R
Richard A. Landkamer
To Whom It May Concern:
Prior to last year, I used Version 6 of Backup My PC, which was previously sold by StompSoft.com at <http://www.stompsoft.com/> and <http://www.stompsoft.com/bump_important.html>. This StompSoft backup product was subsequently replaced by PC Backup at <http://www.stompsoft.com/pc-backup/pc-backup.html>. Eventually all of my previous backups made by Backup My PC were replaced with more current backups that were made by PC Backup and Norton Ghost, the latter of which is sold by a different vendor.
Consequently, this last weekend I decided to uninstall Version 6 of Backup My PC from my computer. The uninstall process went smoothly, and did not instruct me to reboot my computer after I uninstalled Backup My PC. At this point, it must be noted that the uninstall process was totally automatic. Unlike some other products that I have uninstalled, users are not given any option to choose precisely what DLL modules and drivers, etc., are being uninstalled.
When I subsequently did reboot my computer, I immediately got the Microsoft Blue Screen of death. I could not even bring up my computer in Safe Mode or any other mode under Windows XP SP2. About all I could do was use Norton Ghost, which can backup and restore image copies of my hard drive in DOS mode without using any version of Windows. So the first thing that I did was use Norton Ghost to create a current image copy backup of my C: Drive. When this backup ran successfully, I correctly surmised that there was nothing wrong with my C: Drive. Then I used Norton Ghost to restore a previous backup of my C: Drive. After doing this, I was able to reboot my computer.
However, after rebooting my computer, Windows XP instructed me to reboot my computer again in order to install some new unnamed Driver. I thought this very suspicious, since I had not installed any new hardware or software immediately prior to uninstalling Backup My PC. I rebooted my computer. I then ran an old (2004) version of Norton Win Doctor in Norton Utilities. No new problems were found.
I again uninstalled Backup My PC, after which I immediately ran Norton Win Doctor. This time Norton Win Doctor found the following two suspicious registry problems:
"The Key, 'SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs' refers to a missing file, 'C:\WINDOWS\system32\drivers\drvmcdb.sys'"
"The Key, 'SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs' refers to a missing file, 'C:\WINDOWS\inf\drvmcdb.inf'"
I used the Ghost Explorer component of Norton Ghost to restore these two missing files from a previous Norton Ghost backup of my computer. I then rebooted my computer. This time my computer came up normally.
At this point, I was 90% certain that the above two missing files, which were automatically deleted when I uninstalled Backup My PC, were the cause of my original problem.
I ran one other test: I left the above two files where they were. However, I used the Microsoft AutoRuns utility at <http://www.microsoft.com/technet/sysinternals/default.mspx> and <http://www.microsoft.com/technet/sysinternals/SystemInformation/Autoruns..mspx> to temporarily disable the drvmcdb.sys driver from being used when I rebooted my computer. I again rebooted my computer. I encountered the same problem that I originally encountered, i.e., I immediately got the Microsoft Blue Screen of death. I could not even bring up my computer in Safe Mode or any other mode under Windows XP SP2.
I again had to restore my C: Drive using Norton Ghost before I could reboot my computer. I then used the Ghost Explorer component of Norton Ghost to restore mail and other files to their current state from the backup that I took in the 3rd paragraph, above. Finally, I again uninstalled Backup My PC, restored the above two deleted files, and took another current Norton Ghost image copy backup of my C: Drive.
