windowsantivirusndisnetwork-driver

antivirus NDIS filter removal


On our 1200 windows clients we are using KES 10 antivirus.

By error on some desktop workstation we installed the firewall component "klim6".

We need a silent uninstall. Not found within Kaspersky tools.

Which is the working and proper way ?

We need also the explanation of the different behaviour of these tools.

UPDATE : info from the INF file :

; KLIM6.INF -- NDIS Usermode I/O Driver

[version]

Class = NetService

DriverPackageType=Network

[Manufacturer]

%Klft%=KLFT,NTx86,NTia64,NTamd64


Solution

  • As you've noted, there are a variety of tools to work with .INF files. The reason is that there are different flavors of .INF, used for different purposes.

    I don't know if there's any official terminology, but here's the terminology that I use:

    There are other types of INFs used for Windows Drivers, e.g., storage minifilter-style, or upper/lower-filter style INFs. And other people use INFs for things that have nothing to do with Windows Drivers... so it's a confusing area.

    That being said, it's often a mistake to attempt to manually remove a driver. Usually an application's installer will install many 100's of things, only one of which is the driver. If you delete only the driver from an application, you could easily leave dangling bits that damage the system in obvious or subtle ways.

    If you really want to do this anyway, you should check the INF file. If it says Class=NET, then use devcon.exe. If it says Class=NETSERVICE, you should use NetCfg.exe.