Endpoint Protection

Why??? What is this?

It killed a PC before, I had to have someone remove it...then it came back, after running CW and clearing temp files, tried to re install, but still this wonderful message about Base filtering service comes up.

Windows 7 64 BIT

CCA: Machine ID: da571191ba172547abf5577c6ee144665ab134
IDCCA: HttpQueryInfo: 200 OK Error: 0
IDCCA: SETI::CUploadFile::logout200 OK
MSI (s) (78:54) [19:14:22:454]: Doing action: LaunchConditions
Action ended 19:14:22: preLaunchCond. Return value 1.
Action start 19:14:22: LaunchConditions.
MSI (s) (78:54) [19:14:22:455]: Product: Symantec Endpoint Protection -- 2The Base Filtering Engine (BFE) service is not running. Please ensure it is enabled before installing Symantec Endpoint Protection.

2The Base Filtering Engine (BFE) service is not running. Please ensure it is enabled before installing Symantec Endpoint Protection.
Action ended 19:14:22: LaunchConditions. Return value 3.
Action ended 19:14:22: INSTALL. Return value 3.
Property(S): UpgradeCode = {F7BE9C8A-C2E6-470D-B703-0A1845E6FF8C}
Property(S): OS_SUPPORTS_UI = C:\Windows\explorer.exe
Property(S): IE6FOUND = C:\Windows\SysWOW64\shdocvw.dll
Property(S): SPMXMLFOUND = C:\Windows\Temp\Symantec\SyLink.xml
Property(S): SERDEFDATFOUND = C:\Windows\Temp\Symantec\serdef.dat
Property(S): SYMRASMAN_REG13_PATH = C:\Windows\System32\rastls.dll
Property(S): SYMRASMAN_REG13_INTERACTIVEUIPATH = C:\Windows\System32\rastls.dll
Property(S): SYMRASMAN_REG13_CONFIGUIPATH = C:\Windows\System32\rastls.dll
Property(S): SYMRASMAN_REG13_IDENTITYPATH = C:\Windows\System32\rastls.dll
Property(S): SYMRASMAN_REG25_PATH = C:\Windows\System32\rastls.dll
Property(S): SYMRASMAN_REG25_INTERACTIVEUIPATH = C:\Windows\System32\rastls.dll
Property(S): SYMRASMAN_REG25_CONFIGUIPATH = C:\Windows\System32\rastls.dll
Property(S): SYMRASMAN_REG25_IDENTITYPATH = C:\Windows\System32\rastls.dll
Property(S): DEFENDERFOUND = Microsoft Windows Defender
Property(S): OUTLOOKFOUND = C:\Program Files (x86)\Microsoft Office\Office12\
Property(S): SDIDATFOUND = C:\Windows\Temp\Symantec\sdi.dat
Property(S): FOUNDSEPSLF = C:\Windows\Temp\Symantec\sep.slf
Property(S): VC8B762CHECK = C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2\
Property(S): ProductName = Symantec Endpoint Protection
Property(S): ProductDisplayName = Symantec Endpoint Protection
Property(S): ProductVersion = 12.1.2015.2015
Property(S): OPTOUTREPSUBMISSION = 0

Hmmm, found this:

Symantec Endpoint Protection does not detect network applications if Base Filtering Engine service is stopped

https://www-secure.symantec.com/connect/forums/sep-12-installation

http://www.howtogeek.com/wiki/Base_Filtering_Engine

The PC does not even HAVE this service.

Base Filtering Engine (BFE) manages firewall and IPsec (Internet Protocol Security) policies and mode filtering. This service is essential in Vista (OH, COME ONNN!!!) network security. If you are on a network do not disable this service.

This is W7 PC and the BFE service is NOT even listed in the services

I'm glad I don't manage SEP in your environment I would rather be on Triumph, you really run into some crazy issues, most of which I've not seen

It's been since the latest version of 12. It is becomming so time consuming and wasting a valuable resource (Me) :-)

Ran Cleanwipe too, still no go

There were some known viruses able to bring that service down on Windows 7 - this service should definitely be there- have a look at the notes here:

http://blog.crosbydrive.com/?p=265

According to microsoft Technet :

http://social.technet.microsoft.com/Forums/en-US/w7itpronetworking/thread/530e05dc-c97c-405e-b961-6bdf613ca443

there are some workarounds to bring it back:

- try sfc /scannow or :

Method 1

Use sc .exe to create the Windows Service. Sc.exe uses the following syntax:

Syntax1 (use Syntax1 to run Sc.exe)

sc [Servername] Command Servicename [Optionname= Optionvalue...]

Syntax2 (use Syntax2 to display help information, except for the query command)

sc [Command]

Please refer http://support.microsoft.com/kb/251192

Method 2

Also you may backup the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE from another computer of same operating system .Then copy to your computer and restore the Registry.

The whole point of SEP is for it to DELETE or contain these viruses so we don't run into problems like this, I have had to run Malwarebytes so frequently, that I am not even sure that SEP is doing its job as it should. I tried to fix the BFE service file and it has crashed the PC. This is unbelievable.