File System Filter 'wcifs' EVENT ID 4

Eagle51 said:

SoFine409 ... probably, but I ain't going down that road again. Nope, not an IT Pro.

Note: Probably not a valid test.

I found a 'wcifs.md' file dated 2/20/2017 (1k), with what appears to be one ascii character/symbol in it [] . I think this is the original file, when I first noticed my restore issue, but can't be sure.

Put it in 'c:\system volume information'
Created a restore point and got the event id 4 filter manager warning.
Rebooted and got the event id 4 filter manager warning.

File System Filter 'wcifs' (Version 10.0, ‎2016‎-‎09‎-‎15T11:42:03.000000000Z) failed to attach to volume '\Device\HarddiskVolumeShadowCopy4'. The filter returned a non-standard final status of 0xC000000D. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor.

Then did a system restore on the restore point I just created and it completely successfully. That 'wcifys.md' file didn't get deleted or changed and fltmc instances shows wcifs is attached to c: Not sure this really sheds any light on the issue ... lol

So the the wcifys.md file serves as a marker for the message displayed on boot but the contents of the WindowsApps folder determines the success of the restore. The bad update of the Get Office app poisoned the WibdowsApp folder and until that is removed the restore will never be successful. Right? So by that logic then the contents of the wcifys.md file should be cleared by either renaming the WindowsApp folder or deleting the offending subfolder(s). Correct? But that doesn't happen, right? So maybe sonething else is in play?

SoFine409 ... I'm not really sure how all this ties together and I'm guessing there is something else in play that I/we don't know about.

wcifs.md -Does appear to be some kind of marker, but if/how wcifs interacts windows apps, I don't know. From what I've seen just renaming 'WindowsApps' folder and/or deleting (in this case) the 'Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe' folder does NOT change wcifs.md file.

Get Office App - The update sure seems to have messed something up in regards to system restore. That's just the only app/folder I found on my system that fixed the restore issue. You would assume a M$ fix for the app would fix whatever the real issue is. Since it doesn't appear to affect every single user, your guess is as good as mine on if/when that might be. As far as just deleting the 'Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe' folder .. that was just me being aggressive in my trouble shooting. It's possible leaving the app / folder alone and removing the DOMAIN\USER with the Exits Win://SYSAPPID would have achieved the same results. It could have also been another account permission issue that is causing the issue.

Trouble shooting these issues really should be done on a clean install and by someone more knowledgeable than me :)

Eagle51 said:

SoFine409 ... I'm not really sure how all this ties together and I'm guessing there is something else in play that I/we don't know about.

wcifs.md -Does appear to be some kind of marker, but if/how wcifs interacts windows apps, I don't know. From what I've seen just renaming 'WindowsApps' folder and/or deleting (in this case) the 'Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe' folder does NOT change wcifs.md file.

Get Office App - The update sure seems to have messed something up in regards to system restore. That's just the only app/folder I found on my system that fixed the restore issue. You would assume a M$ fix for the app would fix whatever the real issue is. Since it doesn't appear to affect every single user, your guess is as good as mine on if/when that might be. As far as just deleting the 'Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe' folder .. that was just me being aggressive in my trouble shooting. It's possible leaving the app / folder alone and removing the DOMAIN\USER with the Exits Win://SYSAPPID would have achieved the same results. It could have also been another account permission issue that is causing the issue.

Trouble shooting these issues really should be done on a clean install and by someone more knowledgeable than me :)

I just tried renaming the WindowsApps folder and it didn't help. A also deleted the 'Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe' folder but that didn't help either. I decided it was too much trouble to fiddle with the SDOMAIN\USER with the Exits Win://SYSAPPID. So it looks like the problem has different manifestations on different PCs. Either way I'm fed up with wasting any more of my time of this.

Be sure to use the Feedback Hub app to add your voice to the growing number of users who are complaining about this problem so maybe we can get it fixed in the next cumulative update.

Been good collaborating with you on this.
Bob

The only light it sheds on the problem for sure is that MS created a really big mess this time...

Eagle51 said:

SoFine409 ... probably, but I ain't going down that road again. Nope, not an IT Pro.

Note: Probably not a valid test.

I found a 'wcifs.md' file dated 2/20/2017 (1k), with what appears to be one ascii character/symbol in it [] . I think this is the original file, when I first noticed my restore issue, but can't be sure.

Put it in 'c:\system volume information'
Created a restore point and got the event id 4 filter manager warning.
Rebooted and got the event id 4 filter manager warning.

File System Filter 'wcifs' (Version 10.0, ‎2016‎-‎09‎-‎15T11:42:03.000000000Z) failed to attach to volume '\Device\HarddiskVolumeShadowCopy4'. The filter returned a non-standard final status of 0xC000000D. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor.

Then did a system restore on the restore point I just created and it completely successfully. That 'wcifys.md' file didn't get deleted or changed and fltmc instances shows wcifs is attached to c: Not sure this really sheds any light on the issue ... lol

Win10usr said:

The only light it sheds on the problem for sure is that MS created a really big mess this time...

Amen on that!
Everytime I see one of these issues I remember reading that sometime ago MS let go most of their QC and testing staff. Fixing software after it's released is always more expensive then catching the bug in development. Darn shame we users get stuck with the train wrecks. I'm so tired of having Win 10 blowup in my face. It's darn near a full time job just keeping my PCs running. Good thing I'm retired and that we have this forum. Otherwise we'd be up the creek.
Bob

Recovery environment is also gone, no way back at all anymore :-(((((

Found a recovery-dvd. Now trying to restore an image of 01-27. Hope that works. This was a fully loaded production system. And then I hope I can surpress this stupid Skype-update and remove that. Then have to try installing Macrium. But I am worried that Windows became instable itself after those app-updates, so no idea if any image made after that will be very usefull :-(

Win10usr said:

Ok, disaster struck. Just bought Macrium and started the first pc to install it on. Unfortunately, a Skype update appeared. And that failed fatally. First the FilterManager-error appeared in the logs followed by a load of errors I never saw before in my life. Essentially a lost system with blaring fans and frozen installers. Obviously installing and updating of software is not possible anymore this is going to cost me a lot of time to reinstall.

and with fatal I mean I cant even login anymore. What I understood from the logs - before trying to restart - is that the Skype installer tried to make a restore point. That failed. It was followed by the mentioned series of errors. Too many to mention. After a restart, clicking at the splash screen didn't bring up the login dialog anymore. Also not after waiting a long time and several restarts.

Sorry to hear about this. I assume you tried safe mode to log in? Did you try booting up with the USB installer and selecting repair my computer or you could use Kyle's Recovery USB stick to repair the boot files. Take a deep breath before you launch into a reinstall. When you get up running you know you can turn off app updates in the Windows store/settings. Let us know how it goes.

Safe mode was completely gone. Luckily I had a win 10 installation dvd. From that I managed to restore an image. However, after the obligatory app updates the FilterManger-error is back in its full glory. Managed to uninstall Skype though. Now I will try to install Macrium. Hope creating of the bootmedia will work flawless.

SoFine409 said:

Sorry to hear about this. I assume you tried safe mode to log in? Did you try booting up with the USB installer and selecting repair my computer or you could use Kyle's Recovery USB stick to repair the boot files. Take a deep breath before you launch into a reinstall. When you get up running you know you can turn off app updates in the Windows store/settings. Let us know how it goes.