Returnil Quirk

While playing around with the deletevolume test I came across this quirk.

If I use Process Explorer whilst in Returnil mode to kill crss.exe the pc instant blue screens and I have to hit the rest button and it reboots no probs back into XP with Returnil still active.

After restarting, Winpatrol shows a Kernel Fault Check has been added as an extra startup item.No big prob but I would have thought this wouldn't or shouldn't be the case?

 

It might be programmed to do that or windows may not function properly.

 

Here's the event viewer error with a minidump being created and saved to C:\WINDOWS after reboot with Returnil active before and after bsod/reboot.

 

Hi Franklin,
First, RVS performed as expected and designed. When a BSOD like this happens, RVS will allow Windows to create, save, and check the DUMP file but does not allow Windows to keep the autorun entry for the Microsoft error reporting feature following a reboot.

To verify this, check your autorun key for the Windows reporting feature after your system reboots to recover from your forced BSOD. The error and dump are preserved for troublshooting and support without allowing changes to the registry.

You can just delete the dump file if it is not needed...

Mike

 

OK, thanks for the explanation Mike.