Need to defeat Trusted installer (Vista)

O negative

Posts: 19   +0
How can I defeat Trustedinstaller so I can run sfc/scannow? I get the "Windows Resource Protection could not start the repair service". I will probably also need it defeated while I replace corrupted/missing system files.

I have a crippled Vista machine and a running one with an older Vista installed that I intend to use as a donor for replacement files. When I first started poking around in the crippled one there were two or three restore points saved. I restored the oldest one which was about 7 months old. I was able to run sfc/scannow after that. (I didn't try before that.) After some more poking around I decided to restore to a later restore point, about 3 months old. Now scannow doesn't work.

Before the last system restore I saved a system32 directory list (just the root--no subdirectory breakout) to a text file. Comparing it to the directory now, I have exactly the same number of files and subdirectories and the same total size of files, but I now have about 5 Gb less free space on the C:\ drive. I can't account for the extra stuff. I'm not sure exactly how restore works, whether it can restore windows update files contained in the Softwaredistribution\downloads dir. There would be more stuff in there at a later date, but in order for the net change in hard drive space to occur the extra files would have had to have been compressed more than they were when downloaded. Seems far-fetched to me. I did load some files between restore events: a Toshiba value added package that is less than 50 Mb and tsetup.exe that is only 1 Kb. (The Tvap failed to install due to insufficient space on the X:\ drive.)

I've done very little registry editing before, but I'm guessing that is the way to do it when I have only the command prompt (Administrator) to work with.

Are there arguments that can be put after Trustedinstaller on the command line? When I just type "Trustedinstaller" at the C:\windows\servicing prompt and RETURN, I do not get an error, but I get no indication that anything happened. If I try it from another directory I get the "not recognized" error.

I haven't mentioned yet that the restore points are all gone and since I did them from safe mode I can't undo the last one--or so I'm told. Does "can't" mean "impossible" or just "very difficult"?
 
If you cannot account for space, it would be worth running chkdsk /f to see if there was any corruption caused by a somewhat imperfect restore process
 
I ran the memory scan from the restore menu, but maybe that was a test of RAM. I was also thinking that 5 gig would be about the right size for a backup of the system. If so, I'd like to know which directory would contain it.

Maybe MS tells us that you can't undo a restore from safe mode because that would put you back to safe mode, an inferior condition, but maybe it stores the "undo" anyway. We just need to work around obstacles to restore it.
 
The hard disk is what you need to check. A full drive backup is called a 'drive image' and there are free utilities which provide that facility. You cannot save a drive image on the same partition as it is an image of (think chicken and egg). You have to store the backup image on a separate drive partition, and ideally on a separate hard drive. Sensible people have a USB plugin drive for that purpose. For Vista, more likely 15Gb is a minimum, and it can be much larger, since it should contain all your data as well.

Some people think a backup only needs to be their OS directory (aka C:\Windows). You definitely stop thinking that the first time you lose all your photos, games, music, etc etc.
 
Have you tried running sfc in safe mode?


You can try this:
winhelponline[DOTCOM]/blog/fix-for-error-windows-resource-protection-could-not-start-the-repair-service-when-running-sfc-in-vista/

you can set the trusted installer service to manual by the command line:
sc config trustedinstaller start= manual

Another option:
vistax64[DOTCOM]/tutorials/282940-windows-modules-installer-error-126-fix.html

You can also try to boot from the Vista DVD and run SFC in offline mode from the command promt:

sfc /scannow /offbootdir=c:\ /offwindir=c:windows

winhelponline[DOTCOM]/blog/run-sfc-offline-windows-7-vista/
Windows 7 will create a partition in front of your Windows partition. That is why in his example pictures the offbootdir and offwindir directories are "D" not "C". If you're not sure which partition your Windows is installed you can run the DISKPART command and see where it is.

If you run into an error while running from the DVD saying that there is a pending repair, sfc can't run now you can rename the pending.xml file in the winsxs folder
ren c:\windows\winsxs\pending.xml pending.old
This should clear pending actions and allow you to run sfc

Sorry, messy post, good luck

sorry can't post URLs yet because account is too new.

Also, I would look at what brand hard drive you have and find the respective hard drive diagnostic tool that company provides. Western Digital has the Data LifeGuard Diagnostics, and Seagate has SeaTools for example. These can be put onto a bootable CD in which you can test the condition of the hard drive.

