WdFilter.sys - BSOD - SYSTEM_SERVICE_EXCEPTION


  1. Posts : 8
    Windows 10 Pro Build 17074.rs_prerelease_flt.180116-1539
       #1

    WdFilter.sys - BSOD - SYSTEM_SERVICE_EXCEPTION


    Originally posted as #3 here.

    My first issue was an IRQL_NOT_LESS_OR_EQUAL while I was playing Grand Theft Auto V. I wasn't doing anything different than usual, and I hadn't installed applications in weeks. I do remember postponing Insider updates for another three days the night before, but knowing Microsoft they probably still downloaded some updates or something in the background, likely causing issues. I've tried everything and debugging everything from checking memory dump files. I got several B(/G)SODs, with STOPs like:

    • IRQL_NOT_LESS_OR_EQUAL
    • SYSTEM_SERVICE_EXCEPTION
    • SYSTEM_THREAD_EXCEPTION_NOT_HANDLED


    The IRQL_NOT_LESS_OR_EQUAL STOP code refers to a broken driver. The computer collected info as usual and rebooted, although I could not get past the Windows start splash screen.

    I am able to access Safe Mode but not normal mode, further confirming my suspicion of a driver issue. All BSOD's from that point onward were usually SYSTEM_SERVICE_EXCEPTION or IRQL_NOT_LESS_OR_EQUAL. I attempted using verifier.exe and found two drivers that were causing problems, one to do with VMware workstation and another to do with Malwarebytes. I uninstalled the two programs and manually removed the drivers from \windows\System32\drivers.

    This fixed the SYSTEM_SERVICE_EXCEPTION stop code, but I then started getting IRQL_NOT_LESS_OR_EQUAL errors. Many issues with this STOP code are the result of a corrupt graphics driver, so I booted safe mode and used Display Driver Uninstaller and uninstalled the graphics drivers. I was able to reboot into normal mode, and I was actually able to get to my desktop for a couple seconds before getting an IRQL_NOT_LESS_OR_EQUAL stop code. My theory is that Windows is attempting to automatically install a corrupt graphics driver, as I believe most automatic driver updates are done after the user has logged in. After the first several IRQL_NOT_LESS_OR_EQUAL screens, it went back to having a SYSTEM_SERVICE_EXCEPTION, with WdFilter.sys being the culprit, according to both the details on the screen and the dump files. Apparently this has something to do with Windows Defender; I have tried viewing its settings from the Settings app so that I could turn it off or update it (like some Microsoft forum posts state), but the settings screen is actually blank and doesn't appear to be usable in safe mode.

    I have tried CHKDSK, "sfc /scannow", and most recently DISM, but nothing helped--"sfc /scannow" reported no errors.

    I have attached the log collector results. I will let you know that I have uninstalled my graphics drivers and the collection process was done in safe mode as I can't boot normally. However, even if I could I don't understand how the graphics drivers could possibly be the issue... I have been trying to fight with this since 9:30 this morning (it's now 10 PM). Any help would be greatly appreciated.
      My Computer


  2. Posts : 5,169
    64bit Win 10 Pro ver 21H2
       #2

    As this is an insider build there are too many unknowns about drivers and compatibility. If you want a stable system it is best to avoid the insider builds or only experiment with them on a system which is not your main PC.
      My Computers


  3. Posts : 8
    Windows 10 Pro Build 17074.rs_prerelease_flt.180116-1539
    Thread Starter
       #3

    philc43 said:
    As this is an insider build there are too many unknowns about drivers and compatibility. If you want a stable system it is best to avoid the insider builds or only experiment with them on a system which is not your main PC.
    Yes, I was thinking about that. Attempting to perform a system restore to a restore point from (conveniently) the night before left me with an unknown error. Attempting to restore my version of Windows to a previous version via the advanced startup options stated that it couldn't be completed and that I need to reset my PC or something along those lines.

    The problem is that I don't believe that I was doing anything to trigger this. I know Microsoft likes to download/install stuff in the background (as per the Windows 7->10 upgrade back then, which is cited here) usually without knowledge of its users. WdFilter.sys has something to do with the Windows Defender antimalware file filter, or something along those lines--perhaps my computer is infected with something Windows Defender doesn't know how to handle...but Malwarebytes returned no issues with my system when I ran a scan before I uninstalled it. Even then it doesn't explain the IRQL_NOT_LESS_OR_EQUAL stop codes I've been getting either.

