Windows 10: File System Filter 'wcifs' EVENT ID 4

Amen on that!
Everytime I see one of these issues I remember reading that sometime ago MS let go most of their QC and testing staff. Fixing software after it's released is always more expensive then catching the bug in development. Darn shame we users get stuck with the train wrecks. I'm so tired of having Win 10 blowup in my face. It's darn near a full time job just keeping my PCs running. Good thing I'm retired and that we have this forum. Otherwise we'd be up the creek.
Bob

 

Ok, disaster struck. Just bought Macrium and started the first pc to install it on. Unfortunately, a Skype update appeared. And that failed fatally. First the FilterManager-error appeared in the logs followed by a load of errors I never saw before in my life. Essentially a lost system with blaring fans and frozen installers. Obviously installing and updating of software is not possible anymore *Mad this is going to cost me a lot of time to reinstall.

and with fatal I mean I cant even login anymore. What I understood from the logs - before trying to restart - is that the Skype installer tried to make a restore point. That failed. It was followed by the mentioned series of errors. Too many to mention. After a restart, clicking at the splash screen didn't bring up the login dialog anymore. Also not after waiting a long time and several restarts.

 

Recovery environment is also gone, no way back at all anymore :-(((((

 

Found a recovery-dvd. Now trying to restore an image of 01-27. Hope that works. This was a fully loaded production system. And then I hope I can surpress this stupid Skype-update and remove that. Then have to try installing Macrium. But I am worried that Windows became instable itself after those app-updates, so no idea if any image made after that will be very usefull :-(

 

Sorry to hear about this. I assume you tried safe mode to log in? Did you try booting up with the USB installer and selecting repair my computer or you could use Kyle's Recovery USB stick to repair the boot files. Take a deep breath before you launch into a reinstall. When you get up running you know you can turn off app updates in the Windows store/settings. Let us know how it goes.

 

Safe mode was completely gone. Luckily I had a win 10 installation dvd. From that I managed to restore an image. However, after the obligatory app updates the FilterManger-error is back in its full glory. Managed to uninstall Skype though. Now I will try to install Macrium. Hope creating of the bootmedia will work flawless.

 

During installation also a FilterManager-warning appeared :-/

 

as long as you have the install USB you cab try a repair install and choose to keep att you data. That might fix to more serious stuff.

 

Ok, I am running a backup now from the Macrium boot dvd. Can anyone confirm I selected the right partitions for a full system image? I don't want to include data partitions (like E), this is rather useless. I think I have now a complete set of images to restore Win 10. Hopefully.

 

Restoring an image works a lot quicker, I learned... :-/

 

yes you got the right ones.

 

Good to know, tnx *Smile And I can restore ONLY those partitions without destroying the others, I assume (hope...)

 

Yes. When you restore you can decide to put them back in the same partition that they came from or put them somewhere else. That what you would do if you were migrating to a larger HD or SSD. FYI, cloning frequently has problems especially if you try to clone the unique disk identifier. So images are the way to go. You'll sleep better knowing that you have backup images. I run a differential image each time I make significant changes/additions and then a fresh full image say every two weeks or month depending on how often I do differentials. If you keep the backup device turned off then ransomware can't get at it and all you'll need to do is a restore and your back in business.

 

Tnx! *Smile

 

If want to see if the 'wcifs.md' file in the 'C:\System Volume Information' folder is being created/updated, for whatever error/warning/reason and giving you the FilterManager (event id 4 'wcifs' ).

Note: All I'm doing is copying it to the desktop and renaming it.
Note: My 'c:\System Volume Information' folder is already own by Administrators, so I didn't have to do a takeown on it.

... USE AT YOUR OWN RISK ...

Open Command Prompt as Admin
Run the following commands

icacls "C:\System Volume Information" /grant "%USERNAME%":F

takeown /f "C:\System Volume Information\Wcifs.md"

icacls "C:\System Volume Information\Wcifs.md" /grant "%USERNAME%":F

attrib -s -h "C:\System Volume Information\Wcifs.md"

copy "C:\System Volume Information\Wcifs.md" "C:\users\%USERNAME%\Desktop\Wcifs.md"

rename "C:\System Volume Information\Wcifs.md" Wcifs.md.bak

attrib +s +h "C:\System Volume Information\Wcifs.md.bak"

icacls "C:\System Volume Information\Wcifs.md.bak" /setowner "SYSTEM"

icacls "C:\System Volume Information\Wcifs.md.bak" /remove:g "%USERNAME%"

icacls "C:\System Volume Information" /remove:g "%USERNAME%"