[Edit]: Sorry!
 
Thanks Cat. for providing the config details. Unfortunately, "manual" is not a valid option for start= on this machine, but it does cough up a list of 6 valid options:

start= <boot|system|auto|demand|disabled|delayed-auto>

I could try each one and see what happens, but I think I'll search the web first for more explanation. (I don't want to get my beard stuck in the pencil sharpener again. ref. The Simpsons)

Meanwhile, if you think you know which one of these options would allow me to run sfc/scannow without interference, point it out.
 
I am pretty sure when I used it i had to use

sc config trustedinstaller start= auto

Pretty much everything I had read though said the trustedinstaller had to be set to manual. And based on the above command I guessed that there would be a "manual" option.

Sorry!

My story trying to run SFC in Vista 32 SP2
-When I was in normal Windows or Safe Mode, it would give me the "Windows Resource Protection could not start the repair service" error when trying to run sfc
-Boot into the Windows Vista 32 SP2 DVD, command promt, attempt to run offline sfc ("sfc /scannow /offbootdir=c:\ /offwindir=c:\womdpws") and I would get an error saying there is a repair waiting to be done, I was to restart and try again. There was no repair going, or anything like that so I had to rename the pending.xml file in the c:\windows\winsxs folder. ("ren c:\windows\winsxs\pending.xml pending.old")
-Then I could run sfc in offline mode
 
I've been looking into this Trustedinstaller service a little more.

Trustedinstaller cannot be stopped or paused. You can check the current config state by using sc qc trustedinstaller. Changes to the config do not survive rebooting. This machine always boots up with demand start.

I'm a little confused about these start options we can assign to Trustedinstaller. Since Trustedinstaller always starts at boot and cannot be paused or stopped, what are these start options for? Are they for how this service starts other dependents?
 
I got scannow to work, maybe.

I used the "offboot" method from the X:\ "drive" since I don't have a Windows boot disk. At "x:\sources\recovery\Tools>" I entered, "sfc /scannow /offbootdir=c:\ /offwindir=c:\windows" (without quotes, of course). It returned, "Beginning system scan. This process will take some time." This process takes about 4 minutes when you do it the first time after booting. It only takes a minute the second time. (I repeated it to get exact quotes for this post). When done it says, "Windows Resource Protection did not find any integrity violations."

What does it mean "integrity"? Is it looking for security vulnerablilties, evidence of security breaches, damaged files, missing files, all of the above?

There were no new entries in the CBS log, but I suppose that is normal when scannow doesn't find anything. I'm guessing that it logged somthing somewhere that enables it to complete the scan quicker the second time.

After this I rebooted and it failed to load Windows as usual, but when I opted out of the repair and chose the load normal option (what I usually do to get to the command prompt) it went into chkdsk, which is unusual. It found some orphans and other problems and tried rebooting again and took much longer doing so. I tried the repair, same ol'-same ol'.

Scannow finds nothing. Startup Repair can't find anything. Meanwhile Vista can't load network drivers, HD video and sound drivers, among others. What gives?
 
Can you boot into Windows normal mode?

Can you boot into Windows safe mode?

How are you getting to the recovery console?

IIRC sfc just checks the integrity of the protected system files within Windows. Without the Windows disk in the drive no repairs will be able to be performed.

If you are still having problems getting into Windows in normal or safe mode have you fixed the boot/mbr?

bootrec /fixboot
bootrec /fixmbr

Also have you run a full "chkdsk /r" or "chkdsk /f"?

Have you tested your hard drive to make sure it isn't failing?
 
I already did the chkdsk /f and there were no pronlems except at the very end it said, "Failed to transfer logged messages to the event log with status 50". This was after it passed all three tests so there must not have been much to write anyway.

I even ran the chkdsk of C:\ from X:\. I think I haven't been giving the RAM "disk" X:\ enough respect. I found a log file called proccess.log that is in X:\, but not in C:\. Here it is:

=========================================================================
Start.bat
=========================================================================
0. Check PC
Function init adapter failure
Failed to initialize the raid class.
1. Check boot device
1-1. Boot from recovery media? : BOOTDRV = CD

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control
SystemStartOptions REG_SZ /NOEXECUTE=OPTIN /DETECTHAL /MININT RDIMAGEOFFSET=8192 RDIMAGELENGTH=3161088 RDPATH=MULTI(0)DISK(0)RDISK(0)PARTITION(1)\SOURCES\BOOT.WIM

0 "CDROM" found in X:\SOURCES\RECOVERY\TOOLS\BOOTDEV.TXT
1-2. Boot from WinRE area? : BOOTDRV = WINRE
1-1-3 / 1-2-1. WinRE menu

It looks a bit generic. I don't know if it offers any clues.

