Base Filtering Engine could not be started. System Error 5 has occured

When I try and start the BFE through command prompt, it comes up with this error:

*****
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>NET START BFE
The Base Filtering Engine service is starting.
The Base Filtering Engine service could not be started.

A system error has occurred.

System error 5 has occurred.

Access is denied.


C:\Windows\system32>
*****

How could I fix this? I am running Windows 7 64bit.

Please run the following commands, and post the results.
SC QC BFE
SC QUERYEX BFE

Sorry about the delay. Here are the results after doing what you said:

*****
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>SC QC BFE
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: BFE
TYPE : 20 WIN32_SHARE_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Windows\system32\svchost.exe -k LocalServiceNoNe
twork
LOAD_ORDER_GROUP : NetworkProvider
TAG : 0
DISPLAY_NAME : Base Filtering Engine
DEPENDENCIES : RpcSs
SERVICE_START_NAME : NT AUTHORITY\LocalService

C:\Windows\system32>SC QUERYEX BFE

SERVICE_NAME: BFE
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 5 (0x5)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Windows\system32>
*****

Open an Elevated Command Prompt, and run the following commands

sc sdshow plugplay
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18" /S
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19" /S
REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20" /S

Copy and paste the results to your reply

Sorry, I have disabled smileys in this post:

*****
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>sc sdshow plugplay

DA;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCR
RC;;;IU)(A;;CCLCSWLOCRRC;;;SU)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\ProfileList\S-1-5-18" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-18
Flags REG_DWORD 0xc
State REG_DWORD 0x0
RefCount REG_DWORD 0x1
Sid REG_BINARY 010100000000000512000000
ProfileImagePath REG_EXPAND_SZ %systemroot%\system32\config\systemprof
ile


C:\Windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\ProfileList\S-1-5-19" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-19
ProfileImagePath REG_EXPAND_SZ C:\Windows\ServiceProfiles\LocalService

Flags REG_DWORD 0x0
State REG_DWORD 0x0


C:\Windows\system32>REG QUERY "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\ProfileList\S-1-5-20" /S

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-
5-20
ProfileImagePath REG_EXPAND_SZ C:\Windows\ServiceProfiles\NetworkServi
ce
Flags REG_DWORD 0x0
State REG_DWORD 0x0


C:\Windows\system32>
*****

That all looks normal.

Please run these commands and post the results.


REG QUERY HKU
REG QUERY HKU\S-1-5-20

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>REG QUERY HKU

HKEY_USERS\.DEFAULT
HKEY_USERS\S-1-5-19
HKEY_USERS\S-1-5-20
HKEY_USERS\S-1-5-21-216155784-1160685422-2861209106-1000
HKEY_USERS\S-1-5-21-216155784-1160685422-2861209106-1000_Classes
HKEY_USERS\S-1-5-18

C:\Windows\system32>REG QUERY HKU\S-1-5-20

HKEY_USERS\S-1-5-20\AppEvents
HKEY_USERS\S-1-5-20\Console
HKEY_USERS\S-1-5-20\Control Panel
HKEY_USERS\S-1-5-20\Environment
HKEY_USERS\S-1-5-20\EUDC
HKEY_USERS\S-1-5-20\Keyboard Layout
HKEY_USERS\S-1-5-20\Network
HKEY_USERS\S-1-5-20\Printers
HKEY_USERS\S-1-5-20\Software
HKEY_USERS\S-1-5-20\System

C:\Windows\system32>

That looks normal as well
Please open Event Viewer
Navigate to the Windows Logs
right-click on the Application entry, and select Save All Events as.... (apps.evtx)
repeat for System (save as sys.evtx)

Compress both files, and attach to your reply - hopefully we'll see a clue there.

Here are the events you asked for

McAfee is failing to start properly - and this could be part of your problems.
I would suggest uninstalling it at least temporarily, and running the MCPR tool to clear out the dregs, then installing MSE and running a full system scan to see if it picks up anything.


Download the McAfee removal tool from:

http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Click Save, and save the file to a folder on your computer.
Navigate to the folder where you saved the file.
right-click on MCPR.exe and select 'Run as Administrator' to run the removal tool.

when complete, reboot.

After the reboot, open an Elevated Command Prompt, and run the following command

NETSH WINSOCK RESET

You'll be advised to reboot - do so.

then install MSE from here.... Microsoft Security Essentials - Microsoft Windows

I have Norton Internet Security installed at the moment. I uninstalled McAfee a few months ago as my subscription had run out. Should I still follow your last instructions and use Norton instead of Microsoft security essentials?

That would certainly help!

You may also need to uninstall Norton - but we'll see what effect getting rid of McAfee's dregs has first.

Registered just to thank you for your help, NoelDP. Fixed my issue, too. Thank you so much.

Just like the above poster, I have registered to say thanks! I have windows 10 on my new laptop and it came with a free McAfee anti-virus and after the trial expired, I uninstalled it to use a different one. That was a few months ago but just lately (maybe I just noticed) my firewall hasn't been working. I spent the better part of 3 days trying a huge number of fixes. All I had to do was run the McAfee un-installation tool and everything was fixed! Why was it so hard to find this????? I hope this saves someone else three days of looking.