Search code examples
windowsantivirusndisnetwork-driver

antivirus NDIS filter removal

On our 1200 windows clients we are using KES 10 antivirus.

By error on some desktop workstation we installed the firewall component "klim6".

We need a silent uninstall. Not found within Kaspersky tools.

Which is the working and proper way ?

  • RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultUninstall 132 KES10.inf
  • NETCFG.EXE -v -u KLIM6
  • devcon.exe remove =net *klim6*

We need also the explanation of the different behaviour of these tools.

UPDATE : info from the INF file :

; KLIM6.INF -- NDIS Usermode I/O Driver

[version]

Class = NetService

DriverPackageType=Network

[Manufacturer]

%Klft%=KLFT,NTx86,NTia64,NTamd64

Solution

  • As you've noted, there are a variety of tools to work with .INF files. The reason is that there are different flavors of .INF, used for different purposes.

    I don't know if there's any official terminology, but here's the terminology that I use:

    • DefaultInstall-style INFs. Use "rundll32.exe SetupApi.dll,InstallHinfSection" to work with these. You can identify this style of INF because they have "[DefaultInstall]" in them.
    • PNP-style INFs. Use pnputil.exe (built-in, so more convenient) or devcon.exe (more powerful) to work with these. You can identify PNP-style INFs because they have a "[Manufacturer]" section, and they are not NetCfg-style INFs.
    • NetCfg-style INFs. Use NetCfg.exe to work with these. You can identify NetCfg-style INFs by the line Class=NETTRANS or Class=NETSERVICE or Class=NETCLIENT. Only those 3 classes are NetCfg-style INFs -- in particular, Class=NET is not a NetCfg-style INF; it is a PNP-style INF.

    There are other types of INFs used for Windows Drivers, e.g., storage minifilter-style, or upper/lower-filter style INFs. And other people use INFs for things that have nothing to do with Windows Drivers... so it's a confusing area.

    That being said, it's often a mistake to attempt to manually remove a driver. Usually an application's installer will install many 100's of things, only one of which is the driver. If you delete only the driver from an application, you could easily leave dangling bits that damage the system in obvious or subtle ways.

    If you really want to do this anyway, you should check the INF file. If it says Class=NET, then use devcon.exe. If it says Class=NETSERVICE, you should use NetCfg.exe.