Here is a comparison of ntbtlog when starting or trying to start Vista normally. (Ironically, safe mode boot log is more complicated.) Both machines are AMD Turion w/32-bit Vista. The first one is a Toshiba.

Service Pack 2 3 16 2012 12:31:51.359
Loaded driver \SystemRoot\system32\ntkrnlpa.exe
Loaded driver \SystemRoot\system32\hal.dll
Loaded driver \SystemRoot\system32\kdcom.dll
Loaded driver \SystemRoot\system32\PSHED.dll
Loaded driver \SystemRoot\system32\BOOTVID.dll
Loaded driver \SystemRoot\system32\CLFS.SYS
Loaded driver \SystemRoot\system32\CI.dll
Loaded driver \SystemRoot\system32\drivers\Wdf01000.sys
Loaded driver \SystemRoot\system32\drivers\WDFLDR.SYS
Loaded driver \SystemRoot\system32\drivers\acpi.sys
Loaded driver \SystemRoot\system32\drivers\WMILIB.SYS
Loaded driver \SystemRoot\system32\drivers\msisadrv.sys
Loaded driver \SystemRoot\system32\drivers\pci.sys
Loaded driver \SystemRoot\System32\drivers\partmgr.sys
Loaded driver \SystemRoot\system32\DRIVERS\compbatt.sys
Loaded driver \SystemRoot\system32\DRIVERS\BATTC.SYS
Loaded driver \SystemRoot\system32\drivers\volmgr.sys
Loaded driver \SystemRoot\System32\drivers\volmgrx.sys
Loaded driver \SystemRoot\system32\drivers\pciide.sys
Loaded driver \SystemRoot\system32\drivers\PCIIDEX.SYS
Loaded driver \SystemRoot\System32\drivers\mountmgr.sys
Loaded driver \SystemRoot\system32\drivers\atapi.sys
Loaded driver \SystemRoot\system32\drivers\ataport.SYS
Loaded driver \SystemRoot\system32\drivers\msahci.sys
Loaded driver \SystemRoot\system32\drivers\fltmgr.sys
Loaded driver \SystemRoot\system32\drivers\fileinfo.sys
Loaded driver \SystemRoot\System32\Drivers\ksecdd.sys
Loaded driver \SystemRoot\system32\drivers\ndis.sys
Loaded driver \SystemRoot\system32\drivers\msrpc.sys
Loaded driver \SystemRoot\system32\drivers\NETIO.SYS
Loaded driver \SystemRoot\System32\drivers\tcpip.sys
Loaded driver \SystemRoot\System32\drivers\fwpkclnt.sys
Loaded driver \SystemRoot\System32\Drivers\Ntfs.sys
Loaded driver \SystemRoot\system32\drivers\volsnap.sys
Loaded driver \SystemRoot\system32\DRIVERS\TVALZ_O.SYS
Loaded driver \SystemRoot\system32\DRIVERS\tos_sps32.sys
Loaded driver \SystemRoot\System32\Drivers\spldr.sys
Loaded driver \SystemRoot\System32\Drivers\mup.sys
Loaded driver \SystemRoot\System32\drivers\ecache.sys
Loaded driver \SystemRoot\system32\drivers\disk.sys
Loaded driver \SystemRoot\system32\drivers\CLASSPNP.SYS
Loaded driver \SystemRoot\system32\DRIVERS\AtiPcie.sys
Loaded driver \SystemRoot\system32\drivers\crcdisk.sys
Loaded driver \SystemRoot\system32\DRIVERS\tunnel.sys
Loaded driver \SystemRoot\system32\DRIVERS\tunmp.sys
Loaded driver \SystemRoot\system32\DRIVERS\FwLnk.sys
Loaded driver \SystemRoot\system32\DRIVERS\processr.sys
Loaded driver \SystemRoot\system32\DRIVERS\CmBatt.sys
Loaded driver \SystemRoot\System32\drivers\dxgkrnl.sys
Loaded driver \SystemRoot\system32\DRIVERS\atikmdag.sys
Loaded driver \SystemRoot\system32\DRIVERS\Rtlh86.sys
