Amsdk.sys "A driver cannot load on this device": how to fix it in Windows 11 and 10

Amsdk.sys is the kernel driver of the Zemana Anti-Malware SDK, used by Zemana AntiMalware and WatchDog Anti-Malware, and Windows blocks it because it is a known vulnerable driver. It is not an AMD file. Uninstall the program that put it there, or delete its leftover entry, and keep Memory integrity on.

Facts checked on 16 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What amsdk.sys is and what "A driver cannot load on this device" means

Amsdk.sys is the amsdk.sys driver of the Zemana Anti-Malware SDK, a kit that other security programs build on. Zemana AntiMalware uses it, and so does WatchDog Anti-Malware. The driver runs in the Windows kernel so the scanner can stop processes and read the disk directly. That deep access is why Windows checks it.

The window comes from Program Compatibility Assistant. It tells you that Windows Security refused to load amsdk because it matches a known vulnerable driver. Your PC is not broken: Windows did this on purpose, and nothing on the system needs this file to work.

Title

A driver cannot load on this device

Driver line

Driver: amsdk.sys

Reason line

A security setting is detecting this as a vulnerable driver and blocking it from loading. You'll need to adjust your settings to load this driver

Buttons

Learn more, Cancel and a box Don't show this message again

Which setting

Memory integrity and the Microsoft vulnerable driver blocklist in Windows Security, Core isolation

Why the amsdk.sys error appears, from most to least common

Most often Zemana AntiMalware or WatchDog Anti-Malware is still installed, sometimes from years ago, and its service asks for amsdk.sys at every start. Less often the program was removed but its driver service stayed behind. Rarely, and this is the case to take seriously, the file was dropped by something you never installed.

The same window can name other files from other makers. The approach on this page fits any of them, and our general guide to "A driver can't load on this device" covers how to find which program a driver belongs to.

How to fix the amsdk.sys "A driver cannot load on this device" error on Windows 11 and Windows 10

Start with Fix 1: most readers still have an old anti-malware tool that loads amsdk.sys. Fix 2 and Fix 3 are for a PC where no such program is installed. Fix 6 matters if you already followed advice to turn Memory integrity off. You need an administrator account.

Fix 1. Uninstall Zemana AntiMalware or WatchDog Anti-Malware

5 minutesLow riskEveryone who finds a Zemana or WatchDog entry in Installed apps and does not rely on it. This is most readers with the message.

The driver only tries to load because the program's service asks for it at startup. When the program is gone, nothing requests amsdk.sys and the window stops. Microsoft Defender keeps protecting the PC on its own.

1. Windows 11: open Settings > Apps > Installed apps. Windows 10: open Settings > Apps > Apps & features.
2. Type Zemana into the search box above the list, then type WatchDog.
3. Select ... next to the entry, for example Zemana AntiMalware, and choose Uninstall.
4. Accept the program's own uninstaller prompts.
5. Restart the PC and sign in again.

Fix 2. Find where amsdk.sys sits and scan it with Microsoft Defender

10 minutesNo riskReaders who see the message but have no Zemana or WatchDog program installed, or who are not sure where the file came from.

Where the file lives tells you what it is. A leftover from a real install sits in a program or driver folder. In the attacks Check Point described, the driver was placed in a Temp folder and started as a service, which a normal program never does.

1. Press Win + E to open File Explorer and select This PC.
2. Type amsdk.sys into the search box at the top right and wait for the search to finish.
3. Right-click each result, choose Open file location, and note the folder path.
4. Right-click the file, choose Properties, open the Details tab and read File description, Product name and File version.
5. Right-click the file again and choose Scan with Microsoft Defender (on Windows 11 first select Show more options).

If the file was in a Temp folder or Defender reports a threat, run a full scan and an offline scan: How to scan for malware with Microsoft Defender.

Fix 3. Remove the leftover amsdk driver entry with Autoruns

10 minutesRead the warningReaders who see the window although no Zemana or WatchDog program is installed any more.

