
5. Make sure the Network Security box is checked, then click Settings button
to the right of it.
6. Make sure the Enable Windows Firewall box is checked.

The You-Don't-Fully-Appreciate-A-Working-Computer Fairy must have come to
visit overnight. Paying homage now to all those folks out there who help
folks like me and to working computers everywhere so the fairy doesn't make
any more visits. :)