none
How to clear the residues after uninstalling a ndis driver? RRS feed

  • Question

  • We wrote a NDIS miniport driver and a IM driver, sometimes after installing and uninstalling, we found some register keys were not deleted. For example, "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_XXXXX" (XXXXX is the miniport part of our IM driver), "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\YYYY" (YYYY is 4 digital numbers, and the content of the sub keys are the information of our miniport driver). We don't known why.

    With those register keys remain, some times our installing will fail. How can I clear those register keys?


    • Edited by firtank Monday, July 7, 2014 2:02 AM
    Monday, July 7, 2014 2:01 AM

Answers

  • these belong to the OS, you don't need to clean them up. leave them alone.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Monday, July 7, 2014 2:08 AM
  • We wrote a NDIS miniport driver and a IM driver, sometimes after installing and uninstalling, we found some register keys were not deleted. For example, "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_XXXXX" (XXXXX is the miniport part of our IM driver), "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\YYYY" (YYYY is 4 digital numbers, and the content of the sub keys are the information of our miniport driver). We don't known why.

    With those register keys remain, some times our installing will fail. How can I clear those register keys?


    those are intrinsic keys to windows

    might be an idea to use a separate and uniique GUID for each version of your driver to prevent clashes

    then you can use an off the shelf installer


    Corsair Carbide 300R with window
    Corsair TX850V2 70A@12V
    Asus M5A99FX PRO R2.0 CFX/SLI
    AMD Phenom II 965 C3 Black Edition @ 4.0 GHz
    G.SKILL RipjawsX DDR3-2133 8 GB
    EVGA GTX 6600 Ti FTW Signature 2(Gk104 Kepler)
    Asus PA238QR IPS LED HDMI DP 1080p
    ST2000DM001 & Windows 8.1 Enterprise x64
    Microsoft Wireless Desktop 2000
    Wacom Bamboo CHT470M
    Place your rig specifics into your signature like I have, makes it 100x easier to understand!

    Hardcore Games Legendary is the Only Way to Play!

    • Marked as answer by firtank Wednesday, September 3, 2014 6:44 AM
    Wednesday, July 16, 2014 6:39 PM

All replies

  • these belong to the OS, you don't need to clean them up. leave them alone.

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Monday, July 7, 2014 2:08 AM
  • Some times, those keys will cause performance problem when installing. And may cause our driver works abnormal. Even cause next installing failed.
    • Edited by firtank Monday, July 7, 2014 8:53 AM
    Monday, July 7, 2014 8:52 AM
  • Due to architectural deficiencies in the installer, there is no way to completely uninstall NDIS miniports (which is why the .Remove sections in the .INF file don't get called for miniport edge .INFs). You will need to write your driver and .INF file to ignore invalid/old entries in the registry

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Monday, July 7, 2014 7:32 PM
    Moderator
  • This is an instance where using a VM and resuming at a checkpoint is very useful and a lot less time consuming than restoring a backup

     -Brian


    Azius Developer Training www.azius.com Windows device driver, internals, security, & forensics training and consulting. Blog at www.azius.com/blog

    Tuesday, July 8, 2014 11:46 PM
    Moderator
  • Thank you for your replay.

    Yes, I can use VM to resuming the disk image at a clean point, but if a user who install/uninstall my software too much times, will get the same problem.

    Monday, July 14, 2014 3:27 AM
  • The most common cause of these registry keys remaining in after uninstall is when the NetCfg WriteLock is held during NIC uninstallation.  You can minimize this by avoiding holding the WriteLock for long periods of time, and especially don't hold the WriteLock while uninstalling a NIC [SetupDiCallClassInstaller(DIF_REMOVE,...)].

    Also, I believe that this QFE improves netcfg's ability to clean up some specific registry keys:  http://support.microsoft.com/kb/2966087 .  If you don't already have it, try installing it and seeing if the situation improves.

    But, as others on the thread have said - it's not really possible for your driver to "help" Windows manage its own internal state. The best you can do is to be careful with the NetCfg WriteLock.

    Monday, July 14, 2014 4:12 PM
  • Than you Jeffrey, one more question. Since you mentioned "SetupDiCallClassInstaller ...", is it possible to use SetupApi to install/uninstall NDIS IM driver?
    Wednesday, July 16, 2014 8:37 AM
  • No.  If you install it with NetCfg, then you have to uninstall it with NetCfg.

    Wednesday, July 16, 2014 6:27 PM
  • We wrote a NDIS miniport driver and a IM driver, sometimes after installing and uninstalling, we found some register keys were not deleted. For example, "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_XXXXX" (XXXXX is the miniport part of our IM driver), "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\YYYY" (YYYY is 4 digital numbers, and the content of the sub keys are the information of our miniport driver). We don't known why.

    With those register keys remain, some times our installing will fail. How can I clear those register keys?


    those are intrinsic keys to windows

    might be an idea to use a separate and uniique GUID for each version of your driver to prevent clashes

    then you can use an off the shelf installer


    Corsair Carbide 300R with window
    Corsair TX850V2 70A@12V
    Asus M5A99FX PRO R2.0 CFX/SLI
    AMD Phenom II 965 C3 Black Edition @ 4.0 GHz
    G.SKILL RipjawsX DDR3-2133 8 GB
    EVGA GTX 6600 Ti FTW Signature 2(Gk104 Kepler)
    Asus PA238QR IPS LED HDMI DP 1080p
    ST2000DM001 & Windows 8.1 Enterprise x64
    Microsoft Wireless Desktop 2000
    Wacom Bamboo CHT470M
    Place your rig specifics into your signature like I have, makes it 100x easier to understand!

    Hardcore Games Legendary is the Only Way to Play!

    • Marked as answer by firtank Wednesday, September 3, 2014 6:44 AM
    Wednesday, July 16, 2014 6:39 PM