Jump to content


 

Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Can't remove WAN Miniports!

Started by gfreed , Dec 29 2009 11:56 PM

  • Please log in to reply
18 replies to this topic

#1 gfreed

gfreed

    Member

  • Members
  • PipPip
  • 16 posts
  • Gender:Male
  • Location:Seattle

Posted 29 December 2009 - 11:56 PM

WinXp, Service pack2

Attached File  Capture_2.jpg   94.27K   31 downloads

I have these wan miniports i can't remove. I have run every anti-virus program i can think of and i found a few odds and ends but nothing active. when i try to remove these i get something like, Failed to un-install this device. This device may be used to boot this computer. I found some registry keys "TM_PassthruMP" that look very delete-able! I seriously doubt these miniports are being used for anything so i should be able to remove them.

Any ideas?

Edited by gfreed, 30 December 2009 - 03:41 PM.

 

  • BC Ads
  • BleepingComputer.com

#2 ThunderZ

ThunderZ

    Forum Addict

  • Deactivated
  • PipPipPipPipPipPip
  • 4,454 posts
  • Gender:Male

Posted 30 December 2009 - 07:36 AM

Are or were you running Trend Micro AV? Some software installs items that are seen as device drivers.

The WAN miniports are a legitimate part of your PC. Do not remove them.

Edited by ThunderZ, 30 December 2009 - 11:40 AM.

#3 hamluis

hamluis

    Moderator

  • Moderator
  • PipPipPipPipPipPip
  • 36,301 posts
  • Gender:Male
  • Location:Killeen, TX

Posted 30 December 2009 - 11:13 AM

I think he meant "do not" :thumbsup:.

http://www.tomshardware.com/forum/51075-45-what-miniport

Louis

Edited by hamluis, 30 December 2009 - 11:13 AM.

Am I Infected, What Do I Do?
Preparation Guide, Malware Log Topics
Using The Report Button
Misplaced Malware Logs
Discussion Forum Rules

#4 ThunderZ

ThunderZ

    Forum Addict

  • Deactivated
  • PipPipPipPipPipPip
  • 4,454 posts
  • Gender:Male

Posted 30 December 2009 - 11:42 AM

:thumbsup: Thanks Louis. Was typing to fast\doing to much\was still on my first cup of coffee.

Corrected my post.

#5 gfreed

gfreed

    Member

  • Members
  • PipPip
  • 16 posts
  • Gender:Male
  • Location:Seattle

Posted 30 December 2009 - 04:34 PM

Are or were you running Trend Micro AV? Some software installs items that are seen as device drivers.

The WAN miniports are a legitimate part of your PC. Do not remove them.


Yes i was running Trend Micro's on-line virus scanner. I guess it was opening a miniport to communicate.
The reason i'm so hot to remove the minports is that besides looking bad my bootlog looks like my computer is attempting to load these miniports over and over again.

Attached File  ntbtlog.zip   16.26K   21 downloads

This bootlog is huge because i think the os is trying to load these messed up miniports. My Winsock maybe messed up too.
Its seems i have a few thir party additions too my winsock. I'm currently attempting to establish a relationship between winsock an miniports. Found a interesting command "netsh" to play with. Any input you have i would be grateful for, thanks!

#6 ThunderZ

ThunderZ

    Forum Addict

  • Deactivated
  • PipPipPipPipPipPip
  • 4,454 posts
  • Gender:Male

Posted 31 December 2009 - 10:18 AM

Your screen capture shows two of them disabled. I will assume you did that while trying to uninstall them. The other 3 with the ! probably can not start. Might be due to the disabled ones. Though I`m not sure why Trend Micro is still showing up if you ran only the on-line scan.

Just checked several of my PCs for verification. While they are named differently, probably due to type of ISP used = cable, DSL. I have 5 miniports as well. I`m guessing you are on cable. Just switched to DSL which uses PPPoE and I noticed that that had been changed\add`d as (Descriptions) on one of my miniports.

Some info on WAN miniports from MS.

