Event ID 3004 — Kernel-mode Driver Validation
Updated: December 16, 2008
Applies To: Windows Server 2008 R2
Code Integrity checks each kernel-mode driver for a digital signature when an attempt is made to load the driver into memory. If the kernel-mode driver is not signed, the operating system might not load it. Whether an unsigned driver is loaded without a digital signature depends on the platform of the operating system.
- For x64-based computers, all kernel-mode drivers must be digitally signed.
- For x86-based or Itanium-based computers, the following kernel-mode drivers require a digital signature: bootvid.dll, ci.dll, clfs.sys, hal.dll, kdcom.dll, ksecdd.sys, ntoskrnl.exe, pshed.dll, spldr.sys, tpm.sys, and winload.exe.
Note: If a kernel debugger is attached to the computer, Code Integrity still checks for a digital signature on every kernel-mode driver, but the operating system will load the drivers.
|Product:||Windows Operating System|
|Message:||Windows is unable to verify the image integrity of the file %2 because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.|
Replace unsigned kernel-mode driver on x64-based operating system
Every kernel-mode driver must be digitally-signed on x64-based computers.
If the driver is not from Microsoft, you should consult the manufacturer to see if a digitally signed x64-based version is available. If a x64-based version of the file exists, you can update it by using Device Manager.
If the kernel-model driver is from Microsoft and is included with the initial installation of Windows, you should replace the driver by using Startup Repair.
To use Startup Repair to replace a kernel-mode driver:
- Insert the Windows product disc.
- Restart the computer.
- When prompted, press any key to start the computer from the Windows product disc.
- Choose the appropriate language settings, and then click Next.
- Click Repair your computer.
- Select the operating system you want to repair, and then click Next.
- On the System Recovery Options menu, click Startup Repair.
- When Startup Repair is complete, restart the computer.
You can verify that a kernel-mode driver was successfully validated and loaded by checking its driver status using the command prompt.
To perform this procedure, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority.
To verify a kernel-mode driver was successfully validated and loaded:
- Click Start, point to All Programs, point to Accessories.
- Right-click Command Prompt, and then click Run as administrator.
- If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
- Type sc query type= driver, and then press ENTER.
- In the list, find the appropriate driver and ensure that 4 RUNNING is displayed in the STATE column.
Note: If you know the driver name, type sc querydriver, where driver is the name of the driver file without the extension, at the command prompt, and then press ENTER.