[German]Recently I stumbled upon an Microsoft Answers forum post, where a user was reporting a system restore error 0xC000000D in Windows. Here are a few details and background insights.
Advertising
Within a German forum post, the user reported, that he could not use system restore snapshots, because restore fails with a message, that it wasn't successful. The user has published a screen shot of his event viewer, giving details about that issue.
The German text of the event entry has been mentioned also within this veeam.com forum thread:
Der Dateisystemfilter "wcifs" (Version 10.0, 2016-09-15T17:42:03.000000000Z) konnte keine Verbindung mit dem Volume "\Device\HarddiskVolumeShadowCopy39" herstellen. Der Filter hat einen nicht-standardmäßigen letzten Status "0xC000000D" zurückgegeben. Diese Bedingung sollte von diesem Filter und/oder den unterstützenden Anwendungen behandelt werden. Wenden Sie sich an den Hersteller, wenn diese Bedingung weiterhin besteht.
An English version of this error message has been published within this tenforums.com thread.
File System Filter 'wcifs' (Version 10.0, 2016-09-15T11:42:03.000000000Z) failed to attach to volume '\Device\HarddiskVolumeShadowCopy15'. The filter returned a non-standard final status of 0xC000000D. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor.
Here is a similar thread. The term wcifs stands for Windows Container Isolation File System, a service and and a filter driver. It's introduced (afaik) in Windows 10 Version 1511 (probably also available in Win 10 RTM) and starts automatically at system boot. The filter driver wcifs.sys file that is located in the %WinDir%\system32\drivers folder (see here). Microsoft has an article here, that explains that the Windows Container feature is designed to simplify the distribution and deployment of applications (anti virus software for instance).
Advertising
The error 0xC000000D warning
The warning mentioned above says, that the filter driver wcifs returns an unknown state (error 0xC000000D). Obviously the VSS (volume shadow service) writer wasn't able to write successful shadow copies used for system restore.
If it's not a bug, provided from Windows 10, my conclusion is: There is an other filter driver hooked into the filter driver chain, that's causing this conflict. So my recommendation is, to open an administrative command prompt windows (see Windows 10: Open command prompt window as administrator) and enter the command:
fltmc filters
This enlists all filter drivers installed within the system (see also my blog post Windows 10: Error 0x80070057 from Cloudfogger). Then try to identify third party filter drivers that can cause this conflict.
In many cases, there are third party antivirus filter drivers hooked into the filter chain. The original screenshot posted from the German user showed an AVG logo within the taskbar's status area. In this case, try to uninstall the third party AV software and use a vendor's clean tool to remove settings, files and also filter drivers left from the uninstall process. Reboot your Windows machine and check, if the issue has been solved.
Similar articles:
Win10 Wiki
Windows 10: Error 0x80070057 from Cloudfogger
How to decode Windows errors?
Windows 10: Analyze upgrade errors
Windows: How to decode update 0x8024…. errors
Windows 10 Version 1607: System restore error 0x80070091 [Fix]
This seems to be an issue with a few people including myself.
Here's a link to where others, including me, are having the same issue.
https://www.tenforums.com/general-support/77514-file-system-filter-wcifs-event-id-4-a.html