Unsigned windows driver

Question

After regular Windows update I noticed that my video card's driver had suddenly stopped working. I made a rollback to a previous system backup and took a look at this video cards driver's information:

AMD's driver is not signed. And it is pretty strange. I Googled for a little bit and figured out that this type of video card is obsolete, but mustn't it always have a signature regardless?

To me, it looks like a faked driver which may being used to turn into a rootkit.

---

_{Sorry that the screenshot is in Russian, but it should not interfere with understanding the point}

Answer 1

It is not strange, it is normal. At that date drivers were not mandatory digitally signed, that means users could install alternate drivers like the old Omega drivers (good thing).

After Windows Vista x64, signing became officially mandatory and the system would prevent unsigned drivers from being installed (bad thing from alternate drivers perspective, good thing from security perspective).

The check if the files are authentic you could compare them to the ones that are in the installation kit (you will have to manually unpack them) if you still have it.

Scanning your system for malware/spyware is something you should do in any case. Get free tools like super-any-spyware, spyware terminator, hitman or similar and perform a full scan.

Answer 2

Unsigned device drivers used to be extremely common in the XP-Vista-partially 7 days. Obtaining a Microsoft WHDL driver signature comes with a monetary and time cost, so hardware companies releasing frequent updates used to sometimes ignore it and rely on the user to click through. This includes AMD.

Driver signatures are only enforced on new OS installed after July 26, 2016: https://blogs.msdn.microsoft.com/windows_hardware_certification/2016/07/26/driver-signing-changes-in-windows-10-version-1607/

The driver in question predates this policy, so the developer didn't have to have it signed.

The general case for such drivers is not to be malicious, unless later modified by malware. The most reasonable thing to do in such a situation is to uninstall the current driver, do a malware check just in case, download the latest drivers from AMD, and install them.

Answer 3

Yes, no signature means it could be malicious. Here is some background on it, http://www.digitaltrends.com/computing/microsoft-windows-10-version-1607-kernel-mode-drivers-rule/. To sum up, Microsoft started to enforce a policy that does not allow installation of unsigned drivers, but only for Windows 10 1607 and up. Yours must be an earlier version.