The technique & tools to isolate & eliminate BSOD device drivers

[Sue Brumba]

How do I locate and remove a particular driver from WinXP?

I keep getting the blue screen of death (Stop 0xBE) which indicates an
unspecified driver is attempting to write to read-only memory (according to my
googling.

How do I isolate & remove the offending Windows XP device driver?

Googling for "STOP 0XBE solutions", I found I am supposed to run
C:\Windows\System32\verifier.exe but I can't seem to get the knack of reading
the complex results from that Windows XP device verifier program.

For example, here are the device drivers that Windows XP verifier.exe found.
aavmker4.sys avast! Base Kernel-Mode Device Driver
asapiw2k.sys ASAPI
aspi32.sys ASPI for WIN32 Kernel Driver
aswmon2.sys avast! File System Filter Driver for Windows
aswrdr.sys avast! TDI RDR Driver
aswtdi.sys avast! TDI Filter Driver
ipsecw2k.sys Contivity VPN Client Adapter
pgpdisk.sys PGPdisk NT/Win2k driver
pgpsdk.sys PGP Software Development Kit NT Driver
pxhelp20.sys Px Engine Device Driver for Windows 2000
secdrv.sys Macrovision SECURITY Driver
teefer.sys Teefer Driver
tphkdrv.sys ThinkPad Hotkey Driver
vet-filt.sys <unknown>
vet-rec.sys <unknown>
vetfddnt.sys RealTime Anti-Virus Protection Driver
vetmonnt.sys RealTime Anti-Virus Protection Driver
wpsdrvnt.sys wpsdrvnt

Googling, one by one for each of these drivers with the word "Stop 0xBE" leads
me to loosly suspect ipsecw2k.sys or secdrv.sys or vet-filt.sys & vet-rec.sys
(I used to have both Contivity VPN & Zone Alarm firewall but I deleted both, I
thought, long ago).

My frustration is that I do not know how to eliminate these suspect drivers.
When I google, I find I'm supposed to go into the "Device Manager" to delete
Windows XP device drivers, but I can't seem to find where these particular
drivers lie.

I can google but that doesn't mean I understand what I find. Can you help?
How do I isolate & eliminate the driver causing this 0xBE BSOD?

Sue

 

[peter]

vet-rec.sys <unknown>
vetfddnt.sys RealTime Anti-Virus Protection Driver
vetmonnt.sys RealTime Anti-Virus Protection Driver

off hand I would say these files are your problem they seem to be from
E-Trust anti virus and you seem to be using Avast.
If you do a file search for them on your system you will find them.Do not
delete yet.Move them to a folder just for them but remember where they
go.Once you have moved them reboot and if there are no error messages
continue to operate your computer normally.If you get no BSOD for a week or
two then you can delete them.But if you do get another BSOD then you know
its not those files.and you need to start all over again.

I also noticed Teefer.sys.........here is some info on that
http://www.file.net/process/teefer.sys.html
What firewall are you using?
http://www.file.net/process/wpsdrvnt.sys.html

peter

 

[Cathy]

How do I locate and remove a particular driver from WinXP?
For example, here are the device drivers that Windows XP verifier.exe found.

I never heard of the Start:Run:verifier.exe command on Windows XP!
I've always used Start:Run:sigverif.exe instead.
Sigverif will report all unsigned drivers which you can then delete.

I just ran sigverif for myself and it reported these wierd things.
ativmvxx.ax c:\windows\system32
csmbatt.sys c\windows\system32\drivers
ibmtpips.icm c:\windows\system32\spool\drivers\color
ad2kgelp.ini c:\windows\system32\spool\drivers\w32x86\3
ad2kregp.dll c:\windows\system32\spool\drivers\w32x86\3
ad2kuigp.dll c:\windows\system32\spool\drivers\w32x86\3
adpdf6.ppd c:\windows\system32\spool\drivers\w32x86\3

What's a "ax", "icm", and "ppd" file extension anyway?
Are these _really_ drivers?

I want to delete them but I'm worried they are needed.
Do you know if we should delete these unsigned drivers immediately?

 

[Don Burn]

sigverif verifies that files are digitally signed, not everything is since
Microsoft does not all signing of all drivers. The ppd and icm are support
files for printer drivers, the ax is a support file for kernel streaming.

Verifier is a totally different tool. This is a tool to test and validate
drivers, it will perform a number of quality checks that will for a crash if
they are not correct. See Driver Verifier in the system documentation and
the Microsoft site for more details. Driver verifier is required to be run
to sign a driver.

 

[Guest]

Beware only relying on stop error messages and/or microsoft crash analysis.
I was recently steered towards bad video drivers, turned out to be a trashed
motherboard. Although the user stated no stability issues prior to antivirus
running out and multiple infections while substituting the video card for a
known unit multiple bulging/discharging capacitors were noted. I persisted
with swapping out and XP reloads until the only parts left were the case, cpu
and motherboard. Then I found this article.
http://www.pcstats.com/articleview.cfm?articleID=195
That pc is now sweet with its new S478 motherboard.

Cheers,

Peter.