I receive the message that my ESET installation ended prematurely

KB Solution ID: SOLN2861|Last Revised: January 07, 2015


  • If you receive the notification "installation ended prematurely" when upgradeing to ESET Smart Security or ESET NOD32 Antivirus 8, see our Knowledgebase article for instructions.
  • Installation is not successful: "Rolling back action"
  • Base Filtering Engine is missing

Users may receive one of the following messages:

  • "ESET Personal firewall initialization failed"
  • "Services not started"
  • "Virus scanner initialization failed"
  • "The computer has not been restarted after a program uninstallation. Please restart the computer and run the installer again."
  • "An error occurred while starting services. Analysis of application protocols (POP3, HTTP) will not function"

Verify that Windows Data Execution Prevention (DEP) is not blocking installation

If you are receiving "ESET Smart Security installation was ended prematurely" immediately when attempting to run the ESET installer file from your Downloads folder, see our related article before attempting the steps below.


A malware or exploit that is removing the Base Filtering Engine service is executing a Windows command (sc delete bfe) which causes the Base Filtering Engine to disappear after a restart. This does not appear to be an issue isolated to Win32/Sirefef but to multiple Rogue Antivirus applications. This is similar to when a Rogue Antivirus executes the attrib command to hide all files.


I. Check to see if the Base Filtering Engine service is missing

  1. Click Start, type services.msc into the search field and then click services

Figure 1-1 

  1. Look for the Base Filtering Engine entry in the "Name" field, which is sorted alphabetically. 

Figure 1-2
Click the image to view larger in new window

  1. If the Base Filtering Engine entry is present, please provide an installation error log to Customer Care to help resolve your issue. If the Base Filtering Engine entry is missing, continue to part II below. 


II. Run the ESET SirefefCleaner tool with the /r switch to restore the Base Filtering Engine

The ESET SirefefCleaner tool can restore the Base Filtering Engine when run using the /r switch. Follow the steps below even if you do not suspect that your system is infected:

  1. Download the ESETSirefefCleaner tool

    Click Save at the prompt. Choose the destination folder where the tool will be downloaded. The tool may be also automatically saved to your Downloads folder.
  2. Press the Windows key  + R to open a Run dialog.
  3. Type C:\Users\%username%\Downloads\ESETSirefefCleaner.exe /r (where C is your primary directory and %username% is your Windows username) and click OK.

Figure 2-1

  1. Click Yes at the User Account Control prompt.
  2. Click Agree to agree to the Sirefef Cleaner License Agreement.
  3. The tool will scan your system and close automatically if no threats are present. If a threat is found, follow the on-screen prompts to clean your system. You may be prompted to restart your computer manually after the tool finishes running.
  4. After restarting your computer, install your ESET product using the instructions from the appropriate Knowledgebase article below:


Rate this article:
1 2 3 4 5
Please comment on your rating...
We cannot respond to feedback from this form. Requests for assistance should be submitted through your normal support channel.
5 - Definitely
4 - Mostly
3 - Somewhat
2 - Not Really
1 - Not At All