Manage third-party filter drivers for post-SP2 updates

Please let us know how useful you find this tip by rating it below. Do you have a useful Windows tip, timesaver or workaround to share? Submit it to our tip contest and you could win a prize!

Windows has a special class of system device drivers called filter drivers that are used to intercept requests for I/O. For instance, a filter driver could be written to intercept file system requests and look for suspicious activity. Most antivirus products or low-level disk utilities (such as Diskeeper Corp.'s Diskeeper defragmenter) use some kind of filter driver in this manner.

Most filter drivers are well-behaved if they're written in accordance with Microsoft's own standards for how a filter driver should work. Unfortunately, some aren't written that well and can cause problems with post-Service Pack 2 updates because of slight changes in how I/O is handled in Service Pack 2. If a user attempts to add a post-SP2 update in a system with a problematic filter driver, the system hangs.

Microsoft identified this as a problem in Knowledge Base article 885894, and it has a recommended fix for it as well:

• Reboot and open Add / Remove Programs in the Control Panel. Check the "Show Updates" box to show updates as well as applications.
• Remove any update you tried to install, but which caused the system to hang.
• Download this update, which is a post-Service Pack 2 fix for Windows Installer.
• Reboot and reinstall the problematic update.

In addition to antivirus or disk-management products, other types of programs that use filter drivers include backup and recovery software, systems management tools, and even some types of malware (which may use filter drivers to conceal their presence from the operating system). If you are concerned that a filter driver might have been installed by a piece of malware, you may want to investigate using Sysinternals' ootkitRevealer.