Uninstallers sometimes leave the driver's service registered, so Windows tries to load amsdk.sys at every start and shows the window. Autoruns, a free Microsoft Sysinternals tool, lists every driver Windows tries to load and can delete that entry. Users on Microsoft's forum report this ended the message for them.

1. Download Autoruns from Microsoft's Sysinternals page on learn.microsoft.com and extract the ZIP file.
2. Right-click Autoruns64.exe, select Run as administrator, then Yes.
3. Open the Drivers tab and type amsdk into the filter box.
4. Check that the entry's image path ends in amsdk.sys and note the folder it points to.
5. Right-click that entry, select Delete and confirm.
6. Delete the amsdk.sys file itself from the folder you noted, if it is still there.
7. Restart the PC.

Fix 4. Install the current WatchDog Anti-Malware if you use it

10 minutesLow riskReaders who pay for WatchDog Anti-Malware and want to keep it running.

Microsoft's first advice for a blocked driver is an updated driver from the maker. After Check Point's report, WatchDog released a patched driver under a new name, wamsdk.sys, version 1.1.100. A current install should use that file instead of amsdk.sys.

1. Uninstall the old WatchDog Anti-Malware first (Fix 1), so the old amsdk.sys service is removed.
2. Download the current installer from WatchDog's own website, not from a download portal.
3. Install it and restart the PC.
4. Check whether the window still appears at sign-in.

We could not confirm whether Zemana AntiMalware itself still gets updates with a driver Windows accepts. If you rely on Zemana, the safest choice is to remove it and let Microsoft Defender protect the PC.

Fix 5. Stop the program from starting with Windows, or hide the notice

3 minutesNo riskReaders who want the window gone today and will remove the program later.

The window appears because something asks for the driver at sign-in. If the program does not start on its own, nothing asks. Protection stays on, and the driver stays blocked.

1. Windows 11: open Settings > Apps > Startup. Windows 10: open Task Manager with Ctrl + Shift + Esc and select the Startup tab.
2. Turn off the Zemana or WatchDog entry.
3. Restart and sign in.
4. If the window still appears once, tick Don't show this message again and select Cancel. That only hides the notice: amsdk.sys stays blocked.

Fix 6. If you turned Memory integrity off, switch it back on

5 minutes plus a restartLow riskReaders who followed older advice and turned Memory integrity or the vulnerable driver blocklist off to stop the message.

Microsoft names turning Memory integrity off as an option for a driver you need. Nobody needs amsdk.sys: it only serves a third-party scanner, and it has been abused to disable security software. With the driver removed, protection can go back on without any window.

1. Type Core isolation into the taskbar search box and open it. Windows 11 path: Settings > Privacy & security > Windows Security > Device security > Core isolation details. Windows 10: Settings > Update & Security > Windows Security > Device security > Core isolation details.
2. Set Memory integrity to On.
3. If the page shows a Microsoft Vulnerable Driver Blocklist switch, set it to On too.
4. Restart the PC.

Fix 7. Install Windows updates, including optional driver updates

10 to 30 minutesNo riskEveryone, after the fixes above, and readers whose PC is behind on updates.

Microsoft updates the vulnerable driver blocklist and Defender's detections through Windows Update. Updating does not make amsdk.sys load, but it keeps the protection current. Microsoft also lists Windows Update as the place to look for an updated driver.

1. Windows 11: open Settings > Windows Update and select Check for updates. Windows 10: Settings > Update & Security > Windows Update.
2. Install what is offered and restart.
3. Open Advanced options > Optional updates (Windows 10: View optional updates) and install any driver updates listed there.

The amsdk.sys window still appears: what to check and what to send

The window itself is the most direct log: it names the driver Windows blocked. Microsoft notes that the driver name and company name in the notification are the only reliable details it has about the driver. Read both before you remove anything.

• Core isolation lists incompatible drivers: select Review incompatible drivers to see each file and its published name. Remove the program that installed it.
• The window now names another file: the same approach applies to that file and its maker. A file such as atdcm64a.sys belongs to old AMD graphics software, not to Zemana.
• amsdk.sys returns after you deleted it: a program or a scheduled task puts it back. Run a full and an offline Defender scan (Fix 2).
• The Memory integrity switch is greyed out: an organisation manages the PC, or the processor does not support it. That is not caused by amsdk.sys.

