Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Windows Firewall Won't Work and Base Filtering Engine Won't Start


  • Please log in to reply
16 replies to this topic

#1 I have a computer...

I have a computer...

  • Members
  • 84 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:24 PM

Posted 02 January 2018 - 10:16 AM

Hello,

Amongst other problems, I am having issues trying to get Windows Firewall to work.

 

I am running Windows 7 64-bit Service Pack 1 with the latest version of Avast Free Antivirus and I am logged in as an Admin.

 

Action Center reports that Windows Firewall is turned off or set-up incorrectly. When I try to turn it on it says

"Action Center can't turn on Windows Firewall.

Turn on Windows Firewall manually"

When I click on the link (the underscored text), it brings me to the Windows Firewall page where it is red and says

"Update your Firewall settings

Windows Firewall is not using the recommended settings to protect your computer."

When I click on "Use recommended settings" or try to change any of the Firewall settings, it gives me this error

"Windows Firewall can't change some of your settings.

Error code 0x8007042c"

 

In Event Viewer, there is this error:

"The Windows Firewall service depends on the Base Filtering Engine service which failed to start because of the following error:

The service cannot be started, either because it is disabled or because it has no enabled devices associated with it."

According to Services, BFE is disabled and when trying to change it's Startup type, it gives me this error:

"Access is denied."

 

In msconfig, I have checked Base Filtering Engine and restarted the computer multiple times but it always remains unchecked.

 

I'm not really sure what else to do. It could have something to do with me messing around in msconfig and temporarily disabling all of the services when I was trying to figure out what might be causing my other issue but I have since enabled all Microsoft services except Bluetooth Support ('cause I don't use Bluetooth) and Base Filtering Engine which refuses to work and since Windows Firewall service is dependent on it, that won't work.

 

I appreciate your time.



BC AdBot (Login to Remove)

 


#2 SleepyDude

SleepyDude

  • Malware Response Team
  • 3,124 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:12:24 AM

Posted 02 January 2018 - 10:35 AM

Hi,

 

Try this:

 

Download Windows Repair (All-in-One) Portable

  • extract the tweaking.com_windows_repair_aio.zip to c:\Windows\TEMP the zip will extract to a folder called Tweaking.com - Windows Repair
  • execute the file Repair_Windows.exe from the Tweaking.com - Windows Repair folder, accept the Security warning and the EULA
  • click the button Jump To Repairs
  • click the Open Repairs button to access the following screen:
    WindowsRepair.png
  • click the box All Repairs to uncheck all the box's
  • check only the following box's:
    • 01 - Reset Registry Permissions
    • 02 - Reset File Permissions
    • 03 - Reset Service Permissions
    • 25 - Restore Important Windows Services
    • 26 - Set Windows Services to Default Startup
  • check the box Restart/Shutdown System When Finished > Restart System
  • click the Start Repairs button

 


• Please do not PM me asking for support. Post on the forums instead it will increases the chances of getting help for your problem by one of us.
• Posts in the Malware section that are not replied to within 4 days will be closed. PM me or a moderator to reactivate.
• Please post your final results, good or bad. We like to know! Thank you!

 
Proud graduate of GeekU and member of UNITE
___
Rui

 
 


#3 I have a computer...

I have a computer...
  • Topic Starter

  • Members
  • 84 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:24 PM

Posted 21 January 2018 - 03:44 PM

Hi SleepyDude, thank you for your response.
I've finally gotten around to doing this. Your download link didn't work but I found the Windows Repair (All-In-On) Portable Version from the BleepingComputer website... I assume it's the right one.
After completing the steps you've posted, I am sill having the same issues:
Base Filtering Engine is disabled and always stays unchecked in msconfig even when I check it.

Windows Firewall is disabled and I get this error when I try to start it:
"Windows Firewall can't change some of your settings.

Error code 0x8007042c"

I stil find the same error in Event Viewer about the Windows Firewall.

When I try to change the Startup Type to either Disabled, Manual, or Automatic of the Base Filtering Engine with Services, I get this error: Access is denied.
But when I try to change it to Automatic (Delayed Start), I get this error:
"The delayed auto-start flag could not be set.

Error 87: The parameter is incorrect."