Loaded driver \SystemRoot\system32\DRIVERS\athr.sys
Loaded driver \SystemRoot\system32\DRIVERS\tdcmdpst.sys
Loaded driver \SystemRoot\system32\DRIVERS\cdrom.sys
Loaded driver \SystemRoot\System32\Drivers\GEARAspiWDM.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbohci.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbehci.sys
Loaded driver \SystemRoot\system32\DRIVERS\HDAudBus.sys
Loaded driver \SystemRoot\system32\DRIVERS\i8042prt.sys
Loaded driver \SystemRoot\system32\DRIVERS\kbdclass.sys
Loaded driver \SystemRoot\system32\DRIVERS\SynTP.sys
Loaded driver \SystemRoot\system32\DRIVERS\mouclass.sys
Loaded driver \SystemRoot\system32\DRIVERS\msiscsi.sys
Loaded driver \SystemRoot\system32\DRIVERS\rasl2tp.sys
Loaded driver \SystemRoot\system32\DRIVERS\ndistapi.sys
Loaded driver \SystemRoot\system32\DRIVERS\ndiswan.sys
Loaded driver \SystemRoot\system32\DRIVERS\raspppoe.sys
Loaded driver \SystemRoot\system32\DRIVERS\raspptp.sys
Loaded driver \SystemRoot\system32\DRIVERS\rassstp.sys
Loaded driver \SystemRoot\system32\DRIVERS\hamachi.sys
Loaded driver \SystemRoot\system32\DRIVERS\termdd.sys
Loaded driver \SystemRoot\system32\DRIVERS\swenum.sys
Loaded driver \SystemRoot\system32\DRIVERS\mssmbios.sys
Loaded driver \SystemRoot\system32\DRIVERS\umbus.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbhub.sys
Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Loaded driver \SystemRoot\system32\drivers\RTKVHDA.sys
Loaded driver \SystemRoot\system32\DRIVERS\AGRSM.sys
Loaded driver \SystemRoot\system32\drivers\modem.sys
Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS
Loaded driver \SystemRoot\System32\Drivers\Null.SYS
Loaded driver \SystemRoot\System32\Drivers\Beep.SYS
Loaded driver \SystemRoot\system32\DRIVERS\usbccgp.sys
Loaded driver \SystemRoot\System32\Drivers\UVCFTR_S.SYS
Loaded driver \SystemRoot\System32\Drivers\usbvideo.sys
Loaded driver \SystemRoot\System32\drivers\vga.sys
Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys
Loaded driver \SystemRoot\system32\drivers\rdpencdd.sys
Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS
Loaded driver \SystemRoot\System32\DRIVERS\rasacd.sys
Loaded driver \SystemRoot\system32\DRIVERS\tdx.sys
Loaded driver \SystemRoot\system32\DRIVERS\smb.sys
Loaded driver \SystemRoot\system32\drivers\afd.sys
Loaded driver \SystemRoot\system32\DRIVERS\USBSTOR.SYS
Loaded driver \SystemRoot\System32\DRIVERS\netbt.sys
Loaded driver \SystemRoot\system32\DRIVERS\pacer.sys
Loaded driver \SystemRoot\system32\DRIVERS\jswpslwf.sys
Loaded driver \SystemRoot\system32\DRIVERS\netbios.sys
Loaded driver \SystemRoot\system32\DRIVERS\wanarp.sys
Loaded driver \SystemRoot\system32\DRIVERS\rdbss.sys
Loaded driver \SystemRoot\system32\drivers\nsiproxy.sys
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Did not load driver
Loaded driver \SystemRoot\System32\Drivers\dfsc.sys

Here's the HP (the one that still loads):

