0
1
The recent Microsoft patch against Meltdown isn't supposed to install unless the Antivirus software (if any) has previously set a specific registry key to signal it's compatible with the patch.
Somehow my laptop got the patch before the AV was updated and compatible. As a result boot is totally borked beyond the F8 boot loader screen which I can get into (but neither recovery nor windows will load), or booting off a USB install media. I'd rather not reinstall or run a repair install if possible.
I've run safe mode, prevent early AV, and other repair options, none work. Boot logging shows as expected that it freezes during driver load and this makes me even more sure it's the AV drivers.
I don't mind destroying the AV install as reinstalling AV is easy.
I've manually renamed the .sys files in windir\system32\drivers and also all program file/programdata folders for the AV, but its not just carrying on boot when it can't find them, it halts boot and reports it can't find the AV driver. That's actually a step up from just black screen and freeze, now I just need to prevent that from giving an error.
I can also enter text options such as /NOEXECUTE=OPTIN and /NOVGA, and I'm familiar with bcdedit, but I don't know if there are any useful options I can enter in this way, that would help prevent specific (or non-MS?) driver load.
So i suspect that in the end, I'll need to prevent the specific drivers loading, by editing the registry. But I don't know how to do this, that will actually stop them being loaded or started up, or not give an error if the AV's .sys files are renamed/moved/deleted. Driver startup, driver groups, driver filters etc are a black box to me, though regedit and system modding isn't.
If I know a driver's ".sys" filename, how do I get the OS to not even try to load it, or at least not even try to start it?
The OS is windows 8.1 x64 so its also possible there are WOW64 issues to consider in picking the right registry keys or files.
Stilez
Posted 2018-01-07T22:03:08.340
Reputation: 1 183
@Ramhound in WinRE he must use /Image:C: not online, online refers to WinRE i this case – magicandre1981 – 2018-01-08T16:48:58.937
Incidentally winRE (recovery) was borked too, so I used command prompt from a Wimdows install media. – Stilez – 2018-01-08T17:24:51.047
and this worked? were you able to remove the update and boot again? – magicandre1981 – 2018-01-12T16:55:13.853