I didn't try ALL of the startup options last time, but I assume it would've given the same error before.

It might be worth mentioning that this hasn't been the only issue I've been experiencing with windows on this computer. I've also been having an error installing a particular Windows update even before I started having issues with Windows Firewall.
When I first made this thread, I figured that they're separate issues and I'll work on one at a time, but do you think they could be related or not?

 

Also, you didn't mention posting a log for the Windows Repair (All-in-One), but I figure I'll post it anyway just in case (I think that's it):

 

Tweaking.com - Windows Repair 2018 (v4.0.12)
--------------------------------------------------------------------------------

System Variables
--------------------------------------------------------------------------------
OS: Windows 7 Home Premium
OS Architecture: 64-bit
OS Version: 6.1.7601.24002
OS Service Pack: Service Pack 1
Computer Name: USER-PC
Windows Drive: C:\
Windows Path: C:\Windows
Program Files: C:\Program Files
Program Files (x86): C:\Program Files (x86)
Current Profile: C:\Users\user
Current Profile SID: S-1-5-21-1973585710-1515046713-2421341157-1001
Current Profile Classes: S-1-5-21-1973585710-1515046713-2421341157-1001_Classes
Profiles Location: C:\Users
Profiles Location 2: C:\Windows\ServiceProfiles
Local Settings AppData: C:\Users\user\AppData\Local
--------------------------------------------------------------------------------

System Information
--------------------------------------------------------------------------------
System Up Time: 0 Days 03:48:56

Process Count: 58
Commit Total: 1.48 GB
Commit Limit: 15.93 GB
Commit Peak: 3.30 GB
Handle Count: 19978
Kernel Total: 450.86 MB
Kernel Paged: 354.78 MB
Kernel Non Paged: 96.08 MB
System Cache: 2.10 GB
Thread Count: 966
--------------------------------------------------------------------------------

Memory Before Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 3.93 GB
Memory Used: 1.58 GB(40.1151%)
Memory Avail.: 2.35 GB
--------------------------------------------------------------------------------

Cleaning Memory Before Starting Repairs...

Memory After Cleaning with CleanMem
--------------------------------------------------------------------------------
Memory Total: 3.93 GB
Memory Used: 1.36 GB(34.4908%)
Memory Avail.: 2.57 GB
--------------------------------------------------------------------------------

Starting Repairs...
   Started at (22/01/2018 3:24:33 AM)

Setting Any Missing 'InstallDate' From Uninstall Sections Before Running Repair...
Total Missing 'InstallDate' Fixed: 137
 
01 - Reset Registry Permissions
   Restore Windows 7/8/10 Default Registry Permissions
   Start (22/01/2018 3:24:36 AM)


Decompressing & Updating Windows Permission File C:\Windows\temp\Tweaking.com - Windows Repair\files\permissions\7\hku.7z
Done,  0.19 seconds.


Decompressing & Updating Windows Permission File C:\Windows\temp\Tweaking.com - Windows Repair\files\permissions\7\hklm.7z
Done,  2.4 seconds.

   Running Repair Under System Account
   Done (22/01/2018 3:26:19 AM)

02 - Reset File Permissions
   Restore Windows 7/8/10 Default File Permissions
   Start (22/01/2018 3:26:19 AM)


Decompressing & Updating Windows Permission File C:\Windows\temp\Tweaking.com - Windows Repair\files\permissions\7\default.7z
Done,  0.14 seconds.


Decompressing & Updating Windows Permission File C:\Windows\temp\Tweaking.com - Windows Repair\files\permissions\7\profile.7z
Done,  0.15 seconds.


Decompressing & Updating Windows Permission File C:\Windows\temp\Tweaking.com - Windows Repair\files\permissions\7\program_files.7z
Done,  0.18 seconds.


Decompressing & Updating Windows Permission File C:\Windows\temp\Tweaking.com - Windows Repair\files\permissions\7\program_files_x86.7z
Done,  0.17 seconds.


Decompressing & Updating Windows Permission File C:\Windows\temp\Tweaking.com - Windows Repair\files\permissions\7\programdata.7z
Done,  0.16 seconds.


