mchInjDrv.sys has been blocked from loading due to incompatibility

Let me know if there is a better place to post this.

Short version: Windows\system32\Drivers\mchInjDrv.sys has been blocked from loading due to incompatibility

The few other posts that I have found have "suspected malware", but my machine appears clean, and several different anti-virus and anti-spyware products (not running at the same time) all bless the machine.

Any ideas?

Complete: \??\C:\Windows\system32\Drivers\mchInjDrv.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Details:
-System
-Provider[ Name] Application Popup
-EventID1060[ Qualifiers] 49152
Level2Task0Keywords0x80000000000000-TimeCreated[ SystemTime] 2010-07-05T08:13:30.992504900Z
EventRecordID10120ChannelSystemComputerGatewayDX4831Security
-EventData
\??\C:\Windows\system32\Drivers\mchInjDrv.sys000000000200300000000000240400C0000000006B0300C00000000 0000000000000000000000000
Binary data:

In Words
0000: 00000000 00300002 00000000 C0000424
0008: 00000000 C000036B 00000000 00000000
0010: 00000000 00000000

In Bytes
0000: 00 00 00 00 02 00 30 00 ......0.
0008: 00 00 00 00 24 04 00 C0 ....$..À
0010: 00 00 00 00 6B 03 00 C0 ....k..À
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Seems many security apps have a problem with this file. See these pages.

mchinjdrv.sys deleted from seemingly legit program - Wilders Security Forums

What on erth is MCHINJDRV? - MajorGeeks Support Forums

Kaspersky Lab Forum > please help virus?

Read them.

They only say that a probably legiitmate program installed it and possibly a virus is using it.

My operating enivronment is NOT complaining that it contains a virus.

Further research into my event log suggests that something is corrupt.

Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mchInjDrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

and

The following fatal alert was generated: 10. The internal error state is 10.

-System
-Provider[ Name] Schannel[ Guid] {1F678132-5938-4686-9FDC-C8FF68F15C85}
EventID36888Version0Level2Task0Opcode0Keywords0x8000000000000000-TimeCreated[ SystemTime] 2010-07-05T07:19:47.167279000Z
EventRecordID10094Correlation-Execution[ ProcessID] 1172[ ThreadID] 1220
ChannelSystemComputerGatewayDX4831-Security[ UserID] S-1-5-18

-EventData
AlertDesc10ErrorState10

and

Activation context generation failed for "c:\Windows\Installer\{67E03279-F703-408F-B4BF-46B5FC8D70CD}\WksWP.exe". Dependent Assembly msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0" could not be found. Please use sxstrace.exe for detailed diagnosis.

which is where this stuff started.

I removed Microsoft Works about the time these problems started.

Yes...the idea was to point you to the possible sources of this particular file, unless you know already of course.

Thanks, I don't know. It would be more useful to know why the OS thinks it has a problem, what the problem is, and resolve it. Especially if the problem originated at a point UNINSTALLING software.

Hey, I understand we should all like to know the source of potential problems, but they can occur at any point in time recent or long past. The goal is the fix, not finger pointing.

Even knowing a culprit, or potential culprit, an uninstall of every application that did not come with the OS can leave traces behind. I am looking to diagnose what the OS wants, as it is doing a poor job of communicating it's shortfall.

See, the event data says Security, in other words that file is being perceived- rightly or wrongly- as a security threat. The reason could be anything, it could be a false alarm, it could be an unsigned file. Now, that can be known only to the software developer or some experts on the matter, that is why it is relevant to know what application is using this file. if you read the links I posted, you'll know that this driver is used by several apps, I dont know whether you have any of those on your machine.

If its a driver signing issue, you can try the Driver Signature Enforcement Overrider.

Bill2 said:

If its a driver signing issue, you can try the Driver Signature Enforcement Overrider.

Thanks, checking that out now.

Bill2 said:

...the event data says Security, in other words that file is being perceived- rightly or wrongly- as a security threat.

Security threats include not only perceived threats of invasion, but also all forms of actual corruption. The security issue is stability. Perhaps there should be a separate Sanity subsytem limited to health and integrity which are fundamental to higher level functions of rule enforcements and violations.

soho1 said:

Bill2 said:

If its a driver signing issue, you can try the Driver Signature Enforcement Overrider.

Thanks, checking that out now.

That did it. Looks like problem resolved. Nice article.

OK, I am still getting this problem once in a while.

What I have since found is this (reported in the EventLogs under Applications & Service Logs .... CodeIntegrity/Operational

Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mchInjDrv.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Also, I have tracked back the start of these errors to when I performed a system restore.

So, what causes "file hash could not be found on the system" and how would I check it? CHKDSK reports NO errors.

Aside: I have noticed some utilities, including Windows Backup, occasionally reporting that the system could not locate a file. From the file name, I would have guessed that no such file exists. For example Version[1].htm not found. Searching for Version*.htm, I have not found any. Another example: r03022223110[1].png which sounds like some temp file. In almost every case, a "[1]" precedes the .ext in the file name.