Issue

• If you receive the notification “installation ended prematurely” when upgrading to ESET Smart Security or ESET NOD32 Antivirus, see our Knowledgebase article for instructions
• Installation is not successful: “Rolling back action”
• Base Filtering Engine is missing

Details

Additional error messages that may be connected to this solution include the following:

• Users may receive “ESET Personal firewall initialization failed” message
• Users may receive “Services not started” message
• Users may receive “Virus scanner initialization failed” message

A malware or exploit that is removing the Base Filtering Engine service is executing a Windows command (sc delete bfe) which causes the Base Filtering Engine to disappear after a restart. This does not appear to be an issue isolated to Win32/Sirefef but to multiple Rogue Antivirus applications. This is similar to when a Rogue Antivirus executes the attrib command to hide all files.

Solution

1. Run the ESET uninstaller utility to remove partial installations
2. Remove any existing antivirus solutions
3. Run the ESET SirefefCleaner tool with the /r switch to restore the Base Filtering Engine

I. Run the ESET uninstaller utility to remove partial installations

We recommend that you run the ESET uninstaller utility in Safe Mode with Networking to remove any remnants of previously installed ESET programs or partial installations that might have failed before attempting to install your new ESET product. After removing any previous installations, attempt to install your new ESET product again.

II. Remove any existing antivirus solutions

For the successful installation of ESET products, it is important that no other antivirus products are installed on your computer. Typical uninstallation* using the Windows removal tool (Add/Remove Programs) is often insufficient. See our list of Uninstallers (removal tools) for common Windows antivirus software for assistance removing previously installed software. If you do not know whether there is an antivirus product installed on your system, we recommend that you use the ESET A/V Removal tool to scan your system for these types of programs

If your issue is not resolved, continue to section III below.

III. Run the ESET SirefefCleaner tool with the /r switch to restore the Base Filtering Engine

The ESET SirefefCleaner tool can restore the Base Filtering Engine when run using the /r switch. Follow the steps below even if you do not suspect that your system is infected:

1. Download the ESETSirefefCleaner tool

   Click Save at the prompt. Choose the destination folder where the tool will be downloaded. The tool may be also automatically saved to your Downloads folder.

2. Press the Windows key  + R to open a Run dialog.
3. Type C:Users\%username%DownloadsESETSirefefCleaner.exe /r (where C is your primary directory and %username% is your Windows username) and click OK.

Figure 3-1

4. Click Yes at the User Account Control prompt.
5. Click Agree to agree to the Sirefef Cleaner License Agreement.
6. The tool will scan your system and close automatically if no threats are present. If a threat is found, follow the on-screen prompts to clean your system. You may be prompted to restart your computer manually after the tool finishes running.
7. After restarting your computer, install your ESET product using the instructions from the appropriate Knowledgebase article below:
   • Download and Install ESET NOD32 Antivirus
   • Download and Install ESET Internet Security
   • Download and Install ESET Smart Security Premium