UPDATE:
As of BPS Pro 9.6 the Pro-Tools Base64 Decoder / Encoder tools were moved to their own individual pages and can be deleted individually from Pro-Tools. See this Forum link for full details: http://forum.ait-pro.com/forums/topic/scanner-detects-malicious-code-or-infected-files-in-bps-pro-pro-tools/
Scanners do not have the capability to actually tell the difference between good code and bad/malicious code with 100% accuracy. Scanners look for coding patterns or php code functions that are used in hacking scripts. Scanners can help to generally find possible code that could or might be bad, but a scanner just does not and can never be configured to have the capability to actually really tell you 100% if code is good or bad. 😉
BulletProof Security Pro has a Base64 Decoding Tool in the Pro-Tools component of BPS Pro. That Base64 decoding tool has standard legitimate php functions that are used to decode Base64 code/hackers code. The Wordfence scanner is seeing those legitmate php functions in the tools.php file, but cannot really tell whether or not this is actually good or bad/malicious code and can only generally see that the code might be possibly bad/malicious.
To solve this issue just tell Wordfence to always ignore this file.
.
