Windows 10: Warning about File System Filter 'wcifs' - what is THAT ????

Have yet another new Warning on startups of Win 10 Pro 64-bit. When will these stop?
This one is:File System Filter 'wcifs' (Version 10.0, ‎2016‎-‎09‎-‎15T11:42:03.000000000Z) failed to attach to volume '\Device\HarddiskVolumeShadowCopy10'. The filter returned a non-standard final status of 0xC000000D. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor.In the list of these Warnings in Event Viewer, sometimes the "HarddiskVolumeShadowCopy10" number is different. I also see 6, 7 and 8 in the list.
So, what is this and can I get some sleep now?
Also, should TenForums start a new sub-forum captioned "Yet Another EventViewer Issue" ?
Thanks.

:)

 

FilterManager Errors During Installation of Cumulative Updates

Thanks for the reply, Phillipe. It may be that the update simply stopped the wcifs filter, which then prevents any further warnings to be sent to the windows log. You can check the status by opening an Admin Command Prompt and typing "sc query wcifs"
When I stop the wcifs filter ("sc stop wcifs") and set the startup to "disabled" ("sc config wcifs start= disabled") I no longer get the warnings in the windows log but, like you, I continue to get the System Volume Information folder filling with files generated
while Carbonite is active. If I pause Carbonite both the warnings cease and the files in the System Volume Information are no longer generated. So I don't know whether it is a problem with Windows or with Carbonite or with both. I am up to date with the
updates for Windows 10 and still have the problem with both the warnings in the windows logs and with the files being generated in the System Volume Information folder if Carbonite is active. But, as I said, I can at least get rid of the warnings by stopping
the wcifs filter using the command line given above, but that does not solve the main problem of the System Volume Information folder filling up with files.

 

After 2+ days of troubleshooting, was finally able to successfully upgrade to Windows 10 Creator Version 1709

Hi, I am also not able to update Windows with the latest Fall Creators Update and my system freezes also at 75%.

I already dit a complete reinstall of my system and even when restarting from a clean windows system (v1607), I get the same thing.

I also have a Ralink WLAN network card. So I definitily going to try your solution.

However, I wanted to know if you can find anything in the logbooks that would explain this behaviour.

I looked into mine and I find this warning, just before the service control manager fails and the whole system freezes:

"File System Filter 'wcifs' (Version 10.0, ‎2016‎-‎09‎-‎15T17:42:03.000000000Z) failed to attach to volume '\Device\HarddiskVolumeShadowCopy1'. The filter returned a non-standard final status of 0xC000000D. This filter and/or its supporting
applications should handle this condition. If this condition persists, contact the vendor."

Do you also have this warning?

Have you tried anything like this: How to fix File System Filter WCIFS failed with Event ID 4 (Windows 10) - wintips.org - Windows Tips & How-tos

Thx!

Peter.

 

By the way - this is the complete Warning in EventViewer:Log Name: System
Source: Microsoft-Windows-FilterManager
Date: 2/26/2017 10:05:49 AM
Event ID: 4
Task Category: None
Level: Warning
Keywords:
User: SYSTEM
Computer: DESKTOP-3OLB09N
Description:
File System Filter 'wcifs' (Version 10.0, ‎2016‎-‎09‎-‎15T11:42:03.000000000Z) failed to attach to volume '\Device\HarddiskVolumeShadowCopy10'. The filter returned a non-standard final status of 0xC000000D. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-FilterManager" Guid="{F3C5E28E-63F6-49C7-A204-E48A1BC4B09D}" />
<EventID>4</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000000000</Keywords>
<TimeCreated SystemTime="2017-02-26T15:05:49.868225700Z" />
<EventRecordID>7974</EventRecordID>
<Correlation />
<Execution ProcessID="5072" ThreadID="6164" />
<Channel>System</Channel>
<Computer>DESKTOP-3OLB09N</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="FinalStatus">0xc000000d</Data>
<Data Name="DeviceVersionMajor">10</Data>
<Data Name="DeviceVersionMinor">0</Data>
<Data Name="DeviceNameLength">5</Data>
<Data Name="DeviceName">wcifs</Data>
<Data Name="DeviceTime">2016-09-15T11:42:03.000000000Z</Data>
<Data Name="ExtraStringLength">34</Data>
<Data Name="ExtraString">\Device\HarddiskVolumeShadowCopy10</Data>
</EventData>
</Event>

 

I'm encountering the same issue. It's happening a lot for one of my end users.

I have read that it could be a virus, malware, an application or service that is causing issues, etc...

I'm still looking for an answer so I'm looking forward to seeing what is possible solutions are posted.

 

Techteam - FYI, my Win 10 Pro 64-bit is basically unused. I've added almost no applications other than TeamViewer and LogMeIn Free. Not even Office yet. But maybe some updates for the Intel drivers like IntelProSet for the NIC card.
And whatever I added has been there for months, since way before these new errors started popping up.
But if you find anything specific, please come back here and share with us.
Thanks.

 

Been doing some more digging on this site and noticing A LOT more posts. Apparently this might be a bug in Windows 10 from an upgrade/update. Since installing Windows 10 usually installs the latest updates, it makes sense that you would continue to see the error after a clean boot.

