New
#1
WdFilter.sys - BSOD - SYSTEM_SERVICE_EXCEPTION
Originally posted as #3 here.
My first issue was an IRQL_NOT_LESS_OR_EQUAL while I was playing Grand Theft Auto V. I wasn't doing anything different than usual, and I hadn't installed applications in weeks. I do remember postponing Insider updates for another three days the night before, but knowing Microsoft they probably still downloaded some updates or something in the background, likely causing issues. I've tried everything and debugging everything from checking memory dump files. I got several B(/G)SODs, with STOPs like:
- IRQL_NOT_LESS_OR_EQUAL
- SYSTEM_SERVICE_EXCEPTION
- SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
The IRQL_NOT_LESS_OR_EQUAL STOP code refers to a broken driver. The computer collected info as usual and rebooted, although I could not get past the Windows start splash screen.
I am able to access Safe Mode but not normal mode, further confirming my suspicion of a driver issue. All BSOD's from that point onward were usually SYSTEM_SERVICE_EXCEPTION or IRQL_NOT_LESS_OR_EQUAL. I attempted using verifier.exe and found two drivers that were causing problems, one to do with VMware workstation and another to do with Malwarebytes. I uninstalled the two programs and manually removed the drivers from \windows\System32\drivers.
This fixed the SYSTEM_SERVICE_EXCEPTION stop code, but I then started getting IRQL_NOT_LESS_OR_EQUAL errors. Many issues with this STOP code are the result of a corrupt graphics driver, so I booted safe mode and used Display Driver Uninstaller and uninstalled the graphics drivers. I was able to reboot into normal mode, and I was actually able to get to my desktop for a couple seconds before getting an IRQL_NOT_LESS_OR_EQUAL stop code. My theory is that Windows is attempting to automatically install a corrupt graphics driver, as I believe most automatic driver updates are done after the user has logged in. After the first several IRQL_NOT_LESS_OR_EQUAL screens, it went back to having a SYSTEM_SERVICE_EXCEPTION, with WdFilter.sys being the culprit, according to both the details on the screen and the dump files. Apparently this has something to do with Windows Defender; I have tried viewing its settings from the Settings app so that I could turn it off or update it (like some Microsoft forum posts state), but the settings screen is actually blank and doesn't appear to be usable in safe mode.
I have tried CHKDSK, "sfc /scannow", and most recently DISM, but nothing helped--"sfc /scannow" reported no errors.
I have attached the log collector results. I will let you know that I have uninstalled my graphics drivers and the collection process was done in safe mode as I can't boot normally. However, even if I could I don't understand how the graphics drivers could possibly be the issue... I have been trying to fight with this since 9:30 this morning (it's now 10 PM). Any help would be greatly appreciated.