Missing "Non Plug and Play Drivers" from Device Manager

[FoolishTech]

OK, hate to be a noob here, but I've a system here that simply will not show the Non Plug and Play Drivers category. XP SP3

Of course, I do set devmgr_show_nonpresent_devices=1 and select view hidden devices in devman...

My Google-fu must be lacking, because I cannot seem to find any info on this issue. I found one article with no resolution that mentioned it could be a corrupted/missing component of device manager (the article was also about XP Embedded so I didn't expect much anyway)... I couldn't fix anything with SFC and didn't know how to check for / what components could possibly be missing/corrupted?

Am I missing something obvious?

 

[ZenTree]

Had a play on a virtual machine but been unable to replicate that.

The only little nuance I saw when looking around was:

"Note that when you close the command prompt window, Window clears the devmgr_show_nonpresent_devices=1 variable that you set in step 2 and prevents ghosted devices from being displayed when you click Show hidden devices."

So it's not much but I'm assuming you are keeping the cmd window open whilst you check out device manager?

Good luck!

 

[FoolishTech]

I've never noticed it matter in the past, but after you mentioned it I tried that too.

I even tried in safe mode for whatever reason...

Well the system was otherwise fine so it's left the shop now, but still... I've seen this a few times before and I would like to get to the bottom of it. Maybe it won't be long before I'm seeing it again ...

 

[FoolishTech]

Got another system in with the same problem.

I know that set devmgr_show_nonpresent_devices=1 is working, because I can see missing devices under "other devices" that I cannot see when I do not do the set devmgr_.... bit.

But still, no non-plug and play devices category shows up...

And just my luck, system is in for priority service so I can't screw around with it much.

Note that this PC does have (or did, I just removed) the zero access rootkit. Is this possibly something that the rootkit disables somehow, to hinder removal attempts??

Additional things I have tried:

• SFC of course
• Tried same procedure from Safe Mode
• Tried same procedure running command prompt under the LOCAL SYSTEM account.
• Verified plenty of these devices do exist in the HKLM\System\CurrentControlSet\Enum\Root key
• Painstakingly verified that no entries under this reg key were malicious
• Added the devmgr_show_nonpresent_devices to the system environment variables via system properties

I still can't find any love on Google for this issue - too many results come back telling you HOW to show the category, no results I can find where it simply doesn't work...

 

[FoolishTech]

RESOLVED!

Got this one fixed with help from tgell over on Majorgeeks forums.

Turns out, an entire registry key was missing.

HKLM\\SYSTEM\CurrentControlSet\Control\Class\{8ECC055D-047F-11D1-A537-0000F8753ED1}

Which should have several values in place under it. All gone.

As many systems as I've seen this on, I *will* be adding the fix to D7 for the v4.8.1 release!

I can only guess if the deletion of that registry key was from malicious software. As mentioned I had Zero Access rootkit on this particular PC, and (I think it was Zero Access) on another that I've seen this symptom on.

 

[Encrypted Existence]

As many systems as I've seen this on, I *will* be adding the fix to D7 for the v4.8.1 release!

Thank you kind sir!

I have found the Majorgeeks forum to be helpful as well.

 

[FoolishTech]

Thank you kind sir!

YVW!

Just uploaded v4.8.1 with the fix.

The fix is on the Repair tab > misc... but it also runs automatically/silently any time you:

• Launch "Computer Management" from the Windows menu
• Or run the "Repair Lots of Stuff" under the Malware tab.