Microsoft (R) Windows (R) Version 6.0 (Build 6000)
3 18 2012 18:31:37.500
Loaded driver \SystemRoot\system32\ntoskrnl.exe
Loaded driver \SystemRoot\system32\hal.dll
Loaded driver \SystemRoot\system32\kdcom.dll
Loaded driver \SystemRoot\system32\PSHED.dll
Loaded driver \SystemRoot\system32\CLFS.SYS
Loaded driver \SystemRoot\system32\CI.dll
Loaded driver \SystemRoot\system32\drivers\Wdf01000.sys
Loaded driver \SystemRoot\system32\drivers\WDFLDR.SYS
Loaded driver \SystemRoot\system32\drivers\acpi.sys
Loaded driver \SystemRoot\system32\drivers\WMILIB.SYS
Loaded driver \SystemRoot\system32\drivers\msisadrv.sys
Loaded driver \SystemRoot\system32\drivers\pci.sys
Loaded driver \SystemRoot\system32\drivers\volmgr.sys
Loaded driver \SystemRoot\system32\DRIVERS\compbatt.sys
Loaded driver \SystemRoot\system32\DRIVERS\BATTC.SYS
Loaded driver \SystemRoot\System32\drivers\mountmgr.sys
Loaded driver \SystemRoot\system32\drivers\pciide.sys
Loaded driver \SystemRoot\system32\drivers\PCIIDEX.SYS
Loaded driver \SystemRoot\system32\DRIVERS\pcmcia.sys
Loaded driver \SystemRoot\System32\drivers\volmgrx.sys
Loaded driver \SystemRoot\system32\drivers\atapi.sys
Loaded driver \SystemRoot\system32\drivers\ataport.SYS
Loaded driver \SystemRoot\system32\drivers\fltmgr.sys
Loaded driver \SystemRoot\system32\drivers\N360x64\0404000.00C\SYMDS64.SYS
Loaded driver \SystemRoot\system32\drivers\fileinfo.sys
Loaded driver \SystemRoot\system32\drivers\N360x64\0404000.00C\SYMEFA64.SYS
Loaded driver \SystemRoot\system32\drivers\ndis.sys
Loaded driver \SystemRoot\system32\drivers\msrpc.sys
Loaded driver \SystemRoot\system32\drivers\NETIO.SYS
Loaded driver \SystemRoot\System32\Drivers\Ntfs.sys
Loaded driver \SystemRoot\System32\Drivers\ksecdd.sys
Loaded driver \SystemRoot\system32\drivers\volsnap.sys
Loaded driver \SystemRoot\System32\Drivers\spldr.sys
Loaded driver \SystemRoot\System32\drivers\partmgr.sys
Loaded driver \SystemRoot\System32\Drivers\mup.sys
Loaded driver \SystemRoot\System32\drivers\ecache.sys
Loaded driver \SystemRoot\System32\DRIVERS\fvevol.sys
Loaded driver \SystemRoot\system32\drivers\disk.sys
Loaded driver \SystemRoot\system32\drivers\CLASSPNP.SYS
Loaded driver \SystemRoot\system32\drivers\crcdisk.sys
Loaded driver \SystemRoot\system32\DRIVERS\tunnel.sys
Loaded driver \SystemRoot\system32\DRIVERS\tunmp.sys
Loaded driver \SystemRoot\system32\DRIVERS\amdk8.sys
Loaded driver \SystemRoot\system32\DRIVERS\cpqbttn64.sys
Loaded driver \SystemRoot\system32\DRIVERS\wmiacpi.sys
Loaded driver \SystemRoot\System32\drivers\dxgkrnl.sys
Loaded driver \SystemRoot\system32\DRIVERS\atikmdag.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbohci.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbehci.sys
Loaded driver \SystemRoot\system32\DRIVERS\cdrom.sys
Loaded driver \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
Loaded driver \SystemRoot\system32\DRIVERS\i8042prt.sys
Loaded driver \SystemRoot\system32\DRIVERS\kbdclass.sys
Loaded driver \SystemRoot\system32\DRIVERS\mouclass.sys
Loaded driver \SystemRoot\system32\DRIVERS\CmBatt.sys
Loaded driver \SystemRoot\system32\DRIVERS\bcmwl664.sys
Loaded driver \SystemRoot\system32\DRIVERS\ohci1394.sys
Loaded driver \SystemRoot\system32\DRIVERS\sdbus.sys
Loaded driver \SystemRoot\system32\DRIVERS\Rtnic64.sys
Loaded driver \SystemRoot\system32\DRIVERS\msiscsi.sys
Loaded driver \SystemRoot\system32\DRIVERS\rasl2tp.sys
Loaded driver \SystemRoot\system32\DRIVERS\ndistapi.sys
Loaded driver \SystemRoot\system32\DRIVERS\ndiswan.sys
Loaded driver \SystemRoot\system32\DRIVERS\raspppoe.sys
Loaded driver \SystemRoot\system32\DRIVERS\raspptp.sys
