[Winpcap-users] WinPcap 4.1.2 Setup Error

Chin Shi Hong cshong87 at gmail.com
Sat May 19 00:38:42 PDT 2012


On Sat, May 19, 2012 at 2:46 PM, Jay Kay <gamekid334 at gmail.com> wrote:
> Oh wow, you're awesome.  I swear there was no uninstall executable before,
> but after checking the vanilla Program Files instead of (x86) I found it.  I
> rebooted into safe mode and ran the uninstall, but when I checked the Device
> Manager it still had NetGroup Packet Filter Driver in there.  Clicked
> Uninstall for that, rebooted back to normal and tried installing again, and
> it went through with no problems!
>
> Thanks so much.  I owe you one!
>
> Hope to see you around,
>  - Jay
>
>
> On Fri, May 18, 2012 at 9:48 PM, Chin Shi Hong <cshong87 at gmail.com> wrote:
>>
>> On Sat, May 19, 2012 at 12:53 AM, Jay Kay <gamekid334 at gmail.com> wrote:
>> > Mr. Chin,
>> >
>> > I looked and yes, I do have a "NetGroup Packet Filter Driver" in my
>> > Non-Plug
>> > and Play Drivers.  What next?
>> >
>> >  - Jay
>> >
>> >
>> > On Fri, May 18, 2012 at 4:23 AM, Chin Shi Hong <cshong87 at gmail.com>
>> > wrote:
>> >>
>> >> On Fri, May 18, 2012 at 4:12 PM, Jay Kay <gamekid334 at gmail.com> wrote:
>> >> > Michael,
>> >> >
>> >> > Thanks for the quick reply.
>> >> >
>> >> > I downloaded the suite, started the install and ran procmon.exe as
>> >> > you
>> >> > instructed.  It was going a little slow at first, but soon after
>> >> > clicking
>> >> > "Filter" it hit a BSoD.  After my system restarted I tried running
>> >> > procmon
>> >> > again (forgetting to start the installation first though) and it
>> >> > almost
>> >> > immediately hit the BSoD again.  I then tested it in safe mode out of
>> >> > curiosity but apparently a necessary driver is missing when in that
>> >> > mode,
>> >> > but it didn't crash it.
>> >> >
>> >> > Any other suggestions or reasons why procmon could have crashed the
>> >> > system?
>> >> >  That is the first time this has happened to it.  It was such a good
>> >> > idea,
>> >> > too.  I should probably also note that I'm running 64-bit Windows and
>> >> > 2GB of
>> >> > RAM.
>> >> >
>> >> > Thanks,
>> >> >  - Jay
>> >> >
>> >> >
>> >> > On Fri, May 18, 2012 at 12:15 AM, Michael Lehr
>> >> > <michael at maystreet.com>
>> >> > wrote:
>> >> >>
>> >> >> Jay,
>> >> >>
>> >> >> I don't really know the answer specifically for winpcap, but
>> >> >> generally
>> >> >> I
>> >> >> would use the sysinternals suite, start the install, run procmon
>> >> >> (filter on
>> >> >> the install application), do the install, and see what files &
>> >> >> registry
>> >> >> keys
>> >> >> it is accessing to make its decision.  Maybe there is still
>> >> >> something
>> >> >> lingering.
>> >> >>
>> >> >> http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx
>> >> >>
>> >> >> Michael Lehr
>> >> >>
>> >> >>
>> >> >> On Fri, May 18, 2012 at 12:35 AM, Jay Kay <gamekid334 at gmail.com>
>> >> >> wrote:
>> >> >>>
>> >> >>> Hi again,
>> >> >>>
>> >> >>> I sent this (below) into the mailing list about a month ago.  I
>> >> >>> still
>> >> >>> haven't figured out the problem.  Any help would be vastly
>> >> >>> appreciated.
>> >> >>>
>> >> >>> Oh, I'm also running Windows 7 if that helps.
>> >> >>>
>> >> >>> Thanks again,
>> >> >>>  - Jay
>> >> >>>
>> >> >>> ___
>> >> >>>
>> >> >>>> Hi,
>> >> >>>>
>> >> >>>> I've had WinPcap installed on my computer before but uninstalled
>> >> >>>> it
>> >> >>>> at
>> >> >>>> some point, or so I thought.  I recently tried reinstalling
>> >> >>>> WinPcap
>> >> >>>> 4.1.2,
>> >> >>>> but whenever I do, I get the message:
>> >> >>>>
>> >> >>>> "A previous version of WinPCap has been detected on the system and
>> >> >>>> cannot be removed because in use by another application. Please
>> >> >>>> close
>> >> >>>> all
>> >> >>>> the WinPcap-based applications and run the installer again."
>> >> >>>>
>> >> >>>> One problem:  I can't seem to find any traces of WinPcap on my
>> >> >>>> computer.
>> >> >>>>  No uninstallation executables, no DLLs, no registry keys.  What's
>> >> >>>> even more
>> >> >>>> interesting is the fact that Wireshark denies its existence,
>> >> >>>> SmartSniff
>> >> >>>> seems to recognise its presence but can't seem to use it and Cain
>> >> >>>> can
>> >> >>>> use it
>> >> >>>> with absolutely no problems.
>> >> >>>>
>> >> >>>> I've tried everything I could dig up but to no avail, and I was
>> >> >>>> hoping
>> >> >>>> that someone here could help me.  Any suggestions?
>> >> >>>>
>> >> >>>> Thanks!
>> >> >>>>  - Jay
>> >> >>>
>> >> >>>
>> >> >>>
>> >> >>> _______________________________________________
>> >> >>> Winpcap-users mailing list
>> >> >>> Winpcap-users at winpcap.org
>> >> >>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >> >>>
>> >> >>
>> >> >>
>> >> >> _______________________________________________
>> >> >> Winpcap-users mailing list
>> >> >> Winpcap-users at winpcap.org
>> >> >> https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >> >>
>> >> >
>> >> >
>> >> > _______________________________________________
>> >> > Winpcap-users mailing list
>> >> > Winpcap-users at winpcap.org
>> >> > https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >> >
>> >>
>> >> Jay,
>> >>
>> >> Firstly, reboot your computer. Then, run Device Manager, enable "Show
>> >> Hidden Devices" by click on View -> Show Hidden Devices, Then, in
>> >> "Non-Plug and Play Drivers", look for "NetGroup Packet Filter Driver",
>> >> see whether it is there or not.
>> >>
>> >> Regards,
>> >> Just call me Mr. Chin
>> >> _______________________________________________
>> >> Winpcap-users mailing list
>> >> Winpcap-users at winpcap.org
>> >> https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >
>> >
>> >
>> > _______________________________________________
>> > Winpcap-users mailing list
>> > Winpcap-users at winpcap.org
>> > https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >
>>
>> That means your previous uninstallation of WinPcap not successful.
>>
>> Try to reboot your computer into safe mode. If you don't know how to
>> do it, follow the following steps:
>>
>> 1. Reboot your computer.
>> 2. Before Windows boot, hold down the key or keep on pressing the key
>> F8 until you see an option like "Safe Mode". But, depending on our
>> computer, some computer may go into BIOS setup screen when you press
>> F8 key at POST screen. If that is the case, when your computer reboot,
>> you may have to wait until the POST screen disappear, then keep on
>> pressing F8 key before windows start booting,
>> 3. When you see something like "safe mode", press the up/down arrow
>> key to select it, then press Enter.
>> 4. Login with an administrator account.
>>
>> Then, try to uninstall Winpcap by follow these steps:
>> 1. Go to Control Panel -> Programs and Features, look for "WinPcap" in
>> the list of programs.
>> 2. If it is there, uninstall it by selecting it and then click the
>> "Uninstall" button.
>>
>> If "WinPcap" not exist in "Programs and Features", follow the following
>> steps:
>> 1. Go to the directory where you previously installed WinPcap. The
>> default directory should be "C:\Program Files (x86)\WinPcap\".
>> 2. If there is a file named "Uninstall" or "Uninstall.exe", run it to
>> start uninstallation.
>>
>> If the "Unintall" or "Uninstall.exe" does not exist, or the directory
>> does not exist, follow the following steps:
>> 1. Run Device Manager, use the steps I stated in my previous email to
>> find "NetGroup Packet Filter Driver".
>> 2. Right click on it, then click "Uninstall".
>>
>> Regardless of whether the above uninstallation method success or fail,
>> you can try to run the WinPcap setup file to re-install it.
>>
>> Regards,
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>

If you use the uninstall.exe, to make the "NetGroup Packet Filter
Driver" automatically disappear from the Device Manager instead of you
done it yourself through Device Manager, you have to reboot.


More information about the Winpcap-users mailing list