Several machines becomes unresponsive or freezes after MS Windows 10 KB4535996 Update.
This article provides details of the issue and workaround options to resolve it.
Root Cause
- Windows Defender cannot recognize the WFBS-SVC agent as AV defender properly so it tries to lock a file when the WFBS-SVC agent wants to open and scan it which will cause the interop issue. At this time, it is determined that this issue may be related to Windows patch KB4535996.
- tmxpflt had interop with Windows Defender from the memory dump.
Workaround
While some users have experienced problems trying to uninstall KB4535996, these are the steps that you need to follow:
- In Windows Desktop Search, type update history then click View your Update history.
- Select Uninstall Updates.
- On the Installed Updates dialog window, find and select KB4535996, click Uninstall.
- Restart.
You can also download Windows Update troubleshooter, which will enable you to block KB4535996 proactively / stop it from reinstalling.
- Turn off the machine.
- Turn on the machine and enter in safe mode.
- Open the command with admin permission.
-
Enter the following commands:
- "sc config WdFilter start=disabled"
- "sc stop WdFilter"
- Reboot the machine.
- Tap on the Windows-key to open the Start Menu.
- Type regedit.exe and hit Enter.
- Confirm the UAC prompt to continue.
-
Navigate to the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
- If you see the preference DisableAntiSpyware on the right, double-click on it and set it to "1" to disable Windows Defender.
- If the preference does not exist, right-click on Windows Defender and select New > Dword (32-bit) Value, and name it DisableAntiSpyware. Once "DisableAntiSpyware" is created, double-click and make sure the value is set to "1".
- Restart the PC.