Driver Verifier – how dangerous is it?

Topic

New Reply

My machine is to the point where I’m ready to do a fresh install of Windows 10 because lately I’m getting spurious BSODs. WhoCrashed usually indicates that the problem is “probably” a driver but never can say which one. So, I’m ready to run Driver Verifier and see if I can force a crash after having created a restore point. Reading a Microsoft blog entry about Driver Verifier, the blogger says that sometimes the machine can crash before you’re able to log into Windows. My machine isn’t that unstable; the BSOD usually happens when I’m doing something involving codecs (like using Virtual Dub or Memories on TV) but not always; I can use these two programs most of the time without any issues.

Has anyone ever used this tool and gotten himself/herself into a situation where the machine was so hosed you couldn’t even log into it afterwards?

I realize this is a hypothetical question but I’m not in the mood to brick my machine just yet and I see that Driver Verifier has been recommended in the past so I thought I’d take advantage of your experience.

Rob

Reply | Quote

Replies

Try BlueScreenView – I’ve found that to be a bit more informative, but Win 10 has its own Blue Screen trouble shooter.

Go Start – type blue then click on the trouble shooter when it comes up.

This is for BlueScreenView – http://www.nirsoft.net/utils/blue_screen_view.html

Reply | Quote

Sudo: Thanks; I also have the Nirsoft program. It might tell someone who knows how to read Windows dumps what’s wrong but for the BSODs I’ve been having neither it nor WhoCrashed can pinpoint the error; both just tell me it occurred in ntoskrnl.exe or ntkrnlmp.exe. I don’t see a blue screen troubleshooter on my system. Maybe it’s something you get as part of the Insider Program?

Rob

Reply | Quote

No – I free upgraded this one within the time frame.

I’ve turned off Cortana so now that is just Search Windows but before I just used to type in what I wanted and up it would pop for me to click on or press enter.

Go to Control Panel/All Control Panel Items/Troubleshooting/View all and you should see it at the top of the list of trouble shooters.

If you post your BSV report I’ll get Satrow to have a look at it.

Reply | Quote

If you post your BSV report I’ll get Satrow to have a look at it.

I’d much prefer to have more data to work from, the BSOD collection app. here makes a fine job of collecting it, attach the zipped folder here and I’ll take a look at it.

DV can be dangerous – really only if you don’t have a Restore Point or an alt. method of reverting, the instructions here should ensure you’re safe if you use it, the results from a verified crash dump can save a lot of time.

Reply | Quote

I’d much prefer to have more data to work from, the BSOD collection app. here makes a fine job of collecting it, attach the zipped folder here and I’ll take a look at it.

DV can be dangerous – really only if you don’t have a Restore Point or an alt. method of reverting, the instructions here should ensure you’re safe if you use it, the results from a verified crash dump can save a lot of time.

Satrow: Thank you for your kind offer. I’ll download the BSOD collection app and see what needs to be done. For now, I’ve enlarged the size of the page file to match my memory size (32GB which I need like a hole in the head) so the entire dump can be captured and I’m running the kinds of programs that seemed to cause the problem (mostly Virtual Dub). So far, no crashes. I’ll use Driver Verifier as a last resort.

Rob

Reply | Quote

I’d much prefer to have more data to work from, the BSOD collection app. here makes a fine job of collecting it, attach the zipped folder here and I’ll take a look at it.

DV can be dangerous – really only if you don’t have a Restore Point or an alt. method of reverting, the instructions here should ensure you’re safe if you use it, the results from a verified crash dump can save a lot of time.

Satrow: I got my BSOD but no thanks to Driver Verifier. The machine crashed with a SYSTEM SERVICE EXCEPTION error. I got a minidump but for some reason no memory dump. In any case, I used the Sysnative tool to collect the crash data and I’ll upload it if you want to take a look at it.

The crash happened while I was creating a slideshow with “Memories on TV”; I was not burning a DVD; just creating a disk image. This crash has happened at least a few times while running this program. I contacted the vendor (the program hasn’t been updated in years) they don’t have any record of this being a problem with their product.

Reply | Quote

Satrow: Just FYI, I took a stab at Driver Verifier tonight. Upon rebooting, the machine immediately crashed; I booted off of my Win10 DVD and restored back to the restore point I took just prior to enabling Verifier.

Both WhoCashed and Nirsoft’s BlueScreenView point to mozy.sys so I’ve opened a support ticket with Mozy. I thought perhaps I’d download the latest version of their software and install it but the version on my machine is newer than what you can download.

