Windows 10: mpfilter.sys (MSE) issues inherited from Windows 7

Hello all. I was having a few BSODs from mpfilter.sys in the week or two leading up to the 10 launch, but given that I could simply disable Microsoft Security Essentials temporarily when they started to solve the problem, I didn't do anything material about it. Unfortunately, my hope that MSE would be replaced wholesale or at least repaired by Windows 10 was misplaced, as the new Windows Defender is causing identical BSODs.

As on 7, I can disable my AV for a while, which stops the BSODs. However this is far from ideal, so I'm wondering if there is any way to repair mpfilter.sys, or if there is perhaps some other issue at work. I've run the diagnostic tool as indicated in the sticky, which is attached.

:)

 

Pictures folder keeps losing INHERITANCE

There were only 3 when I started and none were removable as they had PARENTS. The others were added with SHARING which I tried in desperation after several attempts to get all 3 to have FULL PERMISSIONS! Now all SIX do, but every boot I lose INHERITANCE.
It also refuses to set it for existing folders too.

Update! I had installed MSE and Windows Defender and both are now GONE! MSE won't download from your site either. Can't get any EXE in Windows Defender folder to do anything.

Ran AVG and MalwareBytes with no problems reported. Have to re-install MSE I guess...

MSE install says I already have a version of Windows Defender WITH MSE in it already running...

I was able to remove 3 from Pictures Folder Properties:

 

Windows 10 - Security Essential installed and Defender turned off - cannot uninstall Essential

I also have upgraded from Windows 7 to Windows 10 and now have MSE installed and cannot uninstall it. I get the same message others have gotten that I don't need to install MSE. That's an absurd response to an attempt to uninstall MSE.

Microsoft needs to address this issue soon with a solution, not a denial.

Enoch Moser

 

Your MSINFO file is missing from your logs, can you follow Option One of System Information File - Create in Windows 10 - Windows 10 Forums and upload the resulting .zip file.

As for your dumps I've found the following. In all three the Hide Folders 2009 file encryption driver has been flagged, it's very old and needs updating. Check for an updated driver or update to the software here, if there is none please disable or uninstall the program for testing purposes.

Code: ffffd000`eac84168 fffff800`e6a32a5fUnable to load image FSPFltd.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for FSPFltd.sys *** ERROR: Module load completed but symbols could not be loaded for FSPFltd.sys FSPFltd+0x2a5f 3: kd> lmvm FSPFltd start end module name fffff800`e6a30000 fffff800`e6a41000 FSPFltd T (no symbols) Loaded symbol image file: FSPFltd.sys Image path: FSPFltd.sys Image name: FSPFltd.sys Timestamp: Thu Jun 05 18:37:17 2008 (4848244D) CheckSum: 00017B5C ImageSize: 00011000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4[/quote]

 

I'm not entirely sure how to go about disabling that driver, as it doesn't seem to be associated with any local software that I can see (and indeed pre-dates the age of the hardware). I can try installing the demo for a more recent version of the software if that might update the driver?

Find attached the file you requested. Thanks for your help!

 

My AV reactivated itself this morning and I got a wdfilter.sys BSOD this time. Looks like Defender will be turned off for the forseeable future. *Sleepy

I've uploaded another zip of all the dumps etc generated just now.

 

It's the same driver again. I've done some digging at it belongs to My Lockbox from FSPro Labs.

Code: ffffd000`21d4d168 fffff800`6d832a5fUnable to load image FSPFltd.sys, Win32 error 0n2 *** WARNING: Unable to verify timestamp for FSPFltd.sys *** ERROR: Module load completed but symbols could not be loaded for FSPFltd.sys FSPFltd+0x2a5f[/quote]
Uninstall My Lockbox.

 

Excellent, thanks for that digging. I had a copy of "My Lockbox Halloween Edition" installed in 2012, which I've now removed. The driver file itself is still there in system32/drivers after the uninstall-demanded reboot - is this an issue? In the meantime I will re-enable the AV and see if anything happens. Thanks so much!

 

The driver shouldn't be active if the software is uninstalled so just test the system for stability. If you have any more issues let us know straight away, but hopefully that should have solved the problem.

 

Haven't had any more issues since the software was uninstalled, so I'm inclined to agree. Thanks so much!

 

You're welcome, glad to hear it. *Thumbs