Keep amsdk.sys and other vulnerable drivers from coming back

Microsoft updates the vulnerable driver blocklist through the monthly Windows updates, which is why the message can appear one day with no change on your side. Windows 10 left support on 14 October 2025, so a PC that stays on Windows 10 no longer gets those updates.

Frequently asked questions

What is amsdk.sys?

Amsdk.sys is a kernel mode driver from the Zemana Anti-Malware SDK, a kit that security programs build on. Zemana AntiMalware and WatchDog Anti-Malware ship it. It is not a Windows file, not an AMD file and not needed for Windows to run. Windows blocks it because it is a known vulnerable driver. If you find it with no such program installed, check where it sits and scan it (Fix 2).

Is amsdk.sys a virus?

The file from a real Zemana or WatchDog install is not a virus, but it is risky. In 2025 Check Point Research reported that attackers dropped the signed WatchDog amsdk.sys into a Temp folder to kill security software before installing a backdoor. So a copy you cannot explain, especially outside Program Files or System32\drivers, deserves a full Microsoft Defender scan: How to scan for malware with Microsoft Defender. While Windows keeps blocking it, the driver cannot run.

Why does the amsdk sys driver cannot load message appear after a Windows update?

Windows updates bring a newer vulnerable driver blocklist and sometimes switch Memory integrity on, for example with a feature update such as 24H2. A driver that loaded quietly for years is then refused, and Windows shows the window at sign-in. The update did not break anything. It started protecting you from a driver that was already on the PC.

What does "A security setting is preventing this driver from loading" mean?

It means Memory integrity, part of Core isolation in Windows Security, or the Microsoft vulnerable driver blocklist refused the driver. The exact window says "A security setting is detecting this as a vulnerable driver and blocking it from loading." Microsoft says such a driver is most likely not malicious but has a vulnerability. For amsdk.sys the right response is to remove it, not to adjust the setting.

Is there an amsdk sys driver update for Windows 11?

Not as a separate download. The driver comes inside the anti-malware program. WatchDog released a patched driver named wamsdk.sys, version 1.1.100, so the current WatchDog installer is the way to get it (Fix 4). We could not confirm a fixed driver for Zemana AntiMalware. Never download amsdk.sys from a file site: that is exactly the kind of copy attackers use.

Should I just turn Memory integrity off?

No. Memory integrity keeps malicious code out of the most protected part of Windows, and amsdk.sys has been used in real attacks to switch off security software. Removing the program takes five minutes and keeps both your PC and the protection. If you already turned it off, switch it back on with Fix 6.

Will ticking "Don't show this message again" fix it?

It hides the window but fixes nothing. Amsdk.sys stays blocked, so the anti-malware program's real-time protection that needs it will not work. If you do not use that program, uninstalling it (Fix 1) is cleaner than hiding the notice, because a program that cannot protect you only gives a false sense of safety.

Is this the same as atdcm64a.sys driver cannot load?

It is the same window but a different driver. Atdcm64a.sys belongs to old AMD graphics software, not to the Zemana SDK, and Windows blocks it as vulnerable for its own reasons. The method is the same idea: find the program that installed it, update or remove it, and keep Memory integrity on. The general guide linked under Why it appears walks through any file name.

I see "A driver cannot load on this device" for AMD Ryzen Master. Is that amsdk.sys?

No. AMD Ryzen Master uses its own driver, AMDRyzenMasterDriver.sys, and the window names that file instead. People search both together because many sites wrongly tie amsdk.sys to AMD. For Ryzen Master, install the current version from AMD's website or uninstall it if you do not tune the processor, then restart and keep Memory integrity on.

Can I delete amsdk.sys?

Yes, once the program that uses it is removed. Windows and your hardware do not need it. Remove the driver's service entry first with Autoruns (Fix 3), then delete the file, and back up the registry beforehand: Back up the registry before editing it. Deleting only the file while the service stays registered can leave an error at startup.