Rob

Reply | Quote

When you get that, you would uninstall first and then download – http://support.mozy.co.uk/articles/en_US/FAQ/Clean-uninstall-reinstall-of-Mozy-on-Windows

I prefer my back ups to be on terra firma in external HDDs.

What antivirus program are you using as that could be playing a part in this.

Reply | Quote

When you get that, you would uninstall first and then download – http://support.mozy.co.uk/articles/en_US/FAQ/Clean-uninstall-reinstall-of-Mozy-on-Windows

I prefer my back ups to be on terra firma in external HDDs.

What antivirus program are you using as that could be playing a part in this.

Sudo: I’m using Windows Defender and Malwarebytes Anti-malware (commercial version). Thanks for the link; I was on Mozy’s web site last night and the only version of the client software I can find (including your link) is a version older than what I’m already running. I’ll wait to see if they respond to my problem ticket.

As far as backups go, I use both Mozy (well, maybe not for long if they can’t fix this) and NovaBACKUP for my terra-firma backup to an external HDD. I’m a belt-and-suspenders type when it comes to backups; must be because I’m an old mainframe guy.

Rob

Reply | Quote

I just use and always have, used Windows own system image and only ever had one fail, but use more than one external HDD as a fall back.

The older version that is available would probably generate prompts for updates, but would have thought their newer version would have been available as a direct download, unless that is their starter version.

When you install an OS – they don’t come with the latest updates.

Does the program have a check for updates facility ?

Reply | Quote

I just use and always have, used Windows own system image and only ever had one fail, but use more than one external HDD as a fall back.

The older version that is available would probably generate prompts for updates, but would have thought their newer version would have been available as a direct download, unless that is their starter version.

When you install an OS – they don’t come with the latest updates.

Does the program have a check for updates facility ?

I should probably spend some time learning about Windows’ built-in backup. I used to use NTBACKUP a million years ago; I liked its flexibility. When Microsoft removed the ability to run their backup tool to backup files at the file level (not a disk image) I went to third-party products. Having said that…I did hear back from Mozy; they want me to install a backleveled version of the program (was sent a direct link to the file) so I’ll try that. The program does have a “check for updates” facility and I don’t believe you can shut it off but it does prompt you to update the program and you can dismiss the prompt without updating.

Rob

Reply | Quote

I’ve never used Windows Backup for file level – they go onto USB sticks.

You may get the same error if you try to install that on top of your current version, so best to uninstall first.

Reply | Quote

I’ve never used Windows Backup for file level – they go onto USB sticks.

You may get the same error if you try to install that on top of your current version, so best to uninstall first.

Ugh. The plot thickens. After uninstalling Mozy, I rebooted with Driver Verifier. This time, it complained about a Virtual Box network driver during reboot, so I did my system restore, uninstalled Virtual Box, set up Driver Verifier again and rebooted. This time, it complained about my Intel video driver during reboot. At this point I’m thinking that all of my drivers can’t be having problems. The way I was setting up Driver Verifier was from a Microsoft blog that tells you to check-off every test except for DDI compliance checking and randomized low-resource simulation. A blog entry on tenforums tells you to only check I/O verification, force pending I/O requests and IRP logging. I set-up DV with just those seetings, rebooted. No problems. I then referenced a blog from another thread on this site (Sysnative) which has you checking-off these tests:

Special Pool
▪ Force IRQL checking
▪ Pool Tracking
▪ Deadlock Detection
▪ Security Checks (new as of Windows 7)
▪ Miscellaneous Checks
▪ Power framework delay fuzzing (new as of Windows 8)
▪ DDI compliance checking (new as of Windows 8)

I set up another DV test with those settings, rebooted, and no issues so far. My next step will be to reinstall Mozy and Virtual Box which may have been victims of too-aggressive testing with Driver Verifier (if that’s even possible).

Nothing’s easy any more.

Reply | Quote

It sounds like you opened a can of worms 😀 – but don’t forget, BSV and WC snagged Mozy for your BSOD so something must have been conflicting.

Reply | Quote

It sounds like you opened a can of worms 😀 – but don’t forget, BSV and WC snagged Mozy for your BSOD so something must have been conflicting.

Only because DV (with possible over enthusiastic settings) flagged it to call the crash.

DV would not normally crash immediately on reboot, it usually takes some hours, maybe as much as 24 – 36 (much more than that gets into the false positive realms) to lean on and flush out a bad driver.

Reply | Quote

Only because DV (with possible over enthusiastic settings) flagged it to call the crash.

DV would not normally crash immediately on reboot, it usually takes some hours, maybe as much as 24 – 36 (much more than that gets into the false positive realms) to lean on and flush out a bad driver.

