Uninstall Virtual Network Adapter

NTDEV
1

Hi Guys,

I am trying to uninstall a virtual network adapter added by a malware (ndisvvan.sys). I have already removed the driver file and rebooted the computer. My code looks something like this:

hr = CoInitializeEx(NULL, COINIT_DISABLE_OLE1DDE | COINIT_APARTMENTTHREADED );
hr = pnc->QueryInterface(IID_INetCfgLock, (LPVOID *)&pncLock);
hr = pncLock->AcquireWriteLock(c_cmsTimeout, c_szSampleNetcfgApp, &szLockedBy);
hr = pnc->Initialize(NULL);
pnc->AddRef();
OboToken.Type = OBO_USER;
hr = pnc->FindComponent(szComponentId, &pncc);
hr = pncc->GetClassGuid(&guidClass);
hr = pnc->QueryNetCfgClass(&guidClass, IID_INetCfgClass, (void**)&pncClass);
hr = pncClass->QueryInterface(IID_INetCfgClassSetup, (void**)&pncClassSetup);
hr = pncClassSetup->DeInstall(pncc, &OboToken, NULL);

I have removed all error checking code for simplicity and shown only the functions to let you have an idea of what function sequence I am writing.

Now the problem:
The DeInstall() function fails with error code: NETCFG_S_STILL_REFERENCED

When I go to MyComputer> Properties> Hardware> DeviceManager> NetworkAdapters
I can see those adapters with yellow mark and when I try to right click uninstall from there it uninstalls properly. (I need to change the characteristics to 1 in reg key, otherwise it gives error saying this device may be required for booting.)

My Configuration is VS2008 on WinXP SP2.

In MSDN I came across these two things which I dont know will be helpfull or not.

  1. INetCfgComponentSetup::Removing will this be required before DeInstall()
  2. Shall I use INetCfgClass::EnumComponents instead of INetCfgClass::FindComponent

I am new to this and got this code from net, so I will request you to explain your solution. Thanks for your time.

Regards
Anand

2

If the component is a Net class (adapter) then remove it with SetupDi
functions (as demonstrated in DevCon) or from device manager (show hidden
device / show nonpresent devices) by selecting it and running ‘uninstall’.

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@hotmail.com
Sent: Friday, May 20, 2011 12:18 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Uninstall Virtual Network Adapter

Hi Guys,

I am trying to uninstall a virtual network adapter added by a malware
(ndisvvan.sys). I have already removed the driver file and rebooted the
computer. My code looks something like this:

hr = CoInitializeEx(NULL, COINIT_DISABLE_OLE1DDE | COINIT_APARTMENTTHREADED
);
hr = pnc->QueryInterface(IID_INetCfgLock, (LPVOID *)&pncLock);
hr = pncLock->AcquireWriteLock(c_cmsTimeout, c_szSampleNetcfgApp,
&szLockedBy);
hr = pnc->Initialize(NULL);
pnc->AddRef();
OboToken.Type = OBO_USER;
hr = pnc->FindComponent(szComponentId, &pncc);
hr = pncc->GetClassGuid(&guidClass);
hr = pnc->QueryNetCfgClass(&guidClass, IID_INetCfgClass, (void**)&pncClass);
hr = pncClass->QueryInterface(IID_INetCfgClassSetup,
(void**)&pncClassSetup);
hr = pncClassSetup->DeInstall(pncc, &OboToken, NULL);

I have removed all error checking code for simplicity and shown only the
functions to let you have an idea of what function sequence I am writing.

Now the problem:
The DeInstall() function fails with error code: NETCFG_S_STILL_REFERENCED

When I go to MyComputer> Properties> Hardware> DeviceManager>
NetworkAdapters
I can see those adapters with yellow mark and when I try to right click
uninstall from there it uninstalls properly. (I need to change the
characteristics to 1 in reg key, otherwise it gives error saying this device
may be required for booting.)

My Configuration is VS2008 on WinXP SP2.

In MSDN I came across these two things which I dont know will be helpfull or
not.

  1. INetCfgComponentSetup::Removing will this be required before DeInstall()
  2. Shall I use INetCfgClass::EnumComponents instead of
    INetCfgClass::FindComponent

I am new to this and got this code from net, so I will request you to
explain your solution. Thanks for your time.

Regards
Anand

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer