Windows 10: File System Filter 'wcifs' EVENT ID 4

Discus and support File System Filter 'wcifs' EVENT ID 4 in Windows 10 Support to solve the problem; True. It happened between 16 and 20 of February. *Huh Right, I forgot that had already been said. FYI, this is not the first wonky app that MS has... Discussion in 'Windows 10 Support' started by Edward, Feb 17, 2017.

  1. SoFine409 Win User

    File System Filter 'wcifs' EVENT ID 4


    Right, I forgot that had already been said.
    FYI, this is not the first wonky app that MS has released. See: .Net Native Framework Package 1.2.23205.0 keeps updating from July, 2016.
    Eventually MS will fix it.
     
    SoFine409, Feb 27, 2017
    #46
  2. Win10usr Win User

    I think unfortunately it has nothing to do with one of the apps itself. I suspect the update system has a serious flaw. It might also be the reason why they halted February's patch Tuesday. But then they shouldn't have rolled out app updates in the same week also. First repair, then do I'd say. *Sad

     
    Win10usr, Feb 27, 2017
    #47
  3. EdTittel Win User
    Just for grins I ran a restore point create on my apparently healthy (no SFC nor DISM /checkhealth errors) 14393 production desktop. Here's what shows up in my Event Viewer right when I do that:

    File System Filter 'wcifs' EVENT ID  4 [​IMG]

    I haven't yet tried to restore the restore point (which reports a successful completion, BTW) but I won't be surprised if it fails with the error that others have reported in this thread. I have to take my son to school now, but when I get back I'll run it and report back.
    HTH,
    --Ed--
     
    EdTittel, Feb 27, 2017
    #48
  4. Win10usr Win User

    File System Filter 'wcifs' EVENT ID 4

    Hi!

    I wouldn't risk a system restore in this situation, you might end up with an instable system after a partly or completely failed one! Just be very carefull...


     
    Win10usr, Feb 27, 2017
    #49
  5. EdTittel Win User
    I make nightly backups with Macrium Reflect, so I wasn't worried about a failed restore. In my experience MS is pretty good about making sure of roll-forward/roll-back recovery with restore -- that is, nothing left halfway between the previous state and the restored restore point state. And if the worst were to happen, this machine has the Macrium recovery partition in the boot menu so I could boot directly into that and restore last night's backup. That's why I proceeded to test the restore anyway. It reported a successful completion during the restore process, but here's what popped up on my screen following the restart:


    File System Filter 'wcifs' EVENT ID  4 [​IMG]


    More or less as I'd expected, based on the error when creating the restore point reported in my previous post here, the restore itself also fails. I'm posting a long message to the Feedback Hub about this, and will also blog about it this morning. Bottom line: don't count on restore points to bail you out of a jam at present. Something is wrong, and needs repair.
    Thanks,
    --Ed--

    PS: I just checked the Event Viewer and it shows a restore error all right, but not the same one that others have been reporting here. Here's a screen cap of the error detail:

    File System Filter 'wcifs' EVENT ID  4 [​IMG]

    Next stop: Feedback Hub!
     
    EdTittel, Feb 27, 2017
    #50
  6. Win10usr Win User
    Ok, tnx for yet another confirmation!

    in case I switch to Macrium - which seems to be unavoidable - which partitions should be exactly backed up for making a system image? Win 10 always takes - as far as I remember - the C-partion with Windows (duh), EFI and Recovery. And can I restore an image WITHOUT destroying a seperate data partions on my HD?


     
    Win10usr, Feb 27, 2017
    #51
  7. SoFine409 Win User
    I decided to do a bit more research into this issue by looking at the info on:
    Windows System Restore fails with error 0xC000000D | Born's Tech and Windows World
    "The error 0xC000000D warning
    The warning mentioned above says, that the filter driver wcifs returns an unknown state (error 0xC000000D). Obviously the VSS (volume shadow service) writer wasn’t able to write successful shadow copies used for system restore.
    If it’s not a bug, provided from Windows 10, my conclusion is: There is another filter driver hooked into the filter driver chain, that’s causing this conflict. So my recommendation is, to open an administrative command prompt windows (see Windows 10: Open command prompt window as administrator) and enter the command:
    fltmc filters

    This enlists all filter drivers installed within the system (see also my blog post Windows 10: Error 0x80070057 from Cloudfogger). Then try to identify third party filter drivers that can cause this conflict."

    I tried the "fltmc filters" command and got:

    File System Filter 'wcifs' EVENT ID  4 [​IMG]

    Of these filters all are MS save for:
    “eeCtrl.sys” and “symefasi.sys”= Symantec
    “MNAMProtector” (mbam.sys) = Malwarebytes

    Next I looked through my events list to see if there were and errors/warning for any of the filters but all loaded correctly save for wcifs.sys. I doubt it wouldn't hurt to try uninstalling Norton Security and Malwarebytes to see if it makes a difference. I might try that later today if I have time.

    In case anyone is interested there is a nice discussion of container isolation filter (wcifs.sys) and how it relates to the simplification of distribution and deployment packages at:
    https://msdn.microsoft.com/en-us/win...ows-containers
    and a discussion of Windows Containers at:
    https://docs.microsoft.com/en-us/vir...rs/about/index

    Just thought I'd share this with everyone in case it helps solve the issue.
     
    SoFine409, Feb 27, 2017
    #52
  8. Win10usr Win User

    File System Filter 'wcifs' EVENT ID 4

    Interesting! However, that doesn't explain why suddenly virtually every Windows 10 system I ran into the last 10 days is suddenly affected. With OR without a virus scanner installed, even completely clean Windows 10 virtual systems got hit (try for yourself... *Smile). Now that is weird. Especially after just a round of app updates. Unless MS installed some kind of a hidden app that interferes with VSS.

    Today I noticed that the FilterManager warning also appears when saving an MS Office document. Which might mean that file revision history is gone too. Maybe it has something to do with running file backup software, didn't check this yet on another system.



     
    Win10usr, Feb 27, 2017
    #53
  9. SoFine409 Win User
    Only four apps were updated on my systems between 2/16 and 2/20: Microsoft Tips; Get Office; App Installer; and Skype Preview. I wonder if one of them is the culprit?
     
    SoFine409, Feb 27, 2017
    #54
  10. Eagle51 Win User
    Forgive me for the double post *Smile

    I just got system restore to work in normal windows, NOT safe mode or recovery.

    In trouble shooting the restore point issue. I was cleaning up some apps that I had uninstalled, but for whatever reason left some
    folders behind in (c:\ProgramFiles\WindowsApps).
    Note: I had uninstalled the apps the normal way - start menu, right click on app and uninstall.
    Note: Tried using Powershell Get-AppxPackage *APPNAME* | Remove-AppxPackage, folders still remained.

    So I just decided to manually delete the folders. No problems till I got to the folder "C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe" ... that I couldn't delete (0x80070091). Taking ownership, granting full user rights, etc didn't help. I found the account DOMAIN\USER permissions were corrupt on some of the folders (specifically the \VFS and its subfolders) and most of the files. Once I was able to get that sorted out and and get that folder deleted, I rebooted (no surprise error/warnings in event viewer), created a new restore point, then restored it successfully.

    So, I need someone to verify this, preferably on a clean install, system restore is NOT working and is comfortable with windows permissions.

    Look in the "c:\Program Files\WindowsApps" see if you have a folder "Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe"
    The account to check is the DOMAIN\USERS.
    Try to edit it and see if it gives you a message about the "permissions are corrupted, remove and add again". Sorry, I don't remember the exact message.

    Here a list of the folders/files.

    Directory: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe


    Mode LastWriteTime Length Name
    ---- ------------- ------ ----
    -a---- 2/16/2017 5:04 PM 152508 AppxBlockMap.xml
    -a---- 2/16/2017 5:04 PM 4553 AppxManifest.xml
    -a---- 2/16/2017 5:04 PM 10648 AppxSignature.p7x
    -a---- 2/16/2017 5:04 PM 2399952 clienttelemetry.dll
    -a---- 2/16/2017 5:04 PM 116962 FilesystemMetadata.xml
    -a---- 2/16/2017 5:04 PM 33 FilesystemMetadata.xml.md
    -a---- 2/16/2017 5:04 PM 4112432 mso20imm.dll
    -a---- 2/16/2017 4:44 PM 5893680 mso30imm.dll
    -a---- 2/16/2017 5:04 PM 2186800 office.odf
    -a---- 2/16/2017 5:04 PM 1625 Officehub_Base_PriConfig.xml
    -a---- 2/16/2017 5:04 PM 1604656 officeimm.odf
    -a---- 2/16/2017 5:04 PM 2934 Offihub_Base_PriInfo.pri.xml
    -a---- 2/16/2017 5:04 PM 3497984 Registry.dat
    -a---- 2/16/2017 5:04 PM 2040 resources.pri
    -a---- 2/16/2017 5:04 PM 56704 StreamMap.xml


