Solved Latest Patch Tuesday update - Kernel driver issue

wiganken · Aug 9, 2023

After ‘Patch Tuesday’ Windows update the following pop-up appeared on my DELL laptop after signing-in on my (Administrator) profile. It does not happen on ‘Admin’ or other profiles. Also it did not happen on my other HP desktop machine on any profile: -

Drviver cannot load on this device DELL.png

A search for this file in File Explorer shows this driver as located C:\Windows\Sys\WOW64\drivers.

Since it only started to appear after ‘Patch Tuesday’ updates maybe it will get fixed in a future update but is anyone else seeing this?

Updates installed: -

glasskuter · Aug 9, 2023

I suggest uninstalling HWInfo using Revo Uninstaller or similar app that will remove all traces of the program. FPS Monitor application also uses that driver according to HWInfo.
forum. Unable to load a driver on this device - Driver: HWiNFO AMD64 Kernel Driver

wiganken · Aug 9, 2023

This driver appears to be AMD related but the DELL laptop has an Intel Core i5 CPU and “Intel UHD Graphics 620” display adapter. I know I can tick the box that shows "Do not show this message again" so it seems okay to do this or MS would not provide the option.
I wonder if this kernel driver is generic and on all Windows systems but does not apply to my DELL machine? I don't want to uninstall something that sounds like a core component and break Windows.

Fabler2 · Aug 9, 2023

Get the latest version( 7.60.5170) after removing the old, see this:

Unable to load a driver on this device - Driver: HWiNFO AMD64 Kernel Driver

hi, today after updating my pc this message popped up on the screen. Could you help me understand what it is and above all how to fix it? Thank you Translation error: The driver cannot be loaded because it is not compatible with a Windows security mitigation called Hardware-enforced stack...

www.hwinfo.com

Bree · Aug 9, 2023

wiganken said:
This driver appears to be AMD related....

No, the text 'AMD64' refers to the processor architecture it is intended for. As AMD invented the 64 bit architecture which Intel then copied 'AMD64' means it is for both (think of it as x64 if it helps :wink:

).

x86-64 (also known as x64, x86_64, AMD64, and Intel 64) is a 64-bit version of the x86 instruction set, first released in 1999....

....Historically, AMD has developed and produced processors with instruction sets patterned after Intel's original designs, but with x86-64, roles were reversed: Intel found itself in the position of adopting the ISA that AMD created as an extension to Intel's own x86 processor line.

x86-64 - Wikipedia

en.wikipedia.org

wiganken · Aug 9, 2023

@Fabler2 - Thanks but if you look at my OP #1 you will see that v8.98.0.0 is installed, which seems to me to be later than what you say is the latest version v7.60.5170?

I ran the Tuneup.bat file and the first run of sfc /scannow 'Found corrupt files and successfully repaired them' but this has not stopped the popup. All other operations were okay with 'No component store corruption' and 'No integrity violations'.

Why only on my profile on the DELL laptop? Could it be that it is only this one profile that is trying to load HWiNFO64A.sys? If so then why just mine and not others?

Ah well, if it is blocked from loading and I see no issues as a result then I might as well tick the "Do not show this message again" box.

It would be nice to know what is affected by it being blocked from loading.

Incidentally this file cannot be found anywhere on my HP desktop machine running Windows 11 Pro version so maybe it is DELL specific. Just guessing.

Fabler2 · Aug 9, 2023

wiganken said:
@Fabler2 - Thanks but if you look at my OP #1 you will see that v8.98.0.0 is installed, which seems to me to be later than what you say is the latest version v7.60.5170?

I ran the Tuneup.bat file and the first run of sfc /scannow 'Found corrupt files and successfully repaired them' but this has not stopped the popup. All other operations were okay with 'No component store corruption' and 'No integrity violations'.

Why only on my profile on the DELL laptop? Could it be that it is only this one profile that is trying to load HWiNFO64A.sys? If so then why just mine and not others?

Ah well, if it is blocked from loading and I see no issues as a result then I might as well tick the "Do not show this message again" box.

It would be nice to know what is affected by it being blocked from loading.

Incidentally this file cannot be found anywhere on my HP desktop machine running Windows 11 Pro version so maybe it is DELL specific. Just guessing.

That's odd. The site says 7.6. I'm not running any Beta software.

stormy13 · Aug 9, 2023

wiganken said:
@Fabler2 - Thanks but if you look at my OP #1 you will see that v8.98.0.0 is installed, which seems to me to be later than what you say is the latest version v7.60.5170?

You're confusing a file version number with a program version number.

wiganken · Aug 10, 2023

@Fabler2 - Okay, I think I know what is happening here: -
You are showing me an installer but there is no HWiNFO program or app installed on my DELL and I have not uninstalled anything called HWiNFO so I do not know where it has come from. Except that the latest Windows update has caused it.
When I search the DELL registry for HWiNFO it finds 12 entries but none are program/app related. See photo.
Does anyone know what these entries relate to?
If there are any registry experts out there can I delete them or should I just tick the box that shows "Do not show this message again"?

Incidentally it is now happening with the other 'Administrator' account as well as my own 'Administrator' account but not on the 'Standard user' accounts.

wiganken · Aug 10, 2023

I suppose I could create a new full image and try deleting the registry entries then I can always restore the image if I have problems afterwards.

x BlueRobot · Aug 10, 2023

That driver has probably been added to the driver blacklist: Microsoft recommended driver block rules - Windows Security

You should be able to delete those registry entries without causing any issues, however, I would recommend that you do using the following commands from an elevated command prompt:

Code:

sc stop HWiNFO32
sc config HWiNFO32 start= disabled

Then reboot your machine. Afterwards, delete the service using the following:

Code:

sc delete HWiNFO32

You may want to load your DRIVERS hive and then search for the driver under there as well.

Ghot · Aug 10, 2023

wiganken said:
I suppose I could create a new full image and try deleting the registry entries then I can always restore the image if I have problems afterwards.

That's a very good use of backup software.
Make a fresh backup... THEN start playing around with things.

Sometimes it's hard to make the jump from just running a program, to using it as a tool.

For clever use of backup software, above and beyond... you have been awarded...

wiganken · Aug 10, 2023

@x BlueRobot - Thank you. That could be the likely cause. It fits with the fact that there are only registry entries and no installed program/app.

But what do you mean by "You may want to load your DRIVERS hive and then search for the driver under there as well"? How do I do this?

Also your code shows HWiNFO32 whereas the issue I am having is with HWiNFO64A. Is this significant?

I may try it when I am sure I know what I am doing.

x BlueRobot · Aug 10, 2023

You can load it using the following from command prompt:

Code:

reg load HKLM\DRIVERS %systemroot%\System32\config\DRIVERS

I usually then do a FRST registry search for the driver name. Please see an example post here.

wiganken · Aug 10, 2023

wiganken said:
Also your code shows HWiNFO32 whereas the issue I am having is with HWiNFO64A. Is this significant?

Are you able to clarify this please?

zbook · Aug 10, 2023

Please run the V2 log collector and post a share link into this thread using one drive, drop box, or google drive.

BSOD - Posting Instructions

BSOD - Posting Instructions This will show you how to help provide needed information about your system and dump files. It will not contain any personal or sensitive information about you or your data. To get better help with your Windows BSOD issue, please read these instructions and follow...

www.elevenforum.com

x BlueRobot · Aug 10, 2023

wiganken said:
Are you able to clarify this please?

HWiNFO32 is the name of the service which is what the sc command is designed to manage. On the other hand, HWiNFO64A.sys is the name of the driver and is what you what search for in your registry.

wiganken · Aug 10, 2023

x BlueRobot said:
That driver has probably been added to the driver blacklist: Microsoft recommended driver block rules - Windows Security

Okay, after 8 hours of process of elimination I conclude that you are 100% correct.
Method: - I restored to an image before installing KB5029263 and no popup. Then I updated everything else one-by-one with no problems but as soon as I updated to latest Windows via KB5029263 the popup came back. Seems conclusive that the culprit is Microsoft. But only on the DELL machine?

To avoid any more hassle I decided to tick the "Do not show this message again" box. I thought it easier and safer to do this rather than delete the registry entries. Incidentally there are now only 5 entries relating to HWiNFO64A. Before I restored from an image there were 12?

Unless the popup returns I'll call this solved. This forum is filled with helpful people. Thank you all.

PenPusher · Aug 11, 2023

HW Info runs fine on my m/c, no messages at all so far.

wiganken · Aug 12, 2023

@PenPusher - It may be DELL specific or maybe I installed some diagnostic software at some stage and then uninstalled it and these drivers are left-over traces. Just guessing but all is okay now that I have dismissed the popup.

Solved Latest Patch Tuesday update - Kernel driver issue

Well-known member

My Computers

aka Mama Glass

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Account Closed

My Computer

Well-known member

My Computers

Well-known member

My Computers

Account Closed

My Computer

Well-known member

My Computers

Well-known member

My Computer

Account Closed

My Computer

Well-known member

My Computers

Well-known member

My Computer

Well-known member

My Computers

Similar threads