Advanced users only - usbport.sys bsod and the use of verifier.exe...

Viruses and worms
1

For advanced users only Windows comes with verifier.exe for driver verification in the Command-line interface. I lately used it to verify my driver settings after a BSOD for usb.port.sys

another hardware device is requesting exclusive CPU time (raising the IRQL). Then I rebooted and the initial problem had been SOLVED…

At this time, usbport device driver has already been scheduled and wants to access memory which has most likely been paged to disk. It’s needs CPU time to do that, but because another device has exclusive access it causes a unrecoverable deadlock situation followed by a blue screen.

Quote taken from MadMonkey on PC HelpForum
How do the advanced users equ qualified removal experts use verifier.exe for instances of
IRQL_NOT_LESS_OR_EQUAL 0xA
PAGE_FAULT_IN_NONPAGED_AREA 0x50
PAGE_FAULT_IN_NONPAGED_AREA 0x50
ATTEMPTED_WRITE_TO_READONLY_MEMORY 0xBE
SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION 0xC1
DRIVER_VERIFIER_DETECTED_VIOLATION 0xC4
DRIVER_CAUGHT_MODIFYING_FREED_POOL 0xC6
TIMER_OR_DPC_INVALID 0xC7
DRIVER_VERIFIER_IOMANAGER_VIOLATION 0xC9

Please comment?

polonus

2

Hi Polonus,

I do not understand drivers but i’m assuming that no unsigned drivers are a good thing…

3

Hi !Donovan,

You did the right thing by checking that. Now reboot normally and you are fine. If you had any unsigned drivers, these should come under scrutiny, but not all are bad. This one was scanned and came out OK, see: https://www.virustotal.com/file/04bafcc9445f82a2caa9852f1b35ecbd18cdd6333e73f6861704e96d740a7c79/analysis/
Windows will alert you with one of the following messages if a driver is unsigned, was signed by a publisher that hasn’t verified its identity with a certification authority, or has been altered since it was signed and released.

polonus

4

Hi,talking about x64 systems,the patchguard won’t let unsigned kernel drivers to load,even if you try to restore “malicious” modifications in debug mode,the bsod will be there,waiting for you ;D .

5

Hi Left123,

That is because that is part of the advanced security there. But we also have to consider all the people around the world out on XP still,

polonus

6

All clear here too ;D

7

Hi Pol,i have a “bad” opinion regarding the Patchguard,so i feel this is not something special.

8

Hi Left123,

At the time Patchquard comes in to check, the victim of malware has already been made “toast and butter” for the kernel malware malcreants…
you have already lowered your OS defenses so much that you have been dealt" two blue eyes and a broken nose", so to say…where your private data are concerned. Well, I think you grasp what I mean to say…

polonus

9

Hi,did you know that some people belive that once the kernel of a computer has been compromised,there is no point in trying to treat it?That’s really funny :).It’s just that Microsoft fails to deliver the demanded level of security,so they limit everything with that Patchguard.
I mean,let’s say that : You have your own child and you love it more than yourself,so in order to protect it from the society,you lock it in a room,which is just stupid ;D .
Microsoft “doesn’t let” AV vendors to use Ring0 Code,therefore they limit the acess to the kernel.How in the h*ll,can someone treat bootkit infections,when these viruses have 100% acess to Kernel using high quality and low level hooks.
Can you shtudown a fire without water?
Philip