BSOD wdfilter.sys Registry Filter Driver Exception

I just got this BSOD after letting my pc idle for about an hour and a half. A couple minutes of use after i got back i noticed that i could move my mouse but i couldn't actually interact with anything until the BSOD happened. The music that was playing in the background sounded normal after it started having issues until the blue screen.

Unfortunately no logs were created as the BSOD was stuck at 0%.

I spent a bit of time googling around but could only come up with either an issue with windows defender somehow, or my gpu driver is corrupt. I'm wondering if anyone has any idea what this crash is supposed to mean.

Also for some reason i couldn't upload the V2 log collector zip in one file so i had to split it into three.

Windows 22H2 19045.2364

For share links please use one drive, drop box, or google drive.



Please perform the following tests / steps in sequence:


1) Post images or share links of disk management:
By default rows and columns are compressed and characters are cutoff.

a) Widen these rows: disk 0, disk 1, disk 2, disk 3, etc. > make sure that no characters are cutoff

b) Widen these columns: Volume and Status > make sure that no characters are cutoff

How to Post a Screenshot of Disk Management


2) Run HD Tune: (free or trial version) (test all drives)
Post images or share links into this thread for results on these tabs:
a) Health
b) Benchmark
c) Full error scan


3) Run Sea Tools for Windows (test all drives)
https://www.seagate.com/content/dam/...sInstaller.exe
https://www.seagate.com/support/seat...or_windows.pdf
Post images or share links for the Long generic test.


4) Open administrative command prompt and type or copy and paste:

chkdsk /b /v W:

Run on all drives using the syntax: chkdsk /b /v C: or chkdsk /b /v D: or chkdsk /b /v E: changing the drive letter W: to the applicable drive letter.

Running these chkdsk switches can take significant time.
Run the chkdsk switches on the Windows drive overnight while sleeping.


C:\WINDOWS\system32>chkdsk /b /v
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: Y

Reboot as needed.


5) These steps / tests can be performed overnight:
a) HD Tune full error scan
b) Sea Tools for Windows long generic test
c) Chkdsk /b /v


6) Find a flash drive that you can format (> or = 8 GB)


7) Create a bootable Windows 10 Media Creation Tool (MCT) (Windows 10 iso):

Create Bootable USB Flash Drive to Install Windows 10

Download Windows 10 ISO File

https://www.microsoft.com/en-us/soft...load/windows10


8) Run these scripts and post share links into this thread:

a) https://www.tenforums.com/attachment...p_plus_log.bat

b) https://www.tenforums.com/attachment...iskparinfo.bat

c) https://www.tenforums.com/attachment...kfromevent.bat


9) Create a new restore point:
Create System Restore Point in Windows 10


10) Upgrade the BIOS to the most up to date non-beta BIOS:

BIOS: Version/Date American Megatrends Inc. 1.80, 7/26/2016

1.8 > 7980v1C

https://us.msi.com/Motherboard/Z170I...PRO-AC/support

Code:

Event[8206]:
  Log Name: System
  Source: Ntfs
  Date: 2022-12-16T20:13:07.4810000Z
  Event ID: 55
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: LeSlimePC
  Description: 
A corruption was discovered in the file system structure on volume F:.

The Master File Table (MFT) contains a corrupted file record.  The file reference number is 0xa00000000000a.  The name of the file is "<unable to determine file name>".

Code:

Event[9895]:
  Log Name: System
  Source: disk
  Date: 2022-12-27T02:02:19.7870000Z
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LeSlimePC
  Description: 
The device, \Device\Harddisk3\DR7, has a bad block.

Code:

Event[8462]:
  Log Name: System
  Source: disk
  Date: 2022-12-16T21:36:49.4980000Z
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LeSlimePC
  Description: 
The device, \Device\Harddisk1\DR1, has a bad block.

Code:

Event[2694]:
  Log Name: System
  Source: Ntfs
  Date: 2022-12-11T22:09:54.4920000Z
  Event ID: 55
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: LeSlimePC
  Description: 
A corruption was discovered in the file system structure on volume C:.

A corruption was found in a file system index structure.  The file reference number is 0x200000019e807.  The name of the file is "\Users\Leon\Downloads\MoreCleaning\Twistedworld-0.6-pc\game\images\character_events_scarlett\event_number_3".  The corrupted index attribute is ":$I30:$INDEX_ROOT".  The corrupted index block is located at Vcn 0xffffffffffffffff, Lcn 0xffffffffffffffff.  The corruption begins at offset 184 within the index block.