Satrow: Can the settings be “over enthusiastic”? Trolling the Web, you find all sorts of advice on how to use it. When I set it up according to the Microsoft blog (all tests checked except for DDI compliance (which is weird…I’d think you’d want that) and low-resource utilization, my machine BSOD’d immediately on rebooting…each time it did it, I removed the software associated with the driver (first Mozy, then Virtual Box). The third time, when it flagged my Intel video driver, I rethought the whole thing because the Intel driver is the only one available for this motherboard.

Currently reinstalling Mozy, then I’ll reinstall Virtual Box…then I’ll restart DV using a combination of settings I found from two different sites and let it cook. Then, if all else fails, I’ll upload the files for review if I can stop myself from throwing this computer off a bridge.

😉

Rob

Reply | Quote

DV may have produced Mozy but the BSODs were occurring before DV was used going by the opening post, but BSV should have listed all BSODs, but if it’s only listing Mozy, then perhaps that’s where the conflict it is.

Probably better if OMG uses that BSOD kit and uploads the dump file for your examination.

Reply | Quote

Using the Sysnative DV settings is probably the best, Rob.

Reply | Quote

Using the Sysnative DV settings is probably the best, Rob.

Then that’s what I shall do!

Thanks.

Reply | Quote

Rob, it’s looking like it’s (mostly) a problem with the graphics subsystem. I’d seek out and install the latest Intel WHQL graphics drivers to begin with – though they may not be the best, sometimes an earlier version is more stable. The current driver, igdkmd64.sys, is from from April.

The BSOD type was a 0x3B (usually System service, Device driver, graphics driver), the last 2 verified BSODs were also graphics related (1 Intel, 1 W10 base graphics), the last of the pre-DV crashes was also a 0x3B.

Code:

 *******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8000274f800, Address of the instruction which caused the bugcheck
Arg3: ffff8801cfa56c20, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  14393.447.amd64fre.rs1_release_inmarket.161102-0100

SYSTEM_MANUFACTURER:                                   

SYSTEM_PRODUCT_NAME:                                   

SYSTEM_SKU:  To be filled by O.E.M.

SYSTEM_VERSION:                                   

BIOS_VENDOR:  Intel Corp.

BIOS_VERSION:  EBH7710H.86A.0103.2014.1015.1532

BIOS_DATE:  10/15/2014

BASEBOARD_MANUFACTURER:  Intel Corporation

BASEBOARD_PRODUCT:  DH77EB

BASEBOARD_VERSION:  AAG39073-304

DUMP_TYPE:  2

BUGCHECK_P1: c0000005

BUGCHECK_P2: fffff8000274f800

BUGCHECK_P3: ffff8801cfa56c20

BUGCHECK_P4: 0

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!MiMapViewOfDataSection+a0
fffff800`0274f800 41b900000100    mov     r9d,10000h

CONTEXT:  ffff8801cfa56c20 -- (.cxr 0xffff8801cfa56c20)
.cxr 0xffff8801cfa56c20
rax=0000000000000000 rbx=0000000000001000 rcx=0000000000001000
rdx=ffffae8a6922a3c0 rsi=0000000000000001 rdi=ffff8801cfa579b0
rip=fffff8000274f800 rsp=ffff8801cfa57630 rbp=0000000000000000
 r8=0000000000000000  r9=ffff8801cfa579b0 r10=ffffae8a6922a3c0
r11=ffff8801cfa579d0 r12=0000000000400000 r13=ffffae8a6d211960
r14=ffffae8a6d211960 r15=0000000000400000
iopl=0         nv up ei pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
nt!MiMapViewOfDataSection+0xa0:
fffff800`0274f800 41b900000100    mov     r9d,10000h
.cxr
Resetting default scope

CPU_COUNT: 8

CPU_MHZ: d48

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3a

CPU_STEPPING: 9

CPU_MICROCODE: 6,3a,9,0 (F,M,S,R)  SIG: 1B'00000000 (cache) 1B'00000000 (init)

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x3B

PROCESS_NAME:  [COLOR="#FF0000"]dwm.exe[/COLOR]

