cancel
Showing results for 
Search instead for 
Did you mean: 
kink80
Level 12

WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport

I had a machine that was newly imaged and received HIPS 8.0.0.1919 from the ePO server. When the machine was transported to another facility for installation the machine would not get an IP from any jack within the facility. I noticed in the Device Manager there was an warning about a  WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport. The warning stated that "Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39) I have attached some screenshots. In the Driver you can see it references 7.0.0.955 as the version. There also seems to be an additional Service listed called McAfee HIPSCore Service that is set to Automatic but it is not running. Is this a holdover from HIPS 7.0.0.955? If so how did it get there when HIPS 8.0.0.1919 was the only HIPS version installed? Thanks.

Message was edited by: kink80 on 3/21/12 2:21:30 PM GMT-06:00

Message was edited by: kink80 on 3/21/12 2:23:28 PM GMT-06:00
0 Kudos
17 Replies
McAfee Employee

Re: WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport

This is a HIPS 7.0 driver and service.  It appears as though HIPS 7.0 was installed on this system as some point and probably not removed properly.

0 Kudos
kink80
Level 12

Re: WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport

So is the driver version consistent with the HIPS version that was installed? Also will this remnant of HIPS 7 cause any issues? If so how would I go about removing the remaining pieces of HIPS 7?

0 Kudos
McAfee Employee

Re: WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport

HIPS 8.0 does not install these driver versions, so yes, HIPS 7.0 was installed at some point.  I'm not sure if it would cause any issues, but if it did, you might see network connectivity issues.  Best to remove all the HIPS 7.0 items, to be sure. 

  • Uninstall HIPS 8.0 from the system.
  • Reboot.
  • Perform manual removal of HIPS 7.0 via KB51699.
  • Install HIPS 8.0.
0 Kudos
kink80
Level 12

Re: WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport

Performing a manual removal of HIPS 7 is not an easy task especially if my preliminary odds of failure hold for my entire enterprise. Roughly 1-2% of the machines I have upgraded from HIPS 7.0.0.1159 to HIPS 8.0.0.1919 have had issues. Either this issue where parts of 7.0 remain and have blocked all Ethernet traffic or during the installation of HIPS 8.0.0.1919 the machine restarts. I have about 12,000 machines so that would mean 120-240 machines would have to be physically touched and repaired. Some of these machines are also in a  I cannot pinpoint what makes one machine fail while another works just fine so troubleshooting is rather problematic. Would there be anyway to try to improve the odds of success.

0 Kudos
strongy
Level 9

Re: WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport

I have a solution to remove the NDIS driver.

 

Once removed from Device manager and the system is rebooted I found that any network issues found were fixed.

 

In regedit navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11­CE-BFC1-08002BE10318}

Do a search in regedit from this point for McAfee NDIS Intermediate driver

 

In the item view the Characteristics value.

Change Characteristics with the value of 0x00000029(41) to 0x00000001(1)

 

Go back into Device Manager and remove the NDIS Driver as normal. Reboot the system.

Please do the above at your own risk.

Good luck

fiveo
Level 7

Re: WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport

The above solution from strongy worked GREAT.  Thanks!

0 Kudos
cchiles
Level 7

Re: WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport

I'm experiencing problems with my VPN connection.  I was upgraded from HIPS 7 to HIPS 8 and can no longer VPN.  I followed your instruction and was hoping this would solve our problems. I changed the value of Characteristics from 29(41) to 1(1) on the McAfee NDIS Intermediate drive, then removed the Cisco Systems VPN Adapter - McAfee NDIS Intermediate Filter Miniport.  This didn't fix my VPN problem.  However, my Device manager still shows other NDIS devices?  we tried deleting them, couldn't delete them, we tried changing the Characteristics value to 1(1) and then deleting them but that didn't work. Then we stop the HIPS service and tried to delete them, no luck.

I have 2 questions:

Should all NDIS device adapters be removed? If this is yes, How?

Any other suggestions would be appriciated.network adapters.PNG

0 Kudos
greatscott
Level 12

Re: WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport

cchiles,

I would apply this hotfix, and see where it leaves you... https://www.google.com/#hl=en&biw=981&bih=615&sclient=psy-ab&q=HIPS+8+patch+2+803520+release+notes&o...

The release notes mention a fix for VPN issues. I would be really curious too if it clears up the WAN Miniport drivers that are faulted in your device manager screenshot. Please provide some feedback.

0 Kudos
cchiles
Level 7

Re: WAN Miniport (IP) - McAfee NDIS Intermediate Filter Miniport

We appled this rollup and it did not correct the issue.  We are working with McAfee to see if we can find a solution to this probelm.

0 Kudos