Code:

------------------------
Disk & DVD/CD-ROM Drives
------------------------
      Drive: C:
 Free Space: 609.1 GB
Total Space: 953.0 GB
File System: NTFS
      Model: CT1000MX500SSD1

      Drive: D:
 Free Space: 126.9 GB
Total Space: 2861.5 GB
File System: NTFS
      Model: TOSHIBA DT01ACA300

      Drive: E:
 Free Space: 18.1 GB
Total Space: 238.5 GB
File System: NTFS
      Model: Samsung SSD 840 Series

zbook said:

For share links please use one drive, drop box, or google drive.



Please perform the following tests / steps in sequence:


1) Post images or share links of disk management:
By default rows and columns are compressed and characters are cutoff.

a) Widen these rows: disk 0, disk 1, disk 2, disk 3, etc. > make sure that no characters are cutoff

b) Widen these columns: Volume and Status > make sure that no characters are cutoff

How to Post a Screenshot of Disk Management


2) Run HD Tune: (free or trial version) (test all drives)
Post images or share links into this thread for results on these tabs:
a) Health
b) Benchmark
c) Full error scan


3) Run Sea Tools for Windows (test all drives)
https://www.seagate.com/content/dam/...sInstaller.exe
https://www.seagate.com/support/seat...or_windows.pdf
Post images or share links for the Long generic test.


4) Open administrative command prompt and type or copy and paste:

chkdsk /b /v W:

Run on all drives using the syntax: chkdsk /b /v C: or chkdsk /b /v D: or chkdsk /b /v E: changing the drive letter W: to the applicable drive letter.

Running these chkdsk switches can take significant time.
Run the chkdsk switches on the Windows drive overnight while sleeping.


C:\WINDOWS\system32>chkdsk /b /v
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: Y

Reboot as needed.


5) These steps / tests can be performed overnight:
a) HD Tune full error scan
b) Sea Tools for Windows long generic test
c) Chkdsk /b /v


6) Find a flash drive that you can format (> or = 8 GB)


7) Create a bootable Windows 10 Media Creation Tool (MCT) (Windows 10 iso):

Create Bootable USB Flash Drive to Install Windows 10

Download Windows 10 ISO File

https://www.microsoft.com/en-us/soft...load/windows10


8) Run these scripts and post share links into this thread:

a) https://www.tenforums.com/attachment...p_plus_log.bat

b) https://www.tenforums.com/attachment...iskparinfo.bat

c) https://www.tenforums.com/attachment...kfromevent.bat


9) Create a new restore point:
Create System Restore Point in Windows 10


10) Upgrade the BIOS to the most up to date non-beta BIOS:

BIOS: Version/Date American Megatrends Inc. 1.80, 7/26/2016

1.8 > 7980v1C

https://us.msi.com/Motherboard/Z170I...PRO-AC/support

Code:

Event[8206]:
  Log Name: System
  Source: Ntfs
  Date: 2022-12-16T20:13:07.4810000Z
  Event ID: 55
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: LeSlimePC
  Description: 
A corruption was discovered in the file system structure on volume F:.

The Master File Table (MFT) contains a corrupted file record.  The file reference number is 0xa00000000000a.  The name of the file is "<unable to determine file name>".

Code:

Event[9895]:
  Log Name: System
  Source: disk
  Date: 2022-12-27T02:02:19.7870000Z
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LeSlimePC
  Description: 
The device, \Device\Harddisk3\DR7, has a bad block.

Code:

Event[8462]:
  Log Name: System
  Source: disk
  Date: 2022-12-16T21:36:49.4980000Z
  Event ID: 7
  Task: N/A
  Level: Error
  Opcode: N/A
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: LeSlimePC
  Description: 
The device, \Device\Harddisk1\DR1, has a bad block.

Code:

Event[2694]:
  Log Name: System
  Source: Ntfs
  Date: 2022-12-11T22:09:54.4920000Z
  Event ID: 55
  Task: N/A
  Level: Error
  Opcode: Info
  Keyword: N/A
  User: S-1-5-18
  User Name: NT AUTHORITY\SYSTEM
  Computer: LeSlimePC
  Description: 
A corruption was discovered in the file system structure on volume C:.