CURRENT_IRQL:  0

ANALYSIS_SESSION_HOST:  BETENOIR

ANALYSIS_SESSION_TIME:  12-02-2016 21:49:22.0809

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

LAST_CONTROL_TRANSFER:  from fffff8000275311a to fffff8000274f800

STACK_TEXT:  
ffff8801`cfa57630 fffff800`0275311a : ffffae8a`6d211960 ffffae8a`6922a3c0 ffff8801`cfa579d0 ffffc90d`683c05a0 : nt!MiMapViewOfDataSection+0xa0
ffff8801`cfa57770 fffff800`026f530a : ffff9857`00000000 00001f80`0108e6d0 fffff80c`444378d0 ffffae8a`68527000 : nt!MiMapViewOfSection+0x24a
ffff8801`cfa578f0 ffff982f`dcc3a6c5 : ffffae8a`684b3088 ffffae8a`692b9718 00000000`00000000 fffff800`02378147 : nt!MmMapViewOfSection+0x62
ffff8801`cfa57960 ffff982f`dcc381e7 : 00000000`00000000 ffff9857`002052e0 00000000`00000000 00000000`00001000 : [COLOR="#FF0000"]win32kbase[/COLOR]!DirectComposition::CBatchSharedMemoryPool::GetUserModeViewAtOffset+0x9d
ffff8801`cfa579d0 ffff982f`dcc37721 : ffffae8a`68bcfcd0 00000000`00361e33 ffff8801`cfa57ab8 00000000`00000001 : [COLOR="#FF0000"]win32kbase[/COLOR]!DirectComposition::CConnection::RetrieveBatches+0xef
ffff8801`cfa57a80 fffff800`023e6193 : 00000000`00000004 ffffae8a`684b3010 00000055`bf68f298 ffff9857`002052e0 : [COLOR="#FF0000"]win32kbase[/COLOR]!NtDCompositionGetConnectionBatch+0x221
ffff8801`cfa57b00 00007fff`138c3744 : 00007fff`112684de 00000000`00000000 00007fff`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000055`bf68f1e8 00007fff`112684de : 00000000`00000000 00007fff`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`138c3744
00000055`bf68f1f0 00000000`00000000 : 00007fff`00000000 00000000`00000000 00000000`00000000 00000002`00000000 : 0x00007fff`112684de


CHKIMG_EXTENSION: !chkimg -lo 50 -d !nt
!chkimg -lo 50 -d !nt
    fffff8000239ee6e - nt!MiPurgeZeroList+6e

	[ fa:be ]
    fffff8000242c909-fffff8000242c90b  3 bytes - nt! ?? ::FNODOBFM::`string'+41f69 (+0x8da9b)

	[ 40 fb f6:00 77 ee ]
    fffff8000242c937 - nt! ?? ::FNODOBFM::`string'+41f97 (+0x2e)

	[ fa:be ]
5 errors : !nt (fffff8000239ee6e-fffff8000242c937)

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  LARGE

STACK_COMMAND:  .cxr 0xffff8801cfa56c20 ; kb

FAILURE_BUCKET_ID:  MEMORY_CORRUPTION_LARGE

BUCKET_ID:  MEMORY_CORRUPTION_LARGE

PRIMARY_PROBLEM_CLASS:  MEMORY_CORRUPTION_LARGE

TARGET_TIME:  2016-12-02T18:59:20.000Z

OSBUILD:  14393

OSSERVICEPACK:  0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:  

USER_LCID:  0

OSBUILD_TIMESTAMP:  2016-11-02 10:17:03

BUILDDATESTAMP_STR:  161102-0100

BUILDLAB_STR:  rs1_release_inmarket

BUILDOSVER_STR:  10.0.14393.447.amd64fre.rs1_release_inmarket.161102-0100

ANALYSIS_SESSION_ELAPSED_TIME: 1556

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:memory_corruption_large

FAILURE_ID_HASH:  {e29154ac-69a4-0eb8-172a-a860f73c0a3c}

Followup:     memory_corruption
---------  

3rd party drivers by date (old ones are often suspect!):

Code:

