File System Filter 'wcifs' EVENT ID 4

During installation also a FilterManager-warning appeared :-/

Win10usr said:

During installation also a FilterManager-warning appeared :-/

as long as you have the install USB you cab try a repair install and choose to keep att you data. That might fix to more serious stuff.

Ok, I am running a backup now from the Macrium boot dvd. Can anyone confirm I selected the right partitions for a full system image? I don't want to include data partitions (like E), this is rather useless. I think I have now a complete set of images to restore Win 10. Hopefully.

Restoring an image works a lot quicker, I learned... :-/

SoFine409 said:

as long as you have the install USB you cab try a repair install and choose to keep att you data. That might fix to more serious stuff.

Win10usr said:

Ok, I am running a backup now from the Macrium boot dvd. Can anyone confirm I selected the right partitions for a full system image? I don't want to include data partitions (like E), this is rather useless. I think I have now a complete set of images to restore Win 10. Hopefully.

yes you got the right ones.

Good to know, tnx :) And I can restore ONLY those partitions without destroying the others, I assume (hope...)

SoFine409 said:

yes you got the right ones.

Win10usr said:

Good to know, tnx :) And I can restore ONLY those partitions without destroying the others, I assume (hope...)

Yes. When you restore you can decide to put them back in the same partition that they came from or put them somewhere else. That what you would do if you were migrating to a larger HD or SSD. FYI, cloning frequently has problems especially if you try to clone the unique disk identifier. So images are the way to go. You'll sleep better knowing that you have backup images. I run a differential image each time I make significant changes/additions and then a fresh full image say every two weeks or month depending on how often I do differentials. If you keep the backup device turned off then ransomware can't get at it and all you'll need to do is a restore and your back in business.

Tnx! :)

SoFine409 said:

Yes. When you restore you can decide to put them back in the same partition that they came from or put them somewhere else. That what you would do if you were migrating to a larger HD or SSD. FYI, cloning frequently has problems especially if you try to clone the unique disk identifier. So images are the way to go. You'll sleep better knowing that you have backup images. I run a differential image each time I make significant changes/additions and then a fresh full image say every two weeks or month depending on how often I do differentials. If you keep the backup device turned off then ransomware can't get at it and all you'll need to do is a restore and your back in business.

If want to see if the 'wcifs.md' file in the 'C:\System Volume Information' folder is being created/updated, for whatever error/warning/reason and giving you the FilterManager (event id 4 'wcifs' ).

Note: All I'm doing is copying it to the desktop and renaming it.
Note: My 'c:\System Volume Information' folder is already own by Administrators, so I didn't have to do a takeown on it.

... USE AT YOUR OWN RISK ...

Open Command Prompt as Admin
Run the following commands

icacls "C:\System Volume Information" /grant "%USERNAME%":F

takeown /f "C:\System Volume Information\Wcifs.md"

icacls "C:\System Volume Information\Wcifs.md" /grant "%USERNAME%":F

attrib -s -h "C:\System Volume Information\Wcifs.md"

copy "C:\System Volume Information\Wcifs.md" "C:\users\%USERNAME%\Desktop\Wcifs.md"

rename "C:\System Volume Information\Wcifs.md" Wcifs.md.bak

attrib +s +h "C:\System Volume Information\Wcifs.md.bak"

icacls "C:\System Volume Information\Wcifs.md.bak" /setowner "SYSTEM"

icacls "C:\System Volume Information\Wcifs.md.bak" /remove:g "%USERNAME%"

icacls "C:\System Volume Information" /remove:g "%USERNAME%"

Thanks Eagle51. Bob