    This is such a strange issue, and of course it has to happen the one time I actually want to use my computer lol.
      My Computer


  4. Posts : 5,169
    64bit Win 10 Pro ver 21H2
       #4

    If you are unable to boot normally you might need to use rescue media and boot from that. Then you can save all data and other files before attempting further repairs or even trying a clean install.

    This is a very good rescue media option: Windows 10 Recovery Tools - Bootable Rescue Disk
      My Computers


  5. Posts : 5,169
    64bit Win 10 Pro ver 21H2
       #5

    Also make sure you have turned Driver Verifier OFF.
      My Computers


  6. Posts : 2
    W10 build 17074
       #6

    windows defender


    1167/5000





    I confirm the culprit is windows defender

    Historical
    1: Tuesday night infinite loop green screen blue screen restart restart restart
    Repair:
    Unusable boot, recovery f11 does not work
    Creating a recovery usb key
    Repair failure
    Restore failure
    reinstalling w10 from recovery with data user: failure missing desktop file
    reinstallation w10 origin ok, data user backup restored, applications installed
    taking an image system, backup
    2: this morning KMOD exception not handle reboot multiple times
    Between 5 and 10 minutes after login to each launch of the windows defender green screen updates
    Then after 5 to 6 times immediately after login green screen
    Restore on last version of last night
    Startup without wifi link, the system is stable, no WD update
    Offline installation of another antivirus (Mcafee), which disables Windows defender
    Restart and open wifi update antivirus Mcfee, scan ok
    Without active Windows defender pending windows updates run
    For more than kmod exception
    I'm loading the 1803 backup version and then re-testing WD
    Georges from Paris with google aid translation....
      My Computer


  7. Posts : 8
    Windows 10 Pro Build 17074.rs_prerelease_flt.180116-1539
    Thread Starter
       #7

    Georges P said:
    1167/5000





    I confirm the culprit is windows defender

    Historical
    1: Tuesday night infinite loop green screen blue screen restart restart restart
    Repair:
    Unusable boot, recovery f11 does not work
    Creating a recovery usb key
    Repair failure
    Restore failure
    reinstalling w10 from recovery with data user: failure missing desktop file
    reinstallation w10 origin ok, data user backup restored, applications installed
    taking an image system, backup
    2: this morning KMOD exception not handle reboot multiple times
    Between 5 and 10 minutes after login to each launch of the windows defender green screen updates
    Then after 5 to 6 times immediately after login green screen
    Restore on last version of last night
    Startup without wifi link, the system is stable, no WD update
    Offline installation of another antivirus (Mcafee), which disables Windows defender
    Restart and open wifi update antivirus Mcfee, scan ok
    Without active Windows defender pending windows updates run
    For more than kmod exception
    I'm loading the 1803 backup version and then re-testing WD
    Georges from Paris with google aid translation....
    Thank you for sharing your issue with it...I might've come up with a breakthrough. I was able to disable Windows Defender in safemode using this article as I couldn't turn it off through the Settings app...I feel stupid for not trying to disable it sooner...and lo and behold I'm able to boot up normally now. I'm currently running updates for my drivers. In the Imgur link at the bottom of this post you can see that there was a Defender update that was installed on the day my issue started occurring (4 April, 2018). That could very likely have been the cause.

    Other screenshots include pictures of Windows Updates running and Windows Defender being turned off.

    Big thank you to those who gave advice. It is much appreciated.

    Screenshots: Imgur: The magic of the Internet

    I have also set it to turn off Insider updates after the next major release.
      My Computer


  8. Posts : 2
    W10 build 17074
       #8

    I installed the 1803 fast ring release
    Loaded some 30 updates including some for the WD platform
    WD viruses are up to date
    return to normal operation after many hours of work......
      My Computer


  9. Posts : 8
    Windows 10 Pro Build 17074.rs_prerelease_flt.180116-1539
    Thread Starter
       #9

    Georges P said:
    I installed the 1803 fast ring release
    Loaded some 30 updates including some for the WD platform
    WD viruses are up to date
    return to normal operation after many hours of work......
    Got that update last night, I'm a bit hesitant to re-enable it haha...
    I'm assuming that they released an update to Windows Defender that only worked with newer builds of Windows 10, that would crash older builds.

    Anyway, the problem is marked solved. Thanks y'all.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 11:11.
Find Us




Windows 10 Forums