Decompressing & Updating Windows Permission File C:\Windows\temp\Tweaking.com - Windows Repair\files\permissions\7\windows.7z
Done,  1.98 seconds.

   Running Repair Under System Account
   Done (22/01/2018 3:49:11 AM)

03 - Reset Service Permissions
   Start (22/01/2018 3:49:11 AM)

   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (22/01/2018 3:50:03 AM)

25 - Restore Important Windows Services
   Start (22/01/2018 3:50:04 AM)

Decompressing & Updating Windows Permission File C:\Windows\temp\Tweaking.com - Windows Repair\files\permissions\7\services.7z
Done,  0.17 seconds.

   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (22/01/2018 3:50:18 AM)

26 - Set Windows Services To Default Startup
   Start (22/01/2018 3:50:18 AM)
   Running Repair Under Current User Account
   Running Repair Under System Account
   Done (22/01/2018 3:50:30 AM)

Cleaning up empty logs...

All Selected Repairs Done.
   Done at (22/01/2018 3:50:30 AM)
   Total Repair Time: 00:25:58


...YOU MUST RESTART YOUR SYSTEM...



Thanks for your time.


Edited by I have a computer..., 21 January 2018 - 03:49 PM.


#4 SleepyDude

SleepyDude

  • Malware Response Team
  • 3,124 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:12:24 AM

Posted 21 January 2018 - 06:50 PM

Hi,
 
Check Windows System files integrity

  • open the Command Prompt as Administrator (Tutorial)
  • type the following command and press Enter:
    sfc /scannow
    
    
    Note: This may take some time to finish.

    let me know if it doesn't say "No integrity violations found"

• Please do not PM me asking for support. Post on the forums instead it will increases the chances of getting help for your problem by one of us.
• Posts in the Malware section that are not replied to within 4 days will be closed. PM me or a moderator to reactivate.
• Please post your final results, good or bad. We like to know! Thank you!

 
Proud graduate of GeekU and member of UNITE
___
Rui

 
 


#5 I have a computer...

I have a computer...
  • Topic Starter

  • Members
  • 84 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:24 PM

Posted 22 January 2018 - 06:25 AM

I ran the scan and it came back with "Windows Resource Protection did not find any integrity violations."

#6 SleepyDude

SleepyDude

  • Malware Response Team
  • 3,124 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:12:24 AM

Posted 22 January 2018 - 06:35 AM

Let's check some windows critical services...

 

» Farbar Service Scanner (FSS) log
Download Farbar Service Scanner and save the file to the Desktop.

  • Run FSS
  • Check all the options
  • click Scan

Post the generated log in your reply.

 


• Please do not PM me asking for support. Post on the forums instead it will increases the chances of getting help for your problem by one of us.
• Posts in the Malware section that are not replied to within 4 days will be closed. PM me or a moderator to reactivate.
• Please post your final results, good or bad. We like to know! Thank you!

 
Proud graduate of GeekU and member of UNITE
___
Rui

 
 


#7 hamluis

hamluis

    Moderator


  • Moderator
  • 56,381 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:06:24 PM

Posted 22 January 2018 - 07:51 AM

Possibly Related Topic .

 

Louis



#8 I have a computer...

I have a computer...
  • Topic Starter

  • Members
  • 84 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:24 PM

Posted 22 January 2018 - 07:56 AM

Here we go:

 

Farbar Service Scanner Version: 27-01-2016
Ran by user (administrator) on 22-01-2018 at 20:53:39
Running from "C:\Users\user\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============
MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is OK.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.

bfe Service is not running. Checking service configuration:
The start type of bfe service is set to Disabled. The default start type is Auto.
The ImagePath of bfe service is OK.
The ServiceDll of bfe service is OK.


Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****



#9 SleepyDude

SleepyDude

  • Malware Response Team
  • 3,124 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:12:24 AM

Posted 22 January 2018 - 08:28 AM

Hi,

 

This isn't the first case that I get the impression that Avast may be interfering with the Windows Repair tool...

 

Please boot Windows in Safe Mode then repeat the steps from post #2

 

 

Then run FSS again and post the new log.


Edited by SleepyDude, 22 January 2018 - 08:44 AM.