#7 gfreed

gfreed

    Member

  • Members
  • PipPip
  • 16 posts
  • Gender:Male
  • Location:Seattle

Posted 31 December 2009 - 02:55 PM

Your screen capture shows two of them disabled. I will assume you did that while trying to uninstall them. The other 3 with the ! probably can not start. Might be due to the disabled ones. Though I`m not sure why Trend Micro is still showing up if you ran only the on-line scan.

Just checked several of my PCs for verification. While they are named differently, probably due to type of ISP used = cable, DSL. I have 5 miniports as well. I`m guessing you are on cable. Just switched to DSL which uses PPPoE and I noticed that that had been changed\add`d as (Descriptions) on one of my miniports.

Some info on WAN miniports from MS.


Yes I have disabled the first two miniports because they show the (!) when enabled. I indeed tried to remove them and they will not delete. The only Trend Micro product i have ever used was their on-line scanner. I've read that he computers "winsock" controls wan miniports in that the winsock calls for each miniport. I have a number of ways to reset the winsock but i would like to understand what i would loose by resetting it. I would like to view the contents of the winsock and choose what i want to remove not just reset the thing.

I've also found registry keys associated with WAN Miniports specifically the Trends Micro miniports. i'm told that the registry is used too lock out users from changing or removing miniports . The key is folder"tm_passthrump" subkey folder 0000. I'm not sure how to change the key to get the desired results. Thought of simply deleting the key altogether as i know this miniport isn't being used, but i'm not sure that this action is a good one.


The reason i'm after these miniports is because of the effect they appear to be having on the boot process. My computer appears to be spending allot of time attempting to load the miniports, slowing boot time. Attached File  ntbtlog.zip   16.26K   22 downloads

Any info you can come up with would help thanks!

#8 ThunderZ

ThunderZ

    Forum Addict

  • Deactivated
  • PipPipPipPipPipPip
  • 4,454 posts
  • Gender:Male

Posted 31 December 2009 - 03:11 PM

Let me see if I understand this. The log showed these problems prior to you disabling them? Prior to you disabling them they showed the !? This accrued after an infection and subsequent clean-up?

#9 gfreed

gfreed

    Member

  • Members
  • PipPip
  • 16 posts
  • Gender:Male
  • Location:Seattle

Posted 31 December 2009 - 05:41 PM

Let me see if I understand this. The log showed these problems prior to you disabling them? Prior to you disabling them they showed the !? This accrued after an infection and subsequent clean-up?


I don't think i ever had a infection or if i did my anti-virus caught it and killed it. One day i notice these miniports having the (!) and tried to remove them. When i couldn't remove them i disabled them. Now i got more of these mini ports and i seem to get them when i use Trend Micro's on-line scanner. If you look at the ntbtlog you will see that these miniports are being reloaded multiple times slowing the boot process (i think)).

I have scanned this computer to death looking for viruses and haven't found any. I can give you a hijackthis report or malwarebytes report or what ever you would like.

thanks!

#10 ThunderZ

ThunderZ

    Forum Addict

  • Deactivated
  • PipPipPipPipPipPip
  • 4,454 posts
  • Gender:Male

Posted 31 December 2009 - 05:52 PM

Whether they are slowing the boot process or not they are required. The fact they have a ! by them possibly\probably indicates a corrupt\improperly installed driver.

The OS knows it is supposed to load them and will try several times before giving up. This is what I believe is being shown in the log. Have you tried updating or uninstalling\reinstalling the drivers?

Removing them completely is not the fix.

#11 gfreed

gfreed

    Member

  • Members
  • PipPip
  • 16 posts
  • Gender:Male
  • Location:Seattle

Posted 31 December 2009 - 06:54 PM

Whether they are slowing the boot process or not they are required. The fact they have a ! by them possibly\probably indicates a corrupt\improperly installed driver.

The OS knows it is supposed to load them and will try several times before giving up. This is what I believe is being shown in the log. Have you tried updating or uninstalling\reinstalling the drivers?

