How to temporarily deactivate the kernel mode filter driver in Windows

-


  • 814112 Files on network shares open slowly or read-only or you receive an error message
  • Event ID 2022 errors messages that occur in the System log, for example:

When you are troubleshooting any one of these issues, frequently, you have to do more than just stop or disable the services that are associated with the software. Even if you disable the software component, the filter driver is still loaded when you restart the computer. You may be forced to remove a software component to find the cause of an issue. As an alternative to removing the software component, you can stop the relevant services and disable the corresponding filter drivers in the registry. For example, if you prevent antivirus software from scanning or filtering files on your computer, you must also disable the corresponding filter drivers.

To disable filter drivers, you must first identify third-party services and their corresponding filter drivers. After you do this, follow these steps.

Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.

Important An antivirus program is designed to help protect your computer from viruses. You must not download or open files from sources that you do not trust, visit Web sites that you do not trust, or open e-mail attachments when your antivirus program is disabled.

For additional information about computer viruses, click the following article number to view the article in the Microsoft Knowledge Base:

129972 Computer viruses: description, prevention, and recovery 

  1. Stop all services that belong to the software package.
  2. Set the Startup type to "Disabled." To do this, follow these steps:
    1. Click Start, click Control Panel, double-click
      Administrative Tools, and then double-click Services.
    2. In the Details pane, right-click the service that you want to configure, and then click Properties.
    3. On the General tab, click Disabled in the Startup type box.
  3. Set the Start registry key of the corresponding filter drivers to 0x4. A value of 0x4 will disable the filter driver.To do this, follow these steps. 

    Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
    322756 How to back up and restore the registry in Windows
    1. Start Registry Editor.
    2. Create a backup of the HKEY_LOCAL_MACHINE\System registry hive.
    3. Locate, and then click the following registry subkey:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
    4. Click the entry for the filter driver that you want to disable.
    5. Double-click the Start registry setting, and then set it to a value of 0x4. 

      Note This registry entry typically has a value of 0x3.
  4. Restart the computer.
Most antivirus software uses filter drivers that work together with a service to scan for viruses. These filter drivers are still loaded after the service is deactivated. These filter drivers scan files as they are opened and closed on a hard disk. For troubleshooting purposes, temporarily remove the antivirus software or contact the manufacturer of the software to determine whether a newer version is available.

For additional information about how to disable antivirus software, click the following article number to view the article in the Microsoft Knowledge Base:

240309 How to fully disable antivirus software from filtering files

Example of filter drivers

This section describes some of the typical filter driver names by product:

Antivirus

  • Inoculan: INO_FLPY and INO_FLTR
  • Norton: SYMEVENT, NAVAP, NAVEN, and NAVEX
  • McAfee (NAI): NaiFiltr and NaiFsRec
  • Trend Micro: Tmfilter.sys and Vsapint.sys

Backup agent

  • Backup Agent for Open Files: Ofant.sys
  • Open Transaction Manager from Veritas BackupExec: Otman.sys (Otman4.sys or Otman5.sys)

    Note Use caution if you disable these filter drivers by using the method that is described in this article. If you do this, you may receive a "stop 0x7b" error message.

    The "stop 0x7b Inaccessible_Boot_Device" error message may occur if the following registry keys exist and contain references to the Otman5 driver when the Otman5.sys driver either does not exist on the hard disk or if the driver is set to disabled.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E967-E325 -11CE-BFC1-08002BE10318}\UpperFilters

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{71A27CDD-812A -11D0-BEC7-08002BE2092F}\UpperFilters

    If you experience the "stop 0x7b" error message you should back up these registry keys and delete the Otman5 reference.

Driver registry settings

The following table lists valid settings and their description for the driver's Start and
Type registry settings:
Value NameValue SettingDescription of Value Setting
Start0 = SERVICE_BOOT_STARTNtldr or Osloader preloads the driver so that it is in memory when the computer starts.

These drivers are initialized just before the SERVICE_SYSTEM_START drivers.
Start1 = SERVICE_SYSTEM_STARTThe driver loads and initializes after SERVICE_BOOT_START drivers have initialized.
Start2 = SERVICE_AUTO_STARTService Control Manager (SCM) starts the driver or service.
Start3 = SERVICE_DEMAND_STARTSCM must start the driver or service on demand.
Start4 = SERVICE_DISABLEDThe driver or service does not load or initialize.
Type1 = SERVICE_KERNEL_DRIVERDevice driver.
Type2 = SERVICE_FILE_SYSTEM_DRIVERKernel-mode file system driver.
Type8 = SERVICE_RECOGNIZER_DRIVERFile system recognizer driver.

References

For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

314743 How to enable verbose debug tracing in various drivers and subsystems
The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products

Comments

Post a Comment

Popular posts from this blog

altiris software key

-
Image
I think a lot of people, like me, spend a lot of time try finding how to get those download: Latest Symantec workspace Virtualization , SWV 6.1, that is advanced SVS version, is integrated with the Altiris client management suite CMS 7.  (Yes, it was also named "SVS PRO") Notice 1: This package includes the "Wise Virtual Composer", and both x86+x64 versions. Notice 2: This link currently also includes SWS (Streaming) and SWC (Corporate) [please vote my post if you use it ;-] Story : I was thinking only SVS 2.1 (Software Virtualization Solution) was integrated into the "Client Management Suite 7". But this is not the case and SWV 6.1 (Symantec Workspace Virtualization) must not be paid in addition . Free home license : Both SVS 2.1 "light" version & SWV are still free personal use. I suggest you use now the latest SWV 6.4 (That is SWV 6.1 SP7 or following! Yes Symantec do this version naming - vote here also to a...
Read more

Service Principal Names (SPNs) SetSPN Syntax (Setspn.exe)

-
Image
Service Principal Names (SPNs) SetSPN Syntax (Setspn.exe) Table of Contents SPN Purpose SPN Format SetSPN Viewing or Checking SPN Registrations SPN Registration Errors Related to SPN Registration or Configuration Manually Registering SPNs Troubleshooting SPN Issues Resolving SPN Registration Issues SPN Lookup Errors Delegation External Articles SPN Purpose A service principal name (SPN) is the name by which a Kerberos client uniquely identifies an instance of a service for a given Kerberos target computer. If you install multiple instances of a service on computers throughout a forest, each instance must have its own SPN. A given service instance can have multiple SPNs if there are multiple names that clients might use for authentication. For example, an SPN always includes the name of the host computer on which the service instance is running, so a service instance might register an SPN for each name or alias of its host. ↑  Return to T...
Read more

Troubleshooting Netlogon Error Codes

-
Image
Quick Reference: Troubleshooting Netlogon Error Codes ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ January 28, 2013   by  Mark Morowczynski [MSFT]   //   24 Comments 0 0 Hi this is Brandon Wilson and today I will be providing you with a quick reference for troubleshooting Netlogon error codes. I say “quick reference” very loosely here, because this is one of those sticky subjects that can easily expand into many more areas and become a very long discussion. So, I’m going to do my best to focus on just the codes and possible solutions for the error codes that are more common to see. Anyone who has dealt with some of these issues knows that some of these outlined areas can lead to huge revenue loss for a business, or at the very least an annoying authentication prompt J I welcome you to leave comments and questions, or suggestions for articles that you as the reader would be interested in seeing us do on AskPFE Platforms ( http://blogs.tech...
Read more