• Please do not PM me asking for support. Post on the forums instead it will increases the chances of getting help for your problem by one of us.
• Posts in the Malware section that are not replied to within 4 days will be closed. PM me or a moderator to reactivate.
• Please post your final results, good or bad. We like to know! Thank you!

 
Proud graduate of GeekU and member of UNITE
___
Rui

 
 


#10 I have a computer...

I have a computer...
  • Topic Starter

  • Members
  • 84 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:24 PM

Posted 22 January 2018 - 11:07 AM

I've run Windows Repair (All-in-One) in safe mode, then restarted and ran FSS in normal mode. Is that right? I wasn't sure if I was meant to run FSS in safe mode or not.

 

Farbar Service Scanner Version: 27-01-2016
Ran by user (administrator) on 23-01-2018 at 00:03:39
Running from "C:\Users\user\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****



#11 SleepyDude

SleepyDude

  • Malware Response Team
  • 3,124 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:12:24 AM

Posted 22 January 2018 - 11:53 AM

Hi,

 

Sorry for not being clear on my instructions, you did ok by running FSS in normal mode.

 

How is the Firewall now?


• Please do not PM me asking for support. Post on the forums instead it will increases the chances of getting help for your problem by one of us.
• Posts in the Malware section that are not replied to within 4 days will be closed. PM me or a moderator to reactivate.
• Please post your final results, good or bad. We like to know! Thank you!

 
Proud graduate of GeekU and member of UNITE
___
Rui

 
 


#12 I have a computer...

I have a computer...
  • Topic Starter

  • Members
  • 84 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:24 PM

Posted 22 January 2018 - 12:05 PM

Oh, I can't believe I forgot to check that!

Windows Firewall says that it's on and Base Filtering Engine is set to Automatic. But Base Filtering Engine isn't checked in msconfig, is that normal then? Because in Services it says that it's Started.

 

Thank you so much! I appreciate your time!

 

So was it a case of incorrect permissions or something? That's outside of my limited range of computer knowledge. How could that have happened?



#13 SleepyDude

SleepyDude

  • Malware Response Team
  • 3,124 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:12:24 AM

Posted 22 January 2018 - 12:19 PM

If you messed with Base Filtering Engine using msconfig its possible that the tool is showing incorrect information because the Tweaking tool restored the defaults without affecting the msconfig settings...

 

Its difficult to say what changed the permissions, it could be some program that didn't work properly, malware, etc.


• Please do not PM me asking for support. Post on the forums instead it will increases the chances of getting help for your problem by one of us.
• Posts in the Malware section that are not replied to within 4 days will be closed. PM me or a moderator to reactivate.
• Please post your final results, good or bad. We like to know! Thank you!

 
Proud graduate of GeekU and member of UNITE
___
Rui

 
 


#14 I have a computer...

I have a computer...
  • Topic Starter

  • Members
  • 84 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:02:24 PM

Posted 23 January 2018 - 08:52 AM

I don't think there's been malware on here. Well, I'm usually pretty careful about that, but it's still possible.

The reason I was messing with msconfig was because I was trying to figure out if a program was causing this other issue I was having (computer spontaneously freezing). So I was disabling all services/startup programs and then enabling them a couple at a time to rule them out. Then I noticed the firewall wasn't working and I figured that after I enabled all the services it'd work again but it didn't.

But I don't know if I even checked windows firewall before I started. Maybe it wasn't working before and I didn't notice?

 

Thank you for your help!



#15 SleepyDude

SleepyDude

  • Malware Response Team
  • 3,124 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:12:24 AM

Posted 23 January 2018 - 09:09 AM

But I don't know if I even checked windows firewall before I started. Maybe it wasn't working before and I didn't notice?

Its possible, if you check the Windows Event Viewer you can probably locate the date when the problem started.
 

Thank you for your help!


You are welcome.

• Please do not PM me asking for support. Post on the forums instead it will increases the chances of getting help for your problem by one of us.
• Posts in the Malware section that are not replied to within 4 days will be closed. PM me or a moderator to reactivate.
• Please post your final results, good or bad. We like to know! Thank you!

 
Proud graduate of GeekU and member of UNITE
___
Rui

 
 





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users