    Directory: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe\AppxMetadata


    Mode LastWriteTime Length Name
    ---- ------------- ------ ----
    -a---- 2/16/2017 5:04 PM 22657 CodeIntegrity.cat


    Directory: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe\loc


    Mode LastWriteTime Length Name
    ---- ------------- ------ ----
    -a---- 2/16/2017 5:04 PM 10063 AppXManifestLoc.16.en-us.xml


    Directory: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe\Office16


    Mode LastWriteTime Length Name
    ---- ------------- ------ ----
    -a---- 2/16/2017 5:04 PM 428744 OfficeHubBackgroundTask.dll
    -a---- 2/16/2017 5:04 PM 35528 OfficeHubTaskHost.exe
    -a---- 2/16/2017 5:04 PM 1952456 OfficeHubWin32.exe


    Directory: C:\Program
    Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe\Office16\1033


    Mode LastWriteTime Length Name
    ---- ------------- ------ ----
    -a---- 2/16/2017 5:04 PM 86910 getofficecarousel.dcp
    -a---- 2/16/2017 5:04 PM 37064 officehubintl.dll


    Directory: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe\strings


    Mode LastWriteTime Length Name
    ---- ------------- ------ ----
    -a---- 2/16/2017 5:04 PM 6451 officehubintl.lang-en-us.resw


    Directory: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe\VFS\ProgramF
    ilesCommonX64\Microsoft Shared\OFFICE16


