Windows 10: WdFilter.sys - BSOD - SYSTEM_SERVICE_EXCEPTION

Originally posted as #3 here.

My first issue was an IRQL_NOT_LESS_OR_EQUAL while I was playing Grand Theft Auto V. I wasn't doing anything different than usual, and I hadn't installed applications in weeks. I do remember postponing Insider updates for another three days the night before, but knowing Microsoft they probably still downloaded some updates or something in the background, likely causing issues. I've tried everything and debugging everything from checking memory dump files. I got several B(/G)SODs, with STOPs like:

• IRQL_NOT_LESS_OR_EQUAL
• SYSTEM_SERVICE_EXCEPTION
• SYSTEM_THREAD_EXCEPTION_NOT_HANDLED

The IRQL_NOT_LESS_OR_EQUAL STOP code refers to a broken driver. The computer collected info as usual and rebooted, although I could not get past the Windows start splash screen.

I am able to access Safe Mode but not normal mode, further confirming my suspicion of a driver issue. All BSOD's from that point onward were usually SYSTEM_SERVICE_EXCEPTION or IRQL_NOT_LESS_OR_EQUAL. I attempted using verifier.exe and found two drivers that were causing problems, one to do with VMware workstation and another to do with Malwarebytes. I uninstalled the two programs and manually removed the drivers from \windows\System32\drivers.

This fixed the SYSTEM_SERVICE_EXCEPTION stop code, but I then started getting IRQL_NOT_LESS_OR_EQUAL errors. Many issues with this STOP code are the result of a corrupt graphics driver, so I booted safe mode and used Display Driver Uninstaller and uninstalled the graphics drivers. I was able to reboot into normal mode, and I was actually able to get to my desktop for a couple seconds before getting an IRQL_NOT_LESS_OR_EQUAL stop code. My theory is that Windows is attempting to automatically install a corrupt graphics driver, as I believe most automatic driver updates are done after the user has logged in. After the first several IRQL_NOT_LESS_OR_EQUAL screens, it went back to having a SYSTEM_SERVICE_EXCEPTION, with WdFilter.sys being the culprit, according to both the details on the screen and the dump files. Apparently this has something to do with Windows Defender; I have tried viewing its settings from the Settings app so that I could turn it off or update it (like some Microsoft forum posts state), but the settings screen is actually blank and doesn't appear to be usable in safe mode.

I have tried CHKDSK, "sfc /scannow", and most recently DISM, but nothing helped--"sfc /scannow" reported no errors.

I have attached the log collector results. I will let you know that I have uninstalled my graphics drivers and the collection process was done in safe mode as I can't boot normally. However, even if I could I don't understand how the graphics drivers could possibly be the issue... I have been trying to fight with this since 9:30 this morning (it's now 10 PM). Any help would be greatly appreciated.

:)

 

PLS HELP MY COMPUTER RESTARTS AUTOMATICALLY

Did as you told

I Worked for a few minutes

and the bsod came again and restarted the pc.

Kmode exception not handled

Wdfilter.sys

 

SYSTEM_SERVICE_EXCEPTION (wdfilter.sys) and DRIVER_OVERRAN_STACK_BUFFER

I have added the dmp files and system information data to my question! Thanks for the help!

 

As this is an insider build there are too many unknowns about drivers and compatibility. If you want a stable system it is best to avoid the insider builds or only experiment with them on a system which is not your main PC.

 

Yes, I was thinking about that. Attempting to perform a system restore to a restore point from (conveniently) the night before left me with an unknown error. Attempting to restore my version of Windows to a previous version via the advanced startup options stated that it couldn't be completed and that I need to reset my PC or something along those lines.

The problem is that I don't believe that I was doing anything to trigger this. I know Microsoft likes to download/install stuff in the background (as per the Windows 7->10 upgrade back then, which is cited here) usually without knowledge of its users. WdFilter.sys has something to do with the Windows Defender antimalware file filter, or something along those lines--perhaps my computer is infected with something Windows Defender doesn't know how to handle...but Malwarebytes returned no issues with my system when I ran a scan before I uninstalled it. Even then it doesn't explain the IRQL_NOT_LESS_OR_EQUAL stop codes I've been getting either.

This is such a strange issue, and of course it has to happen the one time I actually want to use my computer lol.

 

If you are unable to boot normally you might need to use rescue media and boot from that. Then you can save all data and other files before attempting further repairs or even trying a clean install.

This is a very good rescue media option: Windows 10 Recovery Tools - Bootable Rescue Disk

 

Also make sure you have turned Driver Verifier OFF.

 

1167/5000





I confirm the culprit is windows defender

Historical
1: Tuesday night infinite loop green screen blue screen restart restart restart
Repair:
Unusable boot, recovery f11 does not work
Creating a recovery usb key
Repair failure
Restore failure
reinstalling w10 from recovery with data user: failure missing desktop file
reinstallation w10 origin ok, data user backup restored, applications installed
taking an image system, backup
2: this morning KMOD exception not handle reboot multiple times
Between 5 and 10 minutes after login to each launch of the windows defender green screen updates
Then after 5 to 6 times immediately after login green screen
Restore on last version of last night
Startup without wifi link, the system is stable, no WD update
Offline installation of another antivirus (Mcafee), which disables Windows defender
Restart and open wifi update antivirus Mcfee, scan ok
Without active Windows defender pending windows updates run
For more than kmod exception
I'm loading the 1803 backup version and then re-testing WD
Georges from Paris with google aid translation....

 

Thank you for sharing your issue with it...I might've come up with a breakthrough. I was able to disable Windows Defender in safemode using this article as I couldn't turn it off through the Settings app...I feel stupid for not trying to disable it sooner...and lo and behold I'm able to boot up normally now. I'm currently running updates for my drivers. In the Imgur link at the bottom of this post you can see that there was a Defender update that was installed on the day my issue started occurring (4 April, 2018). That could very likely have been the cause.

Other screenshots include pictures of Windows Updates running and Windows Defender being turned off.

Big thank you to those who gave advice. It is much appreciated.

Screenshots: Imgur: The magic of the Internet

I have also set it to turn off Insider updates after the next major release.

 

I installed the 1803 fast ring release
Loaded some 30 updates including some for the WD platform
WD viruses are up to date
return to normal operation after many hours of work...... *Sleepy

 

Got that update last night, I'm a bit hesitant to re-enable it haha...
I'm assuming that they released an update to Windows Defender that only worked with newer builds of Windows 10, that would crash older builds.

Anyway, the problem is marked solved. Thanks y'all.