- May 7, 2013
- 10,400
In most cases, a Stop 0x7B is due to a failing hard drive or some issue with the disk controller. There is often very little to debug apart from running some hard drive diagnostic tests, checking for cable issues (if using SATA) and making sure the disk controller settings in the BIOS are set correctly. However, there is a circumstance, whereby deleting a legacy filter driver can actually lead to this bugcheck being thrown.
When you remove a service without deleting the associated filter driver first then the system will bugcheck with Stop 0x7B on a reboot. In our example. the user had removed a DiskKeeper service but did not check or remove the filter driver for this service, which in our case was tcesd and DKDFM.
Here’s the registry key for the filter driver:
Now, to remove these services and the filter drivers, you can use the following script with FRST64 otherwise you can enter the commands sequentially from an administrative command prompt.
Notice we aren’t deleting the entire subkey or the value, we’re just modifying it so it omits the problematic filter drivers. Once the user rebooted their machine, they no longer had any Stop 0x7B bugchecks but it did turn they out a faulty RAM stick. This was removed and the user no longer had any other crashes.
References:
Deactivate the kernel mode filter driver - Windows Server
Thread: [SOLVED] - Constant BSOD after upgrading from win 7 to win 10. FIX: I removed condusiv software and ran the RAM at stock settings.
When you remove a service without deleting the associated filter driver first then the system will bugcheck with Stop 0x7B on a reboot. In our example. the user had removed a DiskKeeper service but did not check or remove the filter driver for this service, which in our case was tcesd and DKDFM.
Here’s the registry key for the filter driver:
Rich (BB code):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}]
"UpperFilters"="tcesd
DKDFM
partmgr
fltsrv"Now, to remove these services and the filter drivers, you can use the following script with FRST64 otherwise you can enter the commands sequentially from an administrative command prompt.
Code:
cmd: sc stop DKDFM
cmd: sc config DKDFM start= disabled
cmd: sc stop tcesd
cmd: sc config tcesd start= disabled
Reg: reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} /v UpperFilters /t REG_MULTI_SZ /d partmgr\0fltsrv\0 /f
Reg: reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318} /v UpperFilters
Reg: reg add HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Filters\{4d36e967-e325-11ce-bfc1-08002be10318} /v UpperFilters /t REG_MULTI_SZ /d partmgr\0fltsrv\0 /f
Reg: reg query HKEY_LOCAL_MACHINE\SYSTEM\Setup\FirstBoot\Filters\{4d36e967-e325-11ce-bfc1-08002be10318} /v UpperFilters
cmd: sc delete DKDFM
cmd: sc delete tcesdNotice we aren’t deleting the entire subkey or the value, we’re just modifying it so it omits the problematic filter drivers. Once the user rebooted their machine, they no longer had any Stop 0x7B bugchecks but it did turn they out a faulty RAM stick. This was removed and the user no longer had any other crashes.
References:
Deactivate the kernel mode filter driver - Windows Server
Thread: [SOLVED] - Constant BSOD after upgrading from win 7 to win 10. FIX: I removed condusiv software and ran the RAM at stock settings.