Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Teefer2 Miniport ?

Created: 17 Oct 2007 • Updated: 06 Nov 2010 | 13 comments

Hello!

I have installed the Endpoint Security on my Dell D420 Win XPSP2 Laptop.

In the Device Manager there is an entry for "Deterministic Networks WAN Virtual miniport - Teefer2 Miniport".
This entry is checked with an exclamatin mark. When checking the details its says:

The Device could not be started (Code10).

When trying to deinstall the driver I get a message that it could not be deinstalled cause it maybe used to start the system.

Does anyone know about this and how to make it properly work ?

Thanks
Y-Hardie

Discussion Filed Under:

Comments 13 CommentsJump to latest comment

Dick@Aero's picture
The Teefer2 Driver is generated by SEP 11.0.   It shows for all network connections under properties.  The symantec helpdesk tech had me to uncheck the driver under the wireless connection when my wireless network card would not authenticate to WPA.  That fixed my problem.  It is still checked for the wired adapter. I think it may be associated with the Network Access Control feature but I am not sure.
Paul Murgatroyd's picture

The Teefer driver is responsible for capturing all network traffic entering or leaving a particular interface ( via the associated miniport driver ), so that the packets may be passed to the personal firewall component of the SEP 11.0 client for analysis.

Paul Murgatroyd
Principal Product Manager, Symantec Endpoint Protection
Endpoint twitter feed: http://twitter.com/symc_endpoint

Y-Hardie's picture

Thanks for the answers.

But how do I fix the problem, that is is shown with an exclamation mark in the device manager ?

Any hints ?

Thanks
Y-Hardie

SKlassen's picture
Have you tried a repair re-install from the SEP entry in Add/Remove programs?  Alternately you could just uninstall and reinstall. 
Y-Hardie's picture

I did already uninstall and reinstall. Same error.

Any other ideas ?

Y-Hardie

StefanP's picture
"The Teefer2 Driver is generated by SEP 11.0.   It shows for all network connections under properties.  The symantec helpdesk tech had me to uncheck the driver under the wireless connection when my wireless network card would not authenticate to WPA.  That fixed my problem.  It is still checked for the wired adapter. I think it may be associated with the Network Access Control feature but I am not sure."
 
I am surprised that you were advised to switch this off for WiFi as it is the driver for the firewall hence leaving your WiFi-adapter much less secured. Your WPA authentication doesn't work due to the need for a rule allowing Ethernet x888 (EAPOL) for WPA to authenticate. This rule can only be added on the SEPM server for server control and mixed control clients but unfortunately not yet manually on the client due to Ethernet not being an option in the GUI yet. I have filed a request to allow cration of Ethernet rules to support (only UDP,TCP,ICMP and IP Protocols are allowed in the current version).
 
Stefan
SBI SOC Team's picture

after uninstallation of SEP 11 client from the server os, we see teefer2 driver in the device manager and we can't connect the server on LAN.

In few servers no traffic flows through LAN Port in others Lan port do not ping itself or take staic IP.

We have tried with disabling these teefer2 drivers and checked but the same result.

Please HELP!

Sandeep Cheema's picture

Remove the Teefer2 driver

  1. Click Start > Settings > Control Panel > Network Connections.
  2. Click a connection.
  3. In the dialog, click Properties.
  4. Select Teefer2 Driver and click Uninstall.
  5. You will need to repeat these steps for each Network Connection.
  6. Reboot the computer.

Also delete
C:\WINDOWS\system32\drivers\teefer2.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Teefer2


Reference: http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2007080209280848

De facto when AV does something, it starts jumping up and down, waving its arms, and shouting...

"Hey!  I found a virus!  Look at me!  I'm soooo goooood!"

Acretian's picture

I heard there is a tool available
Remove teefer is the tool, you need to open a case to get it

Perry Butler's picture

Using CleanWipe and the manual uninstall instructions for Symantec Endpoint Protection both did not resolve the Teefer 2 problem for me.

In my case, device manager listed my network card twice, but one of them said something like (Teefer 2) at the end. It also listed a third device related to Teefer 2. For example:

  • Realtek Gigabit Ethernet NIC
  • Realtek Gigabit Ethernet NIC (Teefer 2)
  • WAN Miniport (IP) - Teefer 2 Miniport

Here's what I did (WinXP):

  1. Open Device Manager.
  2. Right click on the Realtek Gigabit Ethernet NIC (Teefer 2) and choose Disable.
  3. Right click on the Realtek Gigabit Ethernet NIC and choose Uninstall. Both of the NIC should disappear.
  4. Click Scan for Hardware Changes.

When I did this, the Realtek Gigabit Ethernet NIC was automatically detected and installed, but the Realtek Gigabit Ethernet NIC (Teefer 2) was not! I was instantly able to access the internet! Note that the WAN Miniport (IP) - Teefer 2 Miniport still shows in my device manager as Disabled and doesn't seem to affect anything.

Gdude's picture

Thanks Perry!

Perusing through the quaqmire of info about this and your post solved it for me.

Cheers!

sri2384's picture

If you are running into Teefer issues, please open a support ticket with Symantec. Ask for teefer removal tool. I think their advanced team has access to the tool. Also another workaround would be to install only NTP again on the machine as this would bind with the teefer. Then perform a manual uninstallation thro' Add or Remove Programs....

sri2384's picture

Also make sure to Cleanwipe only locally on the machine..never on a RDP session. not atleast on a non-console session...Chk this link..

http://service1.symantec.com/SUPPORT/ent-security....