**************************Fri Dec  2 18:59:20.976 2016 (UTC + 0:00)**************************
BrUsbSIb.sys                 Tue Nov  3 03:06:35 2009 (4AEF9E3B)
npf.sys                      Fri Jun 25 17:50:58 2010 (4C24DE72)
intelsmb.sys                 Mon Dec  5 15:44:13 2011 (4EDCE6CD)
BrSerIb.sys                  Tue Jul 31 12:54:47 2012 (5017C787)
cpuiox64.sys                 Mon Oct  7 22:19:50 2013 (52532576)
mwac.sys                     Wed Jun 18 03:07:00 2014 (53A0F444)
IntcDAud.sys                 Tue Sep  9 13:13:01 2014 (540EEECD)
HWiNFO64A.SYS                Tue Mar 31 10:51:32 2015 (551A6E24)
RTKVHD64.sys                 Thu Jun 18 11:45:05 2015 (5582A131)
TeeDriverW8x64.sys           Tue Jul  7 18:43:32 2015 (559C0FC4)
MBAMSwissArmy.sys            Wed Jul 29 05:26:01 2015 (55B855D9)
mbam.sys                     Tue Aug 11 18:35:19 2015 (55CA3257)
wdcsam64.sys                 Fri Oct  9 21:31:13 2015 (56182411)
iwdbus.sys                   Thu Nov 19 23:37:42 2015 (564E5D46)
mozy.sys                     Fri Dec  4 11:30:02 2015 (5661793A)
vstor2-mntapi20-shared.sys   Sun Dec 13 09:08:31 2015 (566D358F)
e1i63x64.sys                 Fri Mar  4 21:46:29 2016 (56DA0235)
igdkmd64.sys                 Mon Apr  4 18:48:36 2016 (5702A8F4)
intelppm.sys                 Sat Jul 16 03:10:43 2016 (578997A3)
VBoxNetAdp6.sys              Mon Nov 21 16:44:34 2016 (58332472)
VBoxNetLwf.sys               Mon Nov 21 16:44:34 2016 (58332472)
VBoxUSBMon.sys               Mon Nov 21 16:44:34 2016 (58332472)
VBoxDrv.sys                  Mon Nov 21 16:45:08 2016 (58332494)

http://www.carrona.org/drivers/driver.php?id=BrUsbSIb.sys
http://www.carrona.org/drivers/driver.php?id=npf.sys
http://www.carrona.org/drivers/driver.php?id=intelsmb.sys
http://www.carrona.org/drivers/driver.php?id=BrSerIb.sys
http://www.carrona.org/drivers/driver.php?id=cpuiox64.sys
http://www.carrona.org/drivers/driver.php?id=mwac.sys
http://www.carrona.org/drivers/driver.php?id=IntcDAud.sys
http://www.carrona.org/drivers/driver.php?id=HWiNFO64A.SYS
http://www.carrona.org/drivers/driver.php?id=RTKVHD64.sys
http://www.carrona.org/drivers/driver.php?id=TeeDriverW8x64.sys
http://www.carrona.org/drivers/driver.php?id=MBAMSwissArmy.sys
http://www.carrona.org/drivers/driver.php?id=mbam.sys
http://www.carrona.org/drivers/driver.php?id=wdcsam64.sys
http://www.carrona.org/drivers/driver.php?id=iwdbus.sys
http://www.carrona.org/drivers/driver.php?id=mozy.sys
http://www.carrona.org/drivers/driver.php?id=vstor2-mntapi20-shared.sys
http://www.carrona.org/drivers/driver.php?id=e1i63x64.sys
http://www.carrona.org/drivers/driver.php?id=igdkmd64.sys
http://www.carrona.org/drivers/driver.php?id=intelppm.sys
http://www.carrona.org/drivers/driver.php?id=VBoxNetAdp6.sys
http://www.carrona.org/drivers/driver.php?id=VBoxNetLwf.sys
http://www.carrona.org/drivers/driver.php?id=VBoxUSBMon.sys
http://www.carrona.org/drivers/driver.php?id=VBoxDrv.sys

— E O J — 2016 Dec 02 21:49:54 PM 3rdPartyDriversDate Copyright 2016 Mikael Pryor

Reply | Quote

Satrow: Thank you so much for plowing through the dump. I uninstalled the Intel driver (it’s the latest one for my Intel motherboard which unfortunately is no longer supported) and let Windows install an earlier driver (December 2015). Now I’m a bit on the fence about this. I’ll let the machine cook for a few days to see how stable it is; maybe I’ll put my Nvidia graphics card back in the machine; at least Nvidia is still creating drivers for it. I’m going to rebuild the machine in a week or so anyway so it doesn’t matter at this point.

One thing that kind of blew my mind is the HWiNFO64A.SYS driver; I have no idea why that’s on my system. I did some poking around and found it’s part of a freeware package at hwinfo.com. I know I never installed it. Furthermore, I noticed that sometimes when I would start DV right after a fresh boot, that driver would show in the list of drivers and other times it didn’t. It never shows up in Sysinternals Autoruns.

I did uninstall another piece of software; an Intel motherboard monitor which according to their site only supported Windows up to 8.1. The oldest driver, BrUsbSIb.sys, is for my Brother USB printer and it’s the latest driver from Brother and supposedly supports Windows 10.

Anyway, here’s hoping that reinstalling Windows will help.

Thanks again.

Rob

Reply | Quote