SYSTEM_SERVICE_EXCEPTION (Wdfilter.sys)

This morning my computer started freezing 10mins after login. The kind of freeze where the desktop hangs and moving mouse does nothing and keyboard is unresponsive.

After the freeze it would auto reboot and then repeat this process, freezing again after 10mins.

I'm on Windows 10 Home Insider Preview, Build 17074.rs_prerelease_flt.180116-1539

At first I tried safe mode which seemed to have stopped the crashing, my pc was on for 40mins without issue.

I was going to try a clean boot, disabling non-microsoft services until the problem would stop but this caused the freezing to start on the login screen.

So I did a Windows reset and removed my user profile - the first time I did this still produced the issue, but the 2nd time I did it, I skipped the WiFi connection part of the setup and this stopped the freezing.

So, if I keep my WiFi off, there's no problems. But I tried connecting to my WiFi again and the problem started happening again after an initial 25mins or so.

But this time instead of freezing I get a green screen of death saying SYSTEM_SERVICE_EXCEPTION (WDFILTER.SYS)

I tried sfc /scannow and dism commands but both returned with no corrupt files.

I found a post saying wdfilter is related to Windows defender and suggested doing the following commands, but those didn't stop the freezing either.
Sd config wdfilter start= boot
Sd start wdfilter

I also managed to reproduce the green screen of death by manually attempting to update Windows defender's virus definitions.
When I click the button to update definitions, it loads for a bit but then goes to that green screen.

So I assume there's an issue with windows defender and every 10mins when my connection is available, Windows is trying to update virus definitions?

I tried disabling windows defender protection but it continues attempting to update if my connection is active.

Where should I go from here?

Purupuru said:

This morning my computer started freezing 10mins after login. The kind of freeze where the desktop hangs and moving mouse does nothing and keyboard is unresponsive.

After the freeze it would auto reboot and then repeat this process, freezing again after 10mins.

I'm on Windows 10 Home Insider Preview, Build 17074.rs_prerelease_flt.180116-1539

At first I tried safe mode which seemed to have stopped the crashing, my pc was on for 40mins without issue.

I was going to try a clean boot, disabling non-microsoft services until the problem would stop but this caused the freezing to start on the login screen.

So I did a Windows reset and removed my user profile - the first time I did this still produced the issue, but the 2nd time I did it, I skipped the WiFi connection part of the setup and this stopped the freezing.

So, if I keep my WiFi off, there's no problems. But I tried connecting to my WiFi again and the problem started happening again after an initial 25mins or so.

But this time instead of freezing I get a green screen of death saying SYSTEM_SERVICE_EXCEPTION (WDFILTER.SYS)

I tried sfc /scannow and dism commands but both returned with no corrupt files.

I found a post saying wdfilter is related to Windows defender and suggested doing the following commands, but those didn't stop the freezing either.
Sd config wdfilter start= boot
Sd start wdfilter

I also managed to reproduce the green screen of death by manually attempting to update Windows defender's virus definitions.
When I click the button to update definitions, it loads for a bit but then goes to that green screen.

So I assume there's an issue with windows defender and every 10mins when my connection is available, Windows is trying to update virus definitions?

I tried disabling windows defender protection but it continues attempting to update if my connection is active.

Where should I go from here?

I’m having the same issue. Also started this morning.

jlazerus said:

I’m having the same issue. Also started this morning.

I got a similar issue. I've tried everything and debugging everything from checking memory dump files. I got several B(/G)SODs, with STOPs like:

• IRQL_NOT_LESS_OR_EQUAL
• SYSTEM_SERVICE_EXCEPTION
• SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

The most prominent STOP was IRQL_NOT_LESS_OR_EQUAL. The first time my issue started occurring was while I was playing Grand Theft Auto V. I wasn't doing anything different than usual, and I hadn't installed applications in weeks. I do remember postponing Insider updates for another three days the night before, but knowing Microsoft they probably still downloaded some updates or something in the background, likely causing issues. The IRQL_NOT_LESS_OR_EQUAL refers to a broken driver. The computer collected info as usual and rebooted, although I could not get past the Windows start splash screen.

I am able to access Safe Mode but not normal mode, further confirming my suspicion of a driver issue. All BSOD's from that point onward were usually SYSTEM_SERVICE_EXCEPTION or IRQL_NOT_LESS_OR_EQUAL. I attempted using verifier.exe and found two drivers that were causing problems, one to do with VMware workstation and another to do with Malwarebytes. I uninstalled the two programs and manually removed the drivers from \windows\System32\drivers.

This fixed the SYSTEM_SERVICE_EXCEPTION stop code, but I then started getting IRQL_NOT_LESS_OR_EQUAL. This apparently correlates to a corrupt graphics driver, so I booted safe mode and used Display Driver Uninstaller and uninstalled the graphics drivers. I was able to reboot into normal mode, and I was actually able to get to my desktop for a couple seconds before getting an IRQL_NOT_LESS_OR_EQUAL stop code. My theory is that Windows is attempting to automatically install a corrupt graphics driver, as I believe most automatic driver updates are done after the user has logged in. After the first several IRQL_NOT_LESS_OR_EQUAL screens, it went back to having a SYSTEM_SERVICE_EXCEPTION, with WdFilter.sys being the culprit, according to both the details on the screen and the dump files.

I have no idea what to do, as I can't really do anything in normal mode and I can't access Windows Update settings from within the settings app in safe mode. And on top of that, I'm still Anyone who has any ideas: It'd be greatly appreciated.

Edit: OP mentioned using DISM, I'm running that now to see if that makes any difference.

Hi Purupuru , jlazerus , z609 ,
For all BSOD problems please open new threads and run the the beta log collector > post a zip into the thread:
log collector v2-beta08.zip
(extract > open)
In case there are any problems running the beta log collector see post #5 in this thread:
DM Log tool problem Solved - Windows 10 Forums

Did you try disabling your Internet connection when you get into normal mode?

I'm only getting SYSTEM_SERVICE_EXCEPTION (Wdfilter.sys) after 10mins if I'm connected to the Internet.

I'm not sure how to read the dump files but here are all of mine if anyone can help: Uploadfiles.io - minidumps.zip

Mine barely gets to the login screen before it crashes.

zbook said:

For all BSOD problems please open new threads and run the the beta log collector > post a zip into the thread:
log collector v2-beta08.zip
(extract > open)
In case there are any problems running the beta log collector see post #5 in this thread:
DM Log tool problem Solved - Windows 10 Forums

Thank you for your time, zbook
I've attached the output from that log collector

jlazerus said:

Mine barely gets to the login screen before it crashes.

Having the same issue, I really think it might be graphics related... although I haven't made any system modifications in weeks... in fact I barely use my computer at all--I probably should.

I posted a thread about my issue, if you want you can probably follow it. The issues are all related so I assume getting as much information as possible would be beneficial before resorting to a complete re-installation...

See BSOD posting instructions:
BSOD - Posting Instructions - Windows 10 Forums
On the bottom of the post please use the beta log collector for each thread.

Is it fine that I attached my logs to the post #7 here SYSTEM_SERVICE_EXCEPTION (Wdfilter.sys)

Or do you want me to make a new thread as well?

Some more info: It appears I can use the internet on my pc for longer if I disabled real-time protection. But windows defender says it will enable itself again later but not sure when.

I also added a registry key to disable it but not sure if that helps, though only want to keep it disabled until I can get this problem solved.

There does not appear to be any other source to the problem I'm having, the root of the problem seems to be the attempt to update virus definitions as that's the only thing that I think was causing bsod.