Event log Warning Event id 4 for filtermanager caused by CFRMD[V6]

Comodo Internet Security - CIS Resolved/Outdated Issues - CIS
#1

windows 7 system log warning event id 4 filtermanager caused by CFRMD is appearing every few minutes after installing the latest CIS. It goes through all of my storage devices. For example:

File System Filter ‘CFRMD’ (Version 6.1, ‎2012‎-‎07‎-‎17T01:05:30.000000000Z) failed to attach to volume ‘\Device\Harddisk0\DR0’. The filter returned a non-standard final status of 0xc01c0016. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor.

File System Filter ‘CFRMD’ (Version 6.1, ‎2012‎-‎07‎-‎17T01:05:30.000000000Z) failed to attach to volume ‘\Device\CdRom0’. The filter returned a non-standard final status of 0xc01c0016. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor.

This is occurring on a Hp Pavilion a1740n with latest bios, 2.66 dual core 2, 4GB DDR2, 1TB Intel mirrored HD, Windows 7 Professional 32 bit, nvidia 9600GSO 768MB. No items noted by sfc /scannow. Other than pinning this to Comodo, Google found no other directly relevant solutions.

When CIS is removed the problem goes away. Reinstall and it comes back. No other errors in system log.

Suggestions? Thanks

#2

Additional note: this program is disabled on a windows 7 64 bit amd system.

#3

Can someone respond to this person’s question. I am experiencing the same error message

#4

Have identical log readings with vista sp2. System also freezes. No choice but to shut it off, not shutdown, and start over. SFC and CHKDSK say system ok. Remove cis 2013 all ok. Tried twice. Please, we need help from Comodo engineers or a forum member with way more knowledge than I. ASAP!!!

THANKS IN ADVANCE

#5

Very sorry that you are experiencing this problem. If someone can do a bug report, I’ll do my best to help.

We’ll need the info in the report to fix the problem and to help you.

In this case can you mention which Comodo Utilities you are running if any, with exact versions, as I think this driver may belong to one of these not CIS.

Best wishes

Mouse

Thank you very much for your issue report.

We would very much appreciate it if you would be kind enough to edit your report to put it in the standard format and add any additional information requested, as this will make it much easier for the developers to diagnose and fix the problem.

The reasons we need all the information in the format, though they may not seem directly relevant to the issue are explained here.

If you are able to do this we will forward this post to the format verified board, where it is more likely to get looked at by developers. You can find assistance using red links in the format and here. If you need further help please ask a mod. If you do not add the information after a day or two we will forward this post to the non-format board. If this happens we will tell you how to rectify this if you wish to.

In the current process we will normally leave it up to you whether you want to make a report in standard format or not. However we may remind you if we think a bug of particular importance.

Many thanks again

Mouse

#6

PM reminder sent

#7

Thanks very much for your issue report, which is much appreciated.

We have moved it to the non-format bugs board for the moment, because it is not in the standard format or too much of the information we normally need to replicate a problem and fix it is still missing.

We realize some people may not have the time to do an issue report in standard format, and therefore offer the option of a non-format report instead. But the problem is much more likely to be fixed promptly if you edit your first post to create an issue report which reflects the guidance in the Standard Format topic. (You can copy and paste the format from this topic). The reasons we ask for the information we do are given in this post.

You can get your report moved to the format verified issues board simply by ensuring that it reflects the guidance in the standard format topic, and PM’ing a mod who is active on the bug board.

Best wishes

Mouse

#8

Please advise how to produce the report that you are referring to, as well as specifically where you wish for it to be sent and I will gladly provide my report to you.

Thanks

#9

Thank you Kama, much appreciated. If you follow the red links in the above post all should be explained. You can post the report in this topic.

Best wishes

Mouse

#10

Hi, I am having the same problem but see no solution to the problem. Is this still being looked at?

I am running Windows 8 Pro.

Thanks

Keith

#11

A. THE BUG/ISSUE (Varies from issue to issue)
[ol]- Summary - Give a clear summary in the topic subject, NOT here.

  • Can U reproduce the problem & if so how reliably?:
  • If U can, exact steps to reproduce. If not, exactly what U did & what happened:
  • If not obvious, what U expected to happen:
  • If a software compatibility problem have U tried the conflict FAQ?:
  • Any software except CIS/OS involved? If so - name, & exact version:
  • Any other information, eg your guess at the cause, how U tried to fix it etc:
  • Always attach - Diagnostics file, Watch Activity process list, dump if freeze/crash. (If complex - CIS logs & config, screenshots, video, zipped program - not m’ware)
    [/ol]

B. YOUR SETUP (Likely the same for each issue, so you can copy forward)
[ol]- Exact CIS version & configuration:

  • Modules enabled & level. D+/HIPS, Autosandbox/BBlocker, Firewall, & AV:
  • Have U made any other changes to the default config? (egs here.):
  • Have U updated (without uninstall) from a CIS 5?:
    [li]if so, have U tried a a clean reinstall - if not please do?:
    [/li]- Have U imported a config from a previous version of CIS:
    [li]if so, have U tried a standard config - if not please do:
    [/li]- OS version, SP, 32/64 bit, UAC setting, account type, V.Machine used:
  • Other security/s’box software a) currently installed b) installed since OS: a= b=
    [/ol]

Win 7 Professional
NL

Same error
partly in Dutch below

I have these errors in pairs with the same date and time

I have these errors in every 1 or 2 minutes

The first of these errors occurred for the first time
on 12-6-2013 10:06:11 12 of june
after a (major?) Windows Update.
when the computer was restarted / rebooted

I cannot relate these errors to any recognizable faulty behavior of my laptop

  • Don’t know if relevant, but
    just before restart after the above mentioned Windows Update there was an error:
    De service Group Policy Client is niet juist afgesloten na de ontvangst van een besturingselement voor afsluiten

The service Group Policy Client is not closed/ … in the correct way after receiving a ‘besturingselement voor afsluiten’
/ order to close down ?