But, as requested, I will post any relevant findings

 

I have same issue.


File System Filter 'wcifs' (Version 10.0, ‎2016‎-‎09‎-‎15T11:42:03.000000000Z) failed to attach to volume '\Device\HarddiskVolumeShadowCopy22'. The filter returned a non-standard final status of 0xC000000D. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor


It has something to do with system restore as I am searching for a fix also.

 

UPDATE:

One of your restore points are bad. What I did to fix this do the following

Open command prompt in administrator mode by type CMD in the search box, right click CMD program and open as administrator
2. Type this command vssadmin delete shadows /for=c: /all and hit enter
3. Choose Y on the confirmation and hit enter. A message will display showing how many VSS copies deleted.

After that go into system restore create a new restore point as your old ones will be deleted & no more problems.

 

Did that and this is the result:

C:\WINDOWS\system32>vssadmin delete shadows /for=c: /allvssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool(C) Copyright 2001-2013 Microsoft Corp.Error: Snapshots were found, but they were outside of your allowed context. Try removing them with thebackup application which created them.
Thoughts?

 

Do you use a 3rd party restore program like roxio back on track? Try turning off system restore reboot pc then try above & if that not work you have a software possibly making restore points. & uninstall any 3rd party programs making restore points also unless you are using them then i would leave it & get support from that software help forum.

 

done the command have no third party restore software, got the following Error: Either the specified volume was not found or it is not a local volume.

 

I've been having some issues with my computer not loading my antivirus every time I reboot sometimes it does and sometimes it doesn't. I've contacted my antivirus company and they indicated from the files that I sent them that I'm getting the same error also getting something about a shadow disk.When I did my upgrade from Windows 7 to Windows 10 I have several issues I contacted Microsoft, a Microsoft tech logged into my computer remotely at least three times.

I have no idea what he did to fix my computer nor do I know if he fixed it he may have just made a workaround, in fact if there is a shadow disk he may have created it I don't know.I do have a question I'm hoping when you guys could answer for me. Surely after my problems with the upgrade I purchased a full version of Windows 10 if I was to format my C drive where my OS is installed with that fix the issues I'm having with the same error message. If so, I know that when you install the Microsoft Windows 10 media it says it format your hard drive is there a better way to format my hard drive to make sure absolutely everything is off that hard drive prior to installing them Windows 10 media. I would like to make sure everything is off the hard drive completely and install a fresh copy of Windows 10 however I don't want to do something that will prevent me from being able to install my fresh full version of Windows 10. That's why am asking this question.

The actual error message that my antivirus support identified as a issue was,

• Windows error message:
  "Disk 6 has the same disk identifiers as one or more disks connected to the system. Go to Microsoft's support website (http://support.microsoft.com) and search for KB2983588 to resolve the issue."
• Windows error message:
  "File System Filter 'wcifs' (Version 10.0, ‎2016‎‎09‎‎15T11:42:03.000000000Z) failed to attach to volume '\Device\HarddiskVolumeShadowCopy30'. The filter returned a non-standard final status of 0xC000000D. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor."

Is there a way to identify which of my hard drives is "Disk 6" if it is my C drive, I have a SSD HD I just bought and my full version of Win 10 so that addition to my computer will fix my issues I hope. What do you think????

 

I was getting Event id 4 and the filter message when my disk image backup program ran. I use Shadow Protect Desktop. I also would get a similar message when I mounted a backup.

I finally found a way to get rid of the messages. I booted into Linux to get rid of some files that I couldn't get rid of while in Windows. While in Linux I decided to delete my System Volume Information folder on my C drive which is the drive I backup. When I restarted Windows the SVI folder was recreated. After this I no longer had any messages in my event log and all my backups are fine. As a further test I mounted a backup with the 'old' SVI and I got the event log message when mounting an image. I didn't get the message when mounting an image with the 'new' SVI folder.

I don't use System Restore so I didn't get rid of any Restore Points. If you want to try deleting your SIV keep in mind that you will lose all the restore points on your disk/partition. You could probably delete your SIV in Windows but you probably would need to change permissions or perhaps deal with the folder being in use. Booting into Linux was the easiest way.

 

I have researched different ways of attempting to fix this issue, but the one thing that I think will fix it is something I've been putting off for about six months. After I upgraded to Windows 10 from Windows 7, I wasn't totally secure with what happened. I had a Microsoft tech have to log into my computer remotely three different times to correct the issues I was having, I'm convinced that whatever the duplication message I'm getting about disk six has something to do with what he did to fix my upgrade.Right after that I purchased a 500 GB solid-state hard drive and a full version of Windows 10. So the fix that I'm going to do is finally bite the bullet and stole my solid-state drive in my full version of Windows 10 and then slowly install all my programs all over again. Reason I put it off so long is because I didn't seem to be having too many issues and I have a lot of software installed on the computer. In the end once I install this hard drive and Windows 10 full version that should eliminate everything and that should speed up my computer which is already a fast computer as it is.So I'm no longer looking for solution to this problem because I have decided to fix it by installing a new solid-state hard drive and a new version of Windows 10 full version.