Jump to content

Another Protection turned off issue


Recommended Posts

Hello guys I have been experiencing the web protection turned off issue too.

tried the provided solution of updating database/reinstalling etc. settings still doesn't stick on reboots.

funny thing is, my windows firewall is also turning off on every reboots.

attached is my mb-check-results

and i wasn't able to run FRST. both 64 and 32 bits app doesn't launch when I double click on them. no errors.

how can I get it back to working normally again?

 

edit: also, it seems that I have to restart windows firewall, get it running first before setting malwarebyte's web-protection sticks.

TIA

mb-check-results.zip

Edited by terencet
Link to post
Share on other sites

Hello @terencet and :welcome:

Although generally undesirable for the FRST tool, please temporarily reboot the system in question to the Windows 10 Safe mode and retry running only the latest FRST64.exe on that x64/64-bit system.

If successful, please attach the 2 separate output files, FRST.txt and Addition.txt similarly to that of your first post.

Thank you.

Link to post
Share on other sites

Your BFE service is not running, which is why Web Protection is failing and most likely other things on your computer are failing too. Can you try the fixit from Microsoft below to see if that resolves your issue? If not, please post a new mb-check-results log after doing the steps so we can make sure we're still dealing with the same issue

https://support.microsoft.com/en-us/help/17613/automatically-diagnose-and-fix-problems-with-windows-firewall

Link to post
Share on other sites

Thanks @1PW and @dcollins for replying.

@dcollins I tried the fix, while it worked on a fresh boot. issues came back on subsequent reboots.

I have to manually start windows firewall service on every reboot.

 

@1PW I tried booting into safe mode and ran frst64 but no luck. It wouldn't launch at all.

But! upon rebooting normally. It ran! I have attached the results below.

 

also, FWIW, all these issues surface after the creators update..

much thanks for all the helps in advance!

FRST.txt

Addition.txt

Edited by terencet
Link to post
Share on other sites

The BFE service is the root cause here, so let's work on getting that fixed. Can you try the steps below please:

  1. Press Windows Key + R to bring up the run dialog
  2. In the dialog that comes up, type regedit and click Ok
    • Accept the UAC prompt if it shows up
  3. In Regedit, on the left side, double click the folders to navigate to the following path
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
  4. Right click on BFE on the left side and choose Export
  5. Save the key somewhere you can access it later
  6. Right click BFE on the left side again, and choose Delete then click Yes on the popup
    • If you get an error about this, try rebooting into Safe Mode and performing all of these steps. Then reboot back to normal mode before continuing
  7. Reboot your computer
  8. Run the fixit from Microsoft again: https://support.microsoft.com/en-us/help/17613/automatically-diagnose-and-fix-problems-with-windows-firewall
  9. Reboot your computer
  10. If you're still having issues at this point, please re-run mb-check so we can get a new log
Link to post
Share on other sites

OK, let's try manually starting that BFE service. Can you do the following please:

  1. Click the start menu
  2. Type cmd
  3. A black box titled cmd or Command Prompt should should show up at the top of your screen
  4. Right click the cmd command and choose Run as Administrator
  5. Click yes to accept the UAC prompt
  6. Once the window comes up, type the following command
    sc start bfe
  7. Take a screenshot of the results
Link to post
Share on other sites

@dcollins

good day to u.

alright attached are the screenshots.

I actually took two.

both are fresh reboots. the first one is after I manually restart the firewall and MWB's protection (restart the application)  from the taskbar.

and the second one is right after reboot. both red flags are present in the taskbar.

MetroTwit_2017-05-26_10-10-47.png

explorer_2017-05-26_10-13-57.png

Link to post
Share on other sites

Alright, can you try this please:

  1. Press Windows Key + R to bring up the run dialog
  2. In the window that comes up, type services.msc and click Ok
  3. In the new window, scroll down to find Base Filtering Engine and double click it
  4. If the Startup Type is not Automatic, please change it to Automatic
  5. Click Ok
  6. Reboot
Link to post
Share on other sites

28 minutes ago, dcollins said:

Alright, can you try this please:

  1. Press Windows Key + R to bring up the run dialog
  2. In the window that comes up, type services.msc and click Ok
  3. In the new window, scroll down to find Base Filtering Engine and double click it
  4. If the Startup Type is not Automatic, please change it to Automatic
  5. Click Ok
  6. Reboot

Both BFE and windows firewall services are already set at automatic.

but they do not run at boot. This BEF issue is infact affecting my IDM briwser integration too.

i too have tried repair install windows. No luck.

i wonder if it is the creators update that mess me up. It happened right after.

