How to de-couple hijacked boot drivers?

Discussion in 'backup, imaging & disk mgmt' started by MonarchX, Apr 27, 2019.

  1. MonarchX

    MonarchX Registered Member

    Joined:
    Apr 27, 2019
    Posts:
    14
    Location:
    Here
    I've always used bootable Acronis True Image flash drive to make drive images because it required no installation. Perfoming installation, in case of Acronis True Image, meant having to deal with epic number of new services, drivers, other bloatware, and issues with removing it all, using CleanUp Tool, etc.

    I fooled myself into thinking that AOMEI Backupper installation was less invasive and yet I was unable to fully uninstall it. There is a single driver file - "C:\system32\ambakdrv.sys" that I can't get rid of because removing it manually or via registry or via Autoruns results in BSOD during OS boot with "INACCESSIBLE BOOT DEVICE" error... ambakdrv.sys is a boot driver (boots with OS). I don't quite understand how a driver can hook itself onto OS like that. OS doesn't need it to boot, yet won't boot without it. Removing all other AOMEI Backupper files, drivers, and registry entries produced no issues.

    My OS is Windows 10 x64 LTSC 1809-17763.437. I heard people here are experts on such complexities. I hope I can get some answers!
     
  2. pandlouk

    pandlouk Registered Member

    Joined:
    Jul 15, 2007
    Posts:
    2,976
    Welcome to the forums. Check if the driver of AOMEI is inserted as an upperfilter or lowerfilter in one of the locations in bold (you need to search the registry with the ClassGuid's).
    e.g.for diskdrive you search for "{4d36e967-e325-11ce-bfc1-08002be10318}" in the registry. If it is placed there you delete the entry of "ambakdrv.sys," from the upperfilters or lowerfilters (wherever it exists) reboot the system and then uninstall the driver and reboot again.

    important: Do not delete the UppperFilters or LowerFilters! Only modify the key.
    Panagiotis
    https://docs.microsoft.com/en-us/wi...ned-device-setup-classes-available-to-vendors
     
  3. MonarchX

    MonarchX Registered Member

    Joined:
    Apr 27, 2019
    Posts:
    14
    Location:
    Here
    It worked! Thanks! I got rid of all the registry entries and the file after removing the upper filter entry and rebooting. No issues now!
     
  4. pandlouk

    pandlouk Registered Member

    Joined:
    Jul 15, 2007
    Posts:
    2,976
    You are welcome.

    If you ever encounter another BSOD when removing drivers usually is caused because windows tries to load the driver in one of the above locations does not find it (since it was removed) causing a kernel panic. Imaging apps use one of the locations in bold to load their drivers early during the boot.

    Panagiotis
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.