<meta content="text/html; charset=ISO-8859-1"
<body bgcolor="#FFFFFF" text="#000000">
On the problem system, whenever I try to install WinPCAP, I get a
complaint that WinPCAP is already installed.<br>
I've tried EVERYTHING to get rid of it first but nothing seemed to
Used Windows Program uninstall.<br>
Used Retrevo but it doesn't find WinPCAP at all.<br>
Deleted everything related to WinPCAP in the registry .. there
wasn't much there.<br>
And .. it still complains that it's still installed!!<br>
This looks like the problem or at least seems worth getting rid of.
The question is how??<br>
I was finally able to get a copy of Packet.dll into windows\system32
but Wireshark still comes up saying that npf didn't start.<br>
<pre class="moz-signature" cols="72">Fred Marshall
PO Box 159
Ilwaco, WA 98624
FAX: (360) 642-2074
Cell: (503) 791-5773</pre>
On 1/9/2012 1:01 PM, Fred Marshall wrote:
<blockquote cