StartService fails with ERROR_FILE_NOT_FOUND

NTDEV
1

We have a driver that loads at system start. Then we unload it and try to start it using SC, and it returns ERROR_FILE_NOT_FOUND.

I stepped through our DriverUnload routine in the debugger and verified that it gets called. Resources are getting destroyed as expected. We are also running all the usual Driver Verifier options that would trigger a BSOD if we failed to free something.

Here are a few more clues:

  1. The lm command shows the driver is still loaded.
  2. WinObj does not show the device objects that were created by the driver nor the driver object.

I am guessing that somebody has a reference to the driver but wouldn’t that cause the driver object to stick around too?

2

The problem was caused by a failure to remove some WFP callout objects. Since the memory was being charged to the OS, Verifier could not deduce that we were leaking.