    Mode LastWriteTime Length Name
    ---- ------------- ------ ----
    -a---- 2/16/2017 5:04 PM 2268720 ACECORE.DLL
    -a---- 2/16/2017 5:04 PM 620080 ACEDAO.DLL
    -a---- 2/16/2017 5:04 PM 47152 ACEERR.DLL
    -a---- 2/16/2017 5:04 PM 874544 ACEES.DLL
    -a---- 2/16/2017 5:04 PM 250416 ACEEXCH.DLL
    -a---- 2/16/2017 5:04 PM 527920 ACEEXCL.DLL
    -a---- 2/16/2017 5:04 PM 342064 ACEODBC.DLL
    -a---- 2/16/2017 5:04 PM 22576 ACEODDBS.DLL
    -a---- 2/16/2017 5:04 PM 22576 ACEODEXL.DLL
    -a---- 2/16/2017 5:04 PM 22576 ACEODTXT.DLL
    -a---- 2/16/2017 5:04 PM 434224 ACEOLEDB.DLL
    -a---- 2/16/2017 5:04 PM 242736 ACETXT.DLL
    -a---- 2/16/2017 5:04 PM 3056176 ACEWDAT.DLL
    -a---- 2/16/2017 5:04 PM 327728 ACEXBE.DLL
    -a---- 2/16/2017 5:04 PM 999080 ADAL.DLL
    -a---- 2/16/2017 5:04 PM 404608 AirSpace.Etw.man
    -a---- 2/16/2017 5:04 PM 89648 AIRWER.DLL
    -a---- 2/16/2017 5:04 PM 491152 EXPSRV.DLL
    -a---- 2/16/2017 5:04 PM 200240 EXP_PDF.DLL
    -a---- 2/16/2017 5:04 PM 93744 EXP_XPS.DLL
    -a---- 2/16/2017 5:04 PM 4142 HeartbeatConfig.xml
    -a---- 2/16/2017 5:04 PM 22965504 MSO.DLL
    -a---- 2/16/2017 5:04 PM 4422192 Mso20win32client.dll
    -a---- 2/16/2017 5:04 PM 6462512 Mso30win32client.dll
    -a---- 2/16/2017 5:04 PM 4216880 MSO40UIRES.DLL
    -a---- 2/16/2017 5:04 PM 9718320 Mso40UIwin32client.dll
    -a---- 2/16/2017 5:04 PM 67632 mso50win32client.dll
    -a---- 2/16/2017 5:04 PM 7347248 Mso98win32client.dll
    -a---- 2/16/2017 5:04 PM 13090352 MSO99LRES.DLL
    -a---- 2/16/2017 5:04 PM 7393840 Mso99Lwin32client.dll
    -a---- 2/16/2017 5:04 PM 164052 MSOICONS.EXE.6.ico
    -a---- 2/16/2017 5:04 PM 1446248 MSOIDCLIL.DLL
    -a---- 2/16/2017 5:04 PM 830864 MSOIDRES.DLL
    -a---- 2/16/2017 5:04 PM 66096 MSOPRIV.DLL
    -a---- 2/16/2017 5:04 PM 29384 MsoRes.dll
    -a---- 2/16/2017 5:04 PM 73776 MSOXEV.DLL
    -a---- 2/16/2017 5:04 PM 70704 MSOXMLMF.DLL
    -a---- 2/16/2017 5:04 PM 1514032 MSPTLS.DLL
    -a---- 2/16/2017 5:04 PM 658480 MSSOAP30.DLL
    -a---- 2/16/2017 5:04 PM 660136 msvcp120.dll
    -a---- 2/16/2017 5:04 PM 963240 msvcr120.dll
    -a---- 2/16/2017 5:04 PM 7699 MUAUTH.CAB
    -a---- 2/16/2017 5:04 PM 29744 MUOPTIN.DLL
    -a---- 2/16/2017 5:04 PM 10288 OFFREL.DLL
    -a---- 2/16/2017 5:04 PM 32072 OPTINPS.DLL
    -a---- 2/16/2017 5:04 PM 32968 oregres.dll
    -a---- 2/16/2017 5:04 PM 2675760 RICHED20.DLL
    -a---- 2/16/2017 5:04 PM 18584 VBAJET32.DLL
    -a---- 2/16/2017 5:04 PM 170032 WISC30.DLL
    -a---- 2/16/2017 5:04 PM 158256 WXPNSE.DLL


    Directory: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe\VFS\ProgramF
    ilesCommonX64\Microsoft Shared\OFFICE16\1033


    Mode LastWriteTime Length Name
    ---- ------------- ------ ----
    -a---- 2/16/2017 5:04 PM 1652272 MSOINTL.DLL
    -a---- 2/16/2017 5:04 PM 64560 msointl30.dll


    Directory: C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe\VFS\ProgramF
    ilesCommonX64\Microsoft Shared\OFFICE16\Cultures


    Mode LastWriteTime Length Name
    ---- ------------- ------ ----
    -a---- 2/16/2017 5:04 PM 2186800 OFFICE.ODF


    Directory: C:\Program
    Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.7909.7600.0_x64__8wekyb3d8bbwe\VFS\SystemX64


    Mode LastWriteTime Length Name
    ---- ------------- ------ ----
    -a---- 2/16/2017 5:04 PM 334616 concrt140.dll
    -a---- 2/16/2017 5:04 PM 639728 msvcp140.dll
    -a---- 2/16/2017 5:04 PM 394504 vccorlib140.dll
    -a---- 2/16/2017 5:04 PM 89328 vcruntime140.dll
     
    Eagle51, Feb 27, 2017
    #55
  11. Win10usr Win User
    Will have a look at that tomorrow! As far as I remember though you shouldn't delete that folder when Office is installed. The files in it are used to update Office2016/365. Which actually reminds me of the fact I didn't see some Office updates for a while. Coincidence...?

    Despite that: isn't it Microsoft that should solve this problem? Not many users will happily follow this procedure... *Wink

     
    Win10usr, Feb 28, 2017
    #56
  12. Win10usr Win User
    Might be (see also post below). But it might also be the update procedure itself that went wrong. I deleted all deletable apps with no result. Wish those stupid and useless apps were never there in the first place. *Sad

     
    Win10usr, Feb 28, 2017
    #57
  13. Eagle51 Win User

    File System Filter 'wcifs' EVENT ID 4

    Yea, should have clarified... I don't have or use Office2016/365 or any Office Products for that matter, so I was being aggressive with this issue. I'm not necessarily recommending this as fix, just what I found that appears to have fixed my restore issue. That's why I'm really interested what the guys that have done a clean install and have the restore issue have to say, since the Get Office and Office Hub stuff gets installed by default.
     
