This article describes how to deactivate the kernel mode
filter driver without removing the corresponding software. You may want to deactivate the filter driver when you are troubleshooting the following issues:
When you are troubleshooting any one of these issues, frequently, you have to do more than just stop or
disable the services that are associated with the software. Even if you disable the software component, the filter driver is still
loaded when you restart the computer. You may be forced to remove a software component
to find the cause of an issue. As an alternative to removing the software component, you can stop the relevant services and disable the corresponding filter
drivers in the registry. For example, if you prevent antivirus
software from scanning or filtering files on your computer, you must
also disable the corresponding filter drivers.
To disable filter drivers, you must first
identify third-party services and their corresponding filter drivers. After you do this, follow these steps.Warning
This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.Important
An antivirus program is designed to help protect your computer from viruses. You must not download or open files from sources that you do not trust, visit Web sites that you do not trust, or open e-mail attachments when your antivirus program is disabled.
For additional information about computer viruses, click the following article number to view the article in the Microsoft Knowledge Base:
Computer viruses: description, prevention, and recovery
- Stop all services that belong to the software package.
the Startup type to "Disabled." To do this, follow these steps:
- Click Start, click Control Panel, double-click
Administrative Tools, and then double-click Services.
- In the Details pane, right-click the service that you
want to configure, and then click Properties.
- On the General tab, click Disabled in the Startup type box.
- Set the Start registry key of the corresponding filter
drivers to 0x4. A value of 0x4 will disable the filter driver.To do this, follow these steps.
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
How to back up and restore the registry in Windows
- Start Registry Editor.
- Create a backup of the HKEY_LOCAL_MACHINE\System registry
- Locate, and then click the following registry subkey:
- Click the entry for the filter driver that you want to
- Double-click the Start registry setting, and then set it to a value
Note This registry entry typically has a value of 0x3.
- Restart the computer.
Most antivirus software uses filter drivers that work together with a service to scan for viruses. These filter
drivers are still loaded after the service is deactivated. These filter drivers scan files as they
are opened and closed on a hard disk. For troubleshooting purposes,
temporarily remove the antivirus software or contact the manufacturer of
the software to determine whether a newer version is available.
For additional information about how to disable antivirus software, click the following article number to view the article in the Microsoft Knowledge Base:
How to fully disable antivirus software from filtering files
Example of filter drivers
This section describes some of the typical filter driver names by product:
- Inoculan: INO_FLPY and INO_FLTR
- Norton: SYMEVENT, NAVAP, NAVEN, and NAVEX
- McAfee (NAI): NaiFiltr and NaiFsRec
- Trend Micro: Tmfilter.sys and Vsapint.sys
Driver registry settings
The following table
lists valid settings and their description for the driver's Start and
Type registry settings:
Collapse this tableExpand this table
|Value Name ||Value Setting ||Description of Value Setting|
|Start ||0 = SERVICE_BOOT_START||Ntldr or
Osloader preloads the driver so that it is in memory when the computer starts.
These drivers are initialized just before the SERVICE_SYSTEM_START drivers.
|Start || 1 = SERVICE_SYSTEM_START ||The driver loads
and initializes after SERVICE_BOOT_START drivers have initialized. |
|Start ||2 = SERVICE_AUTO_START || Service Control Manager (SCM) starts the
driver or service. |
|Start ||3 = SERVICE_DEMAND_START||SCM must start
the driver or service on demand.|
|Start ||4 = SERVICE_DISABLED||The driver or service
does not load or initialize. |
|Type ||1 = SERVICE_KERNEL_DRIVER|| Device
|Type || 2 = SERVICE_FILE_SYSTEM_DRIVER ||
Kernel-mode file system driver. |
|Type ||8 = SERVICE_RECOGNIZER_DRIVER || File system
recognizer driver. |
For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
How to enable verbose debug tracing in various drivers and subsystems
The third-party products that are discussed in this article are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.