Link to post
Share on other sites

11 hours ago, dcollins said:

Alright, can you try this please:

  1. Press Windows Key + R to bring up the run dialog
  2. In the window that comes up, type services.msc and click Ok
  3. In the new window, scroll down to find Base Filtering Engine and double click it
  4. If the Startup Type is not Automatic, please change it to Automatic
  5. Click Ok
  6. Reboot

Hey @dcollins, thanks for your patience.

Here are the System and Application Logs. Thanks!!

Logs.zip

Link to post
Share on other sites

On 5/31/2017 at 11:19 AM, terencet said:

Bumping for @dcollins thanks!

 

17 hours ago, 108 said:

Good luck with that; Apparently they're on extended holiday here.

that is unfortunate.

can see that @dcollins is logging onto the forum from his last seen.

but seems he is missing out on this thread. Halfway .... and no other staffs can shed any insight?

Link to post
Share on other sites

Sorry about this, not sure how I missed the replies but I did.

According to your log,the BFE service is still missing. I've attached a zip file to this post. Please follow the instructions outlined below to try and solve this issue

  1. Download and unzip bfefix.zip
  2. Right click on bfefix.bat and choose Run as Administrator
  3. Click Yes on the UAC prompt that comes up
  4. A window will popup and then go away
  5. Reboot your computer
  6. Check if web Protection turns on
  7. If not, please upload the bfefix.txt file that should be created in the same location where you extracted the zip file

bfefix.zip

Link to post
Share on other sites

8 hours ago, dcollins said:

Sorry about this, not sure how I missed the replies but I did.

Spoiler

 

According to your log,the BFE service is still missing. I've attached a zip file to this post. Please follow the instructions outlined below to try and solve this issue

  1. Download and unzip bfefix.zip
  2. Right click on bfefix.bat and choose Run as Administrator
  3. Click Yes on the UAC prompt that comes up
  4. A window will popup and then go away
  5. Reboot your computer
  6. Check if web Protection turns on
  7. If not, please upload the bfefix.txt file that should be created in the same location where you extracted the zip file

bfefix.zip

 

 

@dcollins

no worries sir!

unfortunately, the fix did not manage to repair the issue.
the log is attached. showed everything successful tho.

I'm starting to pull my hairs out lol. BFE is set to automatic, but doesn't start on boot.
I have to manually start it.
NT SERVICE\BFE permission is granted to it too.

done multiple scans of MWB and Windows defender but nothing shows up.
more amusing is there seem to be no duplicate issues anywhere on the net.

bfefix.txt

Edited by terencet
edit content
Link to post
Share on other sites

10 minutes ago, dcollins said:

When you say that NT SERVICE\BFE permission is granted, can you explain what you mean? Maybe include a screenshot?

got this "solution" from the net. Something like this (https://goo.gl/jPeO3m)
refers to adding granting "NT SERVICE\BFE" permission to BFE's registry entry.
screenshot attached. have been removed.

I actually feel odd having the other 2 entries on the top.

 

This guys seem to be having the same issue with me.
but doesn't look like he has much luck too

https://answers.microsoft.com/en-us/windows/forum/windows_10-security/windows-10-bfe-base-filtering-engine-service-does/40e0bfc6-d6a1-4a40-876e-e4db7fd0b65d?tab=question&status=AllReplies#tabs

regedit_2017-06-03_14-21-03.png

Edited by terencet
append
Link to post
Share on other sites

Interesting. Using the files I provided earlier, it should have the proper permissions already baked in to prevent this from happening. Can you please find the RpcSs service in that same list where you took the BFE screenshot and take a screenshot of it's settings on the right pane and then also take a screenshot if it's permissions? BFE depends on this service, so I wonder if it's not starting properly

Link to post
Share on other sites

@dcollins

hey sir, I got tired and a little uneasy of the issue, firewall not starting with the system.
i went ahead and did a PC reset.. all is well now.

i think either somewhere in the system permissions were not granted correctly (screwed by MS's creator's update) or some malicious stuffs (not possible MWB not catching right?) took over it while booting.
because all the services started fine in safe mode.

Edited by terencet
Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.