Did Comodo or Microsoft perhaps inadvertently change permissions of CFRMD.sys ?

I looked at the current permissions of CFRMD.sys
in c:\Windows\System32\drivers\

Names of Groups and Users

SYSTEM
Administrators
Gebruikers (means Users in Dutch)

Many other files in c:\Windows\System32\drivers
also have TrustedInstaller listed

Is CFRMD.sys
also supposed to have TrustedInstaller listed with permissions ?

  • I’m next also going to check my Seagate disk with Seatools etc.
    Seagate
    ST95005620AS
    and check for new firmware

Are other people using same disk ?

Logboeknaam: System
Bron: Microsoft-Windows-FilterManager
Datum: 15-6-2013 21:44:24
Gebeurtenis-id:4
Taakcategorie: Geen
Niveau: Waarschuwing
Trefwoorden:
Gebruiker: Med… < Took the rest out, don’t know if it’s too unique and revealing>
Computer: Med < Took the rest out, don’t know if it’s too unique and revealing>
Beschrijving:
Kan bestandssysteemfilter ‘CFRMD’ (versie 6.1, ‎2012‎-‎07‎-‎17T07:05:30.000000000Z) niet aan volume ‘\Device\Harddisk0\DR0’ koppelen. Een ongebruikelijke uiteindelijke status 0xc01c0016 is geretourneerd. Dit filter en/of de bijbehorende toepassingen moeten deze toestand kunnen verwerken. Neem contact op met het leverancier als de toestand zich blijft voordoen.
Gebeurtenis-XML:



4
0
3
0
0
0x8000000000000000

83769


System
Medlap



0xc01c0016
6
1
5
CFRMD
2012-07-17T07:05:30.000000000Z
21
\Device\Harddisk0\DR0

#12

Please put your post in the format supplied in this post. If your post is not in this format then this bug report cannot be forwarded to the devs.

Note that bug reports in this section of the forum are not being considered by Comodo devs. In order to bring this bug to their attention we need a bug report in the format provided in my above link.

Thank you.

#13

@Chiron

I’m not that computer-english litterate.
I do not comprehend the format in that post.
I see a listing of many posts.
Which has the right format?

I suggest you create a form which I can fill.

And for questions like CIS version: and OS version:

Create an export in plain text file within Comodo software which
finds / reports CIS version: and OS version and perhaps more.

#14

No problem, I can help you to fill out the correct format.

I pasted in the correct code into your previous code. What I need you to do is put in your information after the : on each line. If you have any questions about what any of the lines are asking for please feel free to ask.

Please send me a PM when you have filled out the bug report using the above format.

Thank you.

#15

Can you please check and see if this is fixed with the newest version (version 6.2.282872.2847)? Please let us know whether it is fixed or you are still experiencing the problem.

Also, note that all bug reports in the Non-Format section of the forum, which is where this report currently is, are not looked at by the devs. Thus, if the bug you were experiencing is still not fixed please edit your first post so that it is in the correct format (found here, with all required attachments, so I can forward this to the devs and get this problem fixed.

Thank you. PM sent.

#16

Can you please check and see if this is fixed with the newest version (version 6.3.294583.2937)? Please let us know whether it is fixed or you are still experiencing the problem.

Also, note that all bug reports in the Non-Format section of the forum, which is where this report currently is, are mainly not looked at by the devs. Thus, if the bug you were experiencing is still not fixed please edit your first post so that it is in the correct format (found here, with all required attachments), so I can forward this to the devs and get this problem fixed.

Thank you.

PM sent.

#17

My OS is Windows 7 Home Advanced SP1 x64 (Russian).
Evening November 20th, I have changed Comodo Firewall 5.9 for Comodo Firewall 6.3 (now its version is 6.3.302093.2976). After that, each start of PC is followed by error messages in system log, which are start from the words
“File System Filter ‘CFRMD’ … failed to attach to volume ‘\Device\Harddisk0\DR0’…”(these messages are mostly the same as at the top of this theme; I do not repeat them as they are written in Russian). These messages concern all existing volumes.
I have knew about these mistakes only today, because they have no evident effect on work of my PC.

#18

Please try reinstalling CIS by following the advice I give in this topic:

and let me know if that is able to solve the problem.

If it is not we will continue from there. Thank you.

#19

I followed the procedure (all Avast! Antivirus Free screens were disabled, Comodo Firewall was disabled and uninstalled by the standard way, after reboot the special utility was used at all the points), and at the finish I removed some folders/files and many registry lines manually (all that were permitted by the system).
After that, the last version of Comodo Firewall was installed (while all Avast! Antivirus Free screens were disabled), PC was rebooted, and I got the same error logs that I saw before. Alas.
Thank you for attention and happy New Year!

#20

In that case please edit your first post in this topic so that it is in the format provided in this post:
https://forums.comodo.com/bug-reports-cis/new-format-draft-do-not-use-yet-being-updated-t90436.0.html;msg651613#msg651613
Just copy and paste the code. Then put your responses after the colons.

Let me know if you have any questions.

Thank you.