A corruption was found in a file system index structure.  The file reference number is 0x200000019e807.  The name of the file is "\Users\Leon\Downloads\MoreCleaning\Twistedworld-0.6-pc\game\images\character_events_scarlett\event_number_3".  The corrupted index attribute is ":$I30:$INDEX_ROOT".  The corrupted index block is located at Vcn 0xffffffffffffffff, Lcn 0xffffffffffffffff.  The corruption begins at offset 184 within the index block.

Code:

------------------------
Disk & DVD/CD-ROM Drives
------------------------
      Drive: C:
 Free Space: 609.1 GB
Total Space: 953.0 GB
File System: NTFS
      Model: CT1000MX500SSD1

      Drive: D:
 Free Space: 126.9 GB
Total Space: 2861.5 GB
File System: NTFS
      Model: TOSHIBA DT01ACA300

      Drive: E:
 Free Space: 18.1 GB
Total Space: 238.5 GB
File System: NTFS
      Model: Samsung SSD 840 Series

It's possible for an issue on a secondary drive to cause this BSOD?

Yes, any attached hardware can cause BSOD.

Some of the BSOD bugchecks were WHEA 124.

These bugchecks are most commonly seen with malfunctioning hardware.

zbook said:

Yes, any attached hardware can cause BSOD.

Some of the BSOD bugchecks were WHEA 124.

These bugchecks are most commonly seen with malfunctioning hardware.

I'm not sure how relevant it is but some of the error history is due to having cloned a drive onto another one that turned out to have bad blocks that didn't show on SMART, I think that might have been around late November. I then took that drive and imaged it onto the Crucial I'm currently using, which was around the 16th? of December. It ended up having at least a couple corrupt files that got fixed by chkdsk so in retrospect that may have been a bad idea.

I think the WHEA-Logger events in the event manager were all when i was still using the old drive, the recent entry on the 26th being when i had it connected via usb to format.

Running the above tests / steps should provide useful information.

There is no working recovery partition.

There are no restore points.


C: drive:

Code:

12 KB in bad sectors

The steps in post #2 should provide diagnostic results.
Then new steps will be posted.

zbook said:

Running the above tests / steps should provide useful information.

There is no working recovery partition.

There are no restore points.


C: drive:

Code:

12 KB in bad sectors

The steps in post #2 should provide diagnostic results.
Then new steps will be posted.

I'll probably see if i get another crash, and then hope that i can get a log that'll help.

I somewhat recall the 12 kb in bad sectors thing was with my previous ssd that ended up having to be replaced.

As far as restore points goes, i've been just imaging my system drive with macrium as a backup.

Otherwise i've only run the diagnostic tests on my system drive. It passed the seatools long generic test, no damaged blocks detected with a full error scan.
I've also DDU'd and installed the latest Nvidia Driver if somehow that's the cause due to a corrupted gpu driver that a couple people over on reddit have commented about, and updated my system SSD's firmware due to "bug causes the drive to disappear from Windows and logs a disk error in Windows event, rebooting is required to make the drive appear again".

I've been doing a lot of googling but it seems like the exact issue i had does not seem common whatsoever.

The image of CT1000MX500SSD1 displayed a scroll bar on the right.
Please post an image displaying the missing Health results.

HD Tune full error scan and Sea Tools for Windows long generic tests can run simultaneously.
Please post images or share links for all drive test results.

zbook said:

The image of CT1000MX500SSD1 displayed a scroll bar on the right.
Please post an image displaying the missing Health results.

HD Tune full error scan and Sea Tools for Windows long generic tests can run simultaneously.
Please post images or share links for all drive test results.

I think this should be the same information as hdtune.

I also found "If you own a Crucial MX500 drive (mine is CT4000MX500SSD1) you SHOULD disable TRIM until the firmware is fixed (M3CR045 is defective). Otherwise drive hangs randomly... (on Windows use fsutil). Done extensive testing on this. Take care "

I happened to be running M3CR045 when i got the bsod. I've updated to M3CR046 since then, but do you think this may be related to how i crashed? It sounds like from what i'm being asked to post drive issues are suspected so maybe this has something to do with it.

So far i haven't crashed again so still no logs.

What date was Crystal Disk from?
Crystal Disk displayed F: drive.
F: drive was absent when the V2 log collector ran.
And F: drive was absent when disk management ran.

Make sure that HD Tune and Sea Tools results are posted for F: too.