Removing them completely is not the fix.


Ok i got rid to two miniports by updating the drivers. The remaining miniports can not be updated or un-installed. yes i'm not entirely sure but i think the winsock calls out the network settings and the os will try many times to install whats being called out. The Trends Micro miiniports need to "go away" because i have no software by them on this computer.

Thank you for helping!

#12 ThunderZ

ThunderZ

    Forum Addict

  • Deactivated
  • PipPipPipPipPipPip
  • 4,454 posts
  • Gender:Male

Posted 31 December 2009 - 07:11 PM

While we will not make the miniports go away completely I do believe we can get the Trend Micro references to go away.

WARNING. Tread very carefully and only remove items after careful research. I would only look under Non-Plug and Play Drivers in this case. Removing the wrong item(s) can and will cause problems with your OS\PC\various programs, hardware components.

When you install a device driver on a Windows XP machine, the operating system loads that driver each time the computer boots regardless of whether the device is present—unless you specifically uninstall the driver. This means that drivers from devices that you have long since removed from your system may be wasting valuable system resources.

Follow these steps to view and remove these unnecessary device drivers:

1. Press [Windows]+[Break] to bring up the System Properties dialog box.
2. Select the Advanced tab and click the Environment Variables button.
3. Click the New button below the System Variables panel.
4. In the New System Variable dialog box, type devmgr_show_nonpresent_devices in the Variable Name text box and 1 in the Variable Value text box.
5. Click OK to return to the System Properties dialog box and then click OK again.
6. Select the Hardware tab and click the Device Manager button.
7. In Device Manager, go to View | Show Hidden Devices.
8. Expand the various branches in the device tree and look for the washed out icons, which indicate unused device drivers.
9. To remove an unused device driver, right-click the icon and select Uninstall.

#13 gfreed

gfreed

    Member

  • Members
  • PipPip
  • 16 posts
  • Gender:Male
  • Location:Seattle

Posted 31 December 2009 - 08:22 PM

That was so cool, potentially dangerous but a good supplementary piece of trouble-shooting knowledge. Under "Non-plug & playable drivers" i found a trens micro driver. I removed it an refreshed the device manager and still can't remove those darn miniports but wait! I found something interesting.

Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)

Interesting! Maybe i need to look in the reg! I know that the reg folders are unique with a key folder called tm_passthrump. The two drivers are list in sub folders 0000 & 0001! I often manually remove programs by going to the reg the removing entries associate with the program i'm removing. Just an idea! :thumbsup:

thank you!

#14 ThunderZ

ThunderZ

    Forum Addict

  • Deactivated
  • PipPipPipPipPipPip
  • 4,454 posts
  • Gender:Male

Posted 31 December 2009 - 08:50 PM

A couple things I would try prior to playing in the registry. Re-start the PC. If the Trend Micro references are still there try to uninstall again and\or update. Even though you refreshed the view sometimes closing Device Manager or a PC restart is required even if you were not prompted to do so on the uninstall of the hidden device.

One other thought. I might venture a peak into Network devices with Show hidden devices checked, if you have not already. I do`t think you will find any Trend Micro devices listed, other then the two we know of, but may be worth a look. Again, tread carefully.

Edited by ThunderZ, 31 December 2009 - 08:54 PM.

#15 gfreed

gfreed

    Member

  • Members
  • PipPip
  • 16 posts
  • Gender:Male
  • Location:Seattle

Posted 31 December 2009 - 10:17 PM

Found another interesting thing about the trend micro miniport. When i hit detail i get a strange statement. "no driver files are required or have been loaded for this device."

SO IF THERE IS NO DRIVER INSTALLED?
It can't be a messed up driver!

There is no Trend Micro anything in this computer anymore.

So i wonder what calls it up, i enjoy problems like this!

Keeps my brain going! :thumbsup:
Back to Windows XP Home and Professional


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users


  1. BleepingComputer.com
  2. → Operating Systems
  3. → Windows XP Home and Professional
  4. Privacy Policy
  5. Rules ·