Repair and Restore Base Filtering Engine (BFE)

Windows Filtering Platform (WFP) is a set of system services that enable developing firewall and other connection monitoring and packet processing software. Base Filtering Engine (BFE) is one of these services facilitating WFP. It is vital for the protection of your system against certain Viruses and Trojans, and serves many firewall products. A missing base filtering engine can lead to, or cause from a malware attack.

Missing or Disabled BFE

In the initial phase of infection process, Viruses and Trojans aim to disable or terminate BFE service. The reason for doing so is to influence independent firewall applications, as the filtering service assists these firewall applications in sniffing out the Viruses and Trojans. In case of a disabled or terminated filtering service, no antivirus solution would help you remove viruses from your system.

BFE service is a fundamental constituent of modern versions of Windows operating system. It can be viewed at a number of places in the system. The actual file of BFE lies in a Windows directory, the service can be controlled from Local Services, and its entries reside in Windows Registry. A corrupted or attacked BFE is disabled and its registry keys and values are deleted from Windows registry. Resultantly, it also winds itself up from Local Services database.

Cause

It is caused due to certain applications, processes, and/or services that are vulnerable to malware. For example, an outdated Adobe Flash that is unable to play the media content on a webpage has the tendency to download files. These files may have malicious codes written on them, and when executed, infect your system. Even a User Account Control (UAC) may not be able to prevent the infection.

Solutions

• Restore BFE Registry Entries
• System Restore
• Repair the service .dll file

Restore BFE Registry Entries

Since, the registry entry for BFE has either gone corrupted or being attacked by a malware, the steps stated below would instruct you to enter and modify concerned registry keys. Before doing so, you are advised to scan the registry with a free registry cleaner Registry Recycler to ensure an error free environment.

A missing or disabled BFE can possibly be restored and made operational. Given below is the download link to acquire a new registry file containing essential entries for BFE. Download the zip file and act accordingly, as told in the instructions.

• Click here to download .reg file for Windows 7
• Extract the file from compressed folder and double click it
• Alternatively, go to the File menu of Registry Editor and choose to Import
• Go to Start menu Search and type regedit
• Press Enter to open Windows Registry Editor
• Locate the downloaded and extracted .reg file and open it in Registry Editor
• Now Expand through HKEY_LOCAL_MACHINE to reach the following registry key
• SYSTEM\CurrentControlSet\services\BFE\Parameters\Policy
• Right click the Policy key and access its Permissions
• In the Permissions for Parameters dialog box, click Add button for a new group or username
• Type Everyone in the object name and click OK to create one
• Select Everyone in the above list and check Full Control checkbox under Allow. Click OK
• Click OK to save your changes and Restart your computer

If the issue persists even after a restart, change the permissions of Internet Connection Sharing (ICS) service to Allow Full Control. Locate SharedAccess under Services and repeat the steps as in case of BFE. Please note that we do not recommend a permission set having full control, as it may lead to a security lapse. However, this is the way out in this scenario.

System Restore

Another way to recover BFE is through the system restore option. If you or the system has already created a restore point before the problem arose, you can reverse your PC to those settings. However, you will quite possibly lose your data and settings incorporated at later dates, but if the restore point was created after the problem was triggered, a system restore will not help you out with this issue.

Repair the service .dll file

Since the registry entry of Base Filtering Engine has already been restored in the earlier section of this article, it should be good to go by now. However, if you are able to locate the service in Local Services database but cannot start it, be informed that the relevant file situated at Windows\System32\bfe.dll might have gone corrupted or missing. To tackle this issue accordingly, you may need to run scan with System File Checker. It will troubleshoot damaged or missing system files and restore them. To see the chronological workout, go through the text below.

• Go to Start menu Search and type command prompt in the search box
• Right click Command Prompt in the search results and Run as administrator
• Type the command line SFC /scanfile=c:\windows\system32\bfe.dll and press Enter key
• Replace C: in the above command with your own system drive letter
• Type Exit and press Enter to quit command prompt
• Restart your computer

Precaution

Once you have successfully recovered your BFE service, you can verify its existence by locating it in the Local Services database. To do so, please refer to the following points.

• Verify the service named Base Filtering Engine, restored through Local Services by typing services.msc in Start menu Search
• Update your antivirus application and scan your entire system with it
• Update the vulnerable applications / processes / services to the latest version
• Create a system restore point for any use in future