Loaded driver \SystemRoot\system32\DRIVERS\rdpdr.sys
Loaded driver \SystemRoot\system32\DRIVERS\termdd.sys
Loaded driver \SystemRoot\system32\DRIVERS\swenum.sys
Loaded driver \SystemRoot\system32\DRIVERS\mssmbios.sys
Loaded driver \SystemRoot\system32\DRIVERS\umbus.sys
Loaded driver \SystemRoot\system32\DRIVERS\kbdhid.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbhub.sys
Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS
Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS
Loaded driver \SystemRoot\System32\Drivers\Null.SYS
Loaded driver \SystemRoot\System32\drivers\vga.sys
Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys
Loaded driver \SystemRoot\system32\drivers\rdpencdd.sys
Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS
Loaded driver \SystemRoot\System32\DRIVERS\rasacd.sys
Loaded driver \SystemRoot\System32\drivers\tcpip.sys
Loaded driver \SystemRoot\system32\DRIVERS\tdx.sys
Loaded driver \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
Loaded driver \SystemRoot\System32\Drivers\N360x64\0404000.00C\SYMTDIV.SYS
Loaded driver \SystemRoot\system32\DRIVERS\smb.sys
Loaded driver \SystemRoot\system32\drivers\afd.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbt.sys
Loaded driver \SystemRoot\system32\DRIVERS\pacer.sys
Loaded driver \SystemRoot\system32\DRIVERS\netbios.sys
Loaded driver \SystemRoot\system32\DRIVERS\wanarp.sys
Loaded driver \SystemRoot\system32\drivers\N360x64\0404000.00C\Ironx64.SYS
Loaded driver \SystemRoot\system32\drivers\N360x64\0404000.00C\SRTSPX64.SYS
Loaded driver \SystemRoot\system32\DRIVERS\rdbss.sys
Loaded driver \SystemRoot\system32\drivers\nsiproxy.sys
Loaded driver
Loaded driver \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
Loaded driver \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
Loaded driver \SystemRoot\system32\drivers\csc.sys
Loaded driver \SystemRoot\System32\Drivers\dfsc.sys
Loaded driver \SystemRoot\system32\drivers\N360x64\0404000.00C\ccHPx64.sys
Loaded driver
Loaded driver \SystemRoot\system32\DRIVERS\monitor.sys
Loaded driver \SystemRoot\system32\drivers\luafv.sys
Loaded driver \SystemRoot\system32\DRIVERS\lltdio.sys
Loaded driver \SystemRoot\system32\DRIVERS\nwifi.sys
Loaded driver \SystemRoot\system32\DRIVERS\ndisuio.sys
Loaded driver \SystemRoot\system32\DRIVERS\rspndr.sys
Loaded driver \SystemRoot\system32\drivers\HTTP.sys
Loaded driver \SystemRoot\System32\DRIVERS\srvnet.sys
Loaded driver \SystemRoot\system32\DRIVERS\bowser.sys
Loaded driver \SystemRoot\System32\drivers\mpsdrv.sys
Loaded driver \SystemRoot\system32\drivers\mrxdav.sys
Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb.sys
Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb10.sys
Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb20.sys
Loaded driver \SystemRoot\System32\DRIVERS\srv2.sys
Loaded driver \SystemRoot\System32\DRIVERS\srv.sys
Did not load driver \SystemRoot\System32\DRIVERS\srv.sys
Loaded driver \SystemRoot\system32\DRIVERS\asyncmac.sys
Loaded driver \SystemRoot\system32\drivers\peauth.sys
Loaded driver \SystemRoot\System32\Drivers\secdrv.SYS
Loaded driver \SystemRoot\System32\drivers\tcpipreg.sys
Did not load driver \SystemRoot\system32\drivers\N360x64\0404000.00C\SRTSPX64.SYS
Loaded driver
Loaded driver
Loaded driver \SystemRoot\system32\DRIVERS\cdfs.sys
Loaded driver \SystemRoot\System32\Drivers\N360x64\0404000.00C\SRTSP64.SYS

What's with the hidden drivers? Kinda' hard to fix them if I don't know what they are.

I'm now trying to find out where the OS stores the list(s) that determine(s) which drivers to load and what order.
 
Back