    Eagle51, Feb 28, 2017
    #58
  14. SoFine409 Win User
    I just went back and restored an image from 1/14 and immediately created a restore point and the restored from it. It worked fine. Then I went to the windows Store and let it update 25 apps. After that I tried creating another restore point but it failed to restore. Guess we know it's one of the apps.
     
    SoFine409, Feb 28, 2017
    #59
  15. Win10usr Win User
    Or still the update procedure itself... *Wink

     
    Win10usr, Feb 28, 2017
    #60
Thema:

File System Filter 'wcifs' EVENT ID 4

Loading...
  1. File System Filter 'wcifs' EVENT ID 4 - Similar Threads - File System Filter

  2. File System Filter 'mshield'

    in Windows 10 Gaming
    File System Filter 'mshield': I keep getting this warning event File System Filter 'mshield' Version 10.0, ‎2022‎-‎06‎-‎22T00:39:08.000000000Z does not support bypass IO and then a little time pass and my Pc just shuts down and I can't find a answer to it....
  3. File System Filter 'mshield'

    in Windows 10 Software and Apps
    File System Filter 'mshield': I keep getting this warning event File System Filter 'mshield' Version 10.0, ‎2022‎-‎06‎-‎22T00:39:08.000000000Z does not support bypass IO and then a little time pass and my Pc just shuts down and I can't find a answer to it....
  4. Event ID 10016 How can I filter these messages out of event viewer?

    in Windows 10 Support
    Event ID 10016 How can I filter these messages out of event viewer?: Ok I have added nearly every damn account on the system to the perappruntimebroker but this dcom is ****ing broken it still reports the same damn error. The application-specific permission settings do not grant Local Activation permission for the COM Server application with...
  5. Filter in the event viewer.

    in Windows 10 Support
    Filter in the event viewer.: Hi, is it possible to create a filter by manually editing the XML query in the event viewer and have the entered query remain stored in the log even if I close the event viewer? Thanks 170228
  6. System Rebooting - Event ID 41 & Event ID 161

    in Windows 10 BSOD Crashes and Debugging
    System Rebooting - Event ID 41 & Event ID 161: Hello, My system has started rebooting without BSOD randomly, but usually when playing Shadow of the Tomb Raider or other programs that have the PC under load. Today, it did it when trying to open a system information viewer program when nothing else was running. The CPU...
  7. System restore Event ID?

    in Windows 10 Backup and Restore
    System restore Event ID?: Does anyone know how I can check whether or not the machine was able to successfully do a system restore through the event viewer? If so, can you provide the event ID’s for system restore and if I need to check either the windows or application logs to get the latest time...
  8. System restore Event ID?

    in Windows 10 Support
    System restore Event ID?: Does anyone know how I can check whether or not the machine was able to successfully do a system restore through the event viewer? If so, can you provide the event ID’s for system restore and if I need to check either the windows or application logs to get the latest time...
  9. Event ID 10016 causing system crash

    in Windows 10 BSOD Crashes and Debugging
    Event ID 10016 causing system crash: I have reinstalled Window 10 many times, and change security permission. My desktop: - CPU Core i7 6700 - Mainboard Asus Z170-K - Ram 16GB - Graphic Nvidia Geforce GTX 970 - SSD 240GB WD Here some pictures [ATTACH][ATTACH][ATTACH] Thanks...
  10. Warning about File System Filter 'wcifs' - what is THAT ????

    in Windows 10 Support
    Warning about File System Filter 'wcifs' - what is THAT ????: Have yet another new Warning on startups of Win 10 Pro 64-bit. When will these stop? This one is:File System Filter 'wcifs' (Version 10.0, ‎2016‎-‎09‎-‎15T11:42:03.000000000Z) failed to attach to volume '\Device\HarddiskVolumeShadowCopy10'. The filter returned a non-standard...