At this point, I have uninstalled Backup My PC, but I cannot uninstall the above two files. The above drvmcdb.inf file contains the following copied and pasted information:
; Copyright 2003 Sonic Solutions
SPSVCINST_ASSOCSERVICE = 0x00000002
SPSVCINST_FRONT = 0x00000001
SERVICE_KERNEL_DRIVER = 1
SERVICE_BOOT_START = 0
SERVICE_ERROR_NORMAL = 1
REG_EXPAND_SZ = 0x00020000
REG_DWORD = 0x00010001
[version]
signature="$Windows NT$"
Class=SCSIAdapter
Provider=%CompanyName%
LayoutFile=layout.inf
DriverVer=02/28/2000
[DestinationDirs]
DefaultDestDir = 12 ; DIRID_DRIVERS
[papi_Inst]
CopyFiles = @%DriverName%.sys
AddReg = FilterRegs
[papi_Inst.Services]
AddService = %DriverName%, %SPSVCINST_ASSOCSERVICE%, papi_Service_Inst, Miniport_EventLog_Inst
AddService = %DriverName%, %SPSVCINST_FRONT%, papi_Service_Inst, Miniport_EventLog_Inst
[papi_Service_Inst]
ServiceType = %SERVICE_KERNEL_DRIVER%
StartType = %SERVICE_BOOT_START%
ErrorControl = %SERVICE_ERROR_NORMAL%
ServiceBinary = %12%\%DriverName%.sys
LoadOrderGroup = Filter
[Manufacturer]
%CompanyName%=company
[company]
%papi.DeviceDesc% = papi_Inst, ""
[Miniport_EventLog_Inst]
AddReg = Miniport_EventLog_AddReg
[Miniport_EventLog_AddReg]
HKR,,EventMessageFile,%REG_EXPAND_SZ%,"%%SystemRoot%%\System32\IoLogMsg.dll"
HKR,,TypesSupported,%REG_DWORD%,7
[FilterRegs]
HKLM,"SYSTEM\CurrentControlSet\Control\Class\{4d36e965-e325-11ce-bfc1-08002be10318}","LowerFilters",0x00010008,%DriverName%
HKLM,"SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}","LowerFilters",0x00010008,%DriverName%
HKLM,"SYSTEM\CurrentControlSet\Control\Class\{6d807884-7d21-11cf-801c-08002be10318}","LowerFilters",0x00010008,%DriverName%
[Strings]
CompanyName = "Sonic Solutions"
DriverName = "drvmcdb"
papi.DeviceDesc = "SCSI/ATAPI Port Filter" ; localizable
The drvmcdb.sys is Version 3.22.7.0 - and states "Copyright © Sonic Solutions". I recall that Backup My PC used some kind of Sonic product for automatically updating Backup My PC. I discovered that this Sonic Update product had its own uninstallation process, so I also uninstalled this Sonic product from my computer before running the above 2nd test using the Microsoft AutoRuns utility.
I am very suspicious of any driver on my computer that I cannot uninstall. Is this malicious spyware software, or what? Can anyone tell me what this drvmcdb.sys driver does?
Also, is it legal for a vendor to sell any software that disables your computer if you subsequently uninstall that software? I spent about 12 hours on Easter Sunday working on this problem. After this problem, I am very suspicious of both StompSoft.com and Sonic Solutions.
I would appreciate any input from others regarding this problem.
Richard A. Landkamer
Prior to last year, I used Version 6 of Backup My PC, which was previously sold by StompSoft.com at <http://www.stompsoft.com/> and <http://www.stompsoft.com/bump_important.html>. This StompSoft backup product was subsequently replaced by PC Backup at <http://www.stompsoft.com/pc-backup/pc-backup.html>. Eventually all of my previous backups made by Backup My PC were replaced with more current backups that were made by PC Backup and Norton Ghost, the latter of which is sold by a different vendor.
Consequently, this last weekend I decided to uninstall Version 6 of Backup My PC from my computer. The uninstall process went smoothly, and did not instruct me to reboot my computer after I uninstalled Backup My PC. At this point, it must be noted that the uninstall process was totally automatic. Unlike some other products that I have uninstalled, users are not given any option to choose precisely what DLL modules and drivers, etc., are being uninstalled.
When I subsequently did reboot my computer, I immediately got the Microsoft Blue Screen of death. I could not even bring up my computer in Safe Mode or any other mode under Windows XP SP2. About all I could do was use Norton Ghost, which can backup and restore image copies of my hard drive in DOS mode without using any version of Windows. So the first thing that I did was use Norton Ghost to create a current image copy backup of my C: Drive. When this backup ran successfully, I correctly surmised that there was nothing wrong with my C: Drive. Then I used Norton Ghost to restore a previous backup of my C: Drive. After doing this, I was able to reboot my computer.
However, after rebooting my computer, Windows XP instructed me to reboot my computer again in order to install some new unnamed Driver. I thought this very suspicious, since I had not installed any new hardware or software immediately prior to uninstalling Backup My PC. I rebooted my computer. I then ran an old (2004) version of Norton Win Doctor in Norton Utilities. No new problems were found.
I again uninstalled Backup My PC, after which I immediately ran Norton Win Doctor. This time Norton Win Doctor found the following two suspicious registry problems:
"The Key, 'SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs' refers to a missing file, 'C:\WINDOWS\system32\drivers\drvmcdb.sys'"
"The Key, 'SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs' refers to a missing file, 'C:\WINDOWS\inf\drvmcdb.inf'"
I used the Ghost Explorer component of Norton Ghost to restore these two missing files from a previous Norton Ghost backup of my computer. I then rebooted my computer. This time my computer came up normally.
At this point, I was 90% certain that the above two missing files, which were automatically deleted when I uninstalled Backup My PC, were the cause of my original problem.
I ran one other test: I left the above two files where they were. However, I used the Microsoft AutoRuns utility at <http://www.microsoft.com/technet/sysinternals/default.mspx> and <http://www.microsoft.com/technet/sysinternals/SystemInformation/Autoruns..mspx> to temporarily disable the drvmcdb.sys driver from being used when I rebooted my computer. I again rebooted my computer. I encountered the same problem that I originally encountered, i.e., I immediately got the Microsoft Blue Screen of death. I could not even bring up my computer in Safe Mode or any other mode under Windows XP SP2.
I again had to restore my C: Drive using Norton Ghost before I could reboot my computer. I then used the Ghost Explorer component of Norton Ghost to restore mail and other files to their current state from the backup that I took in the 3rd paragraph, above. Finally, I again uninstalled Backup My PC, restored the above two deleted files, and took another current Norton Ghost image copy backup of my C: Drive.
At this point, I have uninstalled Backup My PC, but I cannot uninstall the above two files. The above drvmcdb.inf file contains the following copied and pasted information:
; Copyright 2003 Sonic Solutions
SPSVCINST_ASSOCSERVICE = 0x00000002
SPSVCINST_FRONT = 0x00000001
SERVICE_KERNEL_DRIVER = 1
SERVICE_BOOT_START = 0
SERVICE_ERROR_NORMAL = 1
REG_EXPAND_SZ = 0x00020000
REG_DWORD = 0x00010001
[version]
signature="$Windows NT$"
Class=SCSIAdapter
Provider=%CompanyName%
LayoutFile=layout.inf
DriverVer=02/28/2000
[DestinationDirs]
DefaultDestDir = 12 ; DIRID_DRIVERS
[papi_Inst]
CopyFiles = @%DriverName%.sys
AddReg = FilterRegs
[papi_Inst.Services]
AddService = %DriverName%, %SPSVCINST_ASSOCSERVICE%, papi_Service_Inst, Miniport_EventLog_Inst
AddService = %DriverName%, %SPSVCINST_FRONT%, papi_Service_Inst, Miniport_EventLog_Inst
[papi_Service_Inst]
ServiceType = %SERVICE_KERNEL_DRIVER%
StartType = %SERVICE_BOOT_START%
ErrorControl = %SERVICE_ERROR_NORMAL%
ServiceBinary = %12%\%DriverName%.sys
LoadOrderGroup = Filter
[Manufacturer]
%CompanyName%=company
[company]
%papi.DeviceDesc% = papi_Inst, ""
[Miniport_EventLog_Inst]
AddReg = Miniport_EventLog_AddReg
[Miniport_EventLog_AddReg]
HKR,,EventMessageFile,%REG_EXPAND_SZ%,"%%SystemRoot%%\System32\IoLogMsg.dll"
HKR,,TypesSupported,%REG_DWORD%,7
[FilterRegs]
HKLM,"SYSTEM\CurrentControlSet\Control\Class\{4d36e965-e325-11ce-bfc1-08002be10318}","LowerFilters",0x00010008,%DriverName%
HKLM,"SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}","LowerFilters",0x00010008,%DriverName%
HKLM,"SYSTEM\CurrentControlSet\Control\Class\{6d807884-7d21-11cf-801c-08002be10318}","LowerFilters",0x00010008,%DriverName%
[Strings]
CompanyName = "Sonic Solutions"
DriverName = "drvmcdb"
papi.DeviceDesc = "SCSI/ATAPI Port Filter" ; localizable
The drvmcdb.sys is Version 3.22.7.0 - and states "Copyright © Sonic Solutions". I recall that Backup My PC used some kind of Sonic product for automatically updating Backup My PC. I discovered that this Sonic Update product had its own uninstallation process, so I also uninstalled this Sonic product from my computer before running the above 2nd test using the Microsoft AutoRuns utility.
I am very suspicious of any driver on my computer that I cannot uninstall. Is this malicious spyware software, or what? Can anyone tell me what this drvmcdb.sys driver does?
Also, is it legal for a vendor to sell any software that disables your computer if you subsequently uninstall that software? I spent about 12 hours on Easter Sunday working on this problem. After this problem, I am very suspicious of both StompSoft.com and Sonic Solutions.
I would appreciate any input from others regarding this problem.
Richard A. Landkamer
)