[RESOLVED] ogtzckdw failed to register with Filter Manager

[shazbot]

I've been trying to troubleshoot some sporadic crashing on a PC, and the event log is filled with notices saying "File System Manager ogtzckdw failed to register with Filter Manager". Looking around online, it seems to indicate something having to do with a bad driver, but I don't see any anomalies in Device Manager. Additionally, the owner complained that the built-in five-in-one card reader doesn't seem to be working anymore, but unplugging it from the motherboard failed to resolve the error log issue.

Am I going about this the wrong way, i.e. do I need to unplug the device and then remove something from the registry? Or is there something else I should be looking into that I'm completely missing?

[Midknyte]

What version of Win7? 32 or 64 bit?

Can you post a screenshot of the event log error? It might help to see stuff like Event ID.

What AV is that system running?

[shazbot]

It's a Win7 Home Premium 64-bit system that had webroot secureanywhere loaded, but not running. I uninstalled it earlier, but am still seeing those same messages.

Here's a shot of the event log, with one of the recurring waring messages open:



eventlog.jpg

[Midknyte]

How did you uninstall it? Did you use something like Revo?

That error seems related to things like Kaspersky and Secunia, so it's possible that webroot is causing it.

[shazbot]

I removed it with it's own uninstaller, but I haven't run any additional removal agents for it. I'll see if I can find any to run on it...

[Midknyte]

Webroot - Trouble Installing or Uninstalling?

[shazbot]

I was mistaken before; webroot only appeared to be uninstalled after running the uninstaller, but reappeared afterwards. I ran the removal tool in normal and Safe Mode, but no luck there.

Is a third-party uninstaller like Revo the way to go, then?

[Midknyte]

You can give Revo a try.

Did you deactivate that system from Webroot?
https://community.webroot.com/t5/Web...list/td-p/9198

[shazbot]

Revo seems to have done the trick.

The problem remains, though. I found an entry for it in the registry:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_OGTZCKDW


Is this something I can just remove?

[Midknyte]

It's not in the current control set, but you could give it a shot.

Make a backup of the registry first, then delete that key.

[shazbot]

No good. Says there's an error whenever I try to delete it, or any of its subfolders. I can't even change any of the values within the entries.

[Midknyte]

Hmm. And this is an administrator, right?

Not a lot to go on with OGTZCKDW. It seems like a random name.

http://msdn.microsoft.com/en-us/libr...=vs.85%29.aspx
You could try settings AttachWhenLoaded to 0 and reboot.

Did you run an AV and Antimalware scan recently?

[shazbot]

No change even after changing that value for the Filter Manager.

I did run a Malwarebytes scan that found and disabled a number of minor items, but still no luck with the error messages.

[Midknyte]

Did you try the Webroot cleanup tool? I know you already used Revo.
Webroot - Trouble Installing or Uninstalling?

Running out of ideas here.

[shazbot]

I did, but no luck removing the message.

I'm out of ideas myself, but at the same time, the crashing seems to have abated. I do wonder why the system messages keep appearing, but I was mainly interested in them because they seemed to be tied to the crashing. With no crashing and no errors showing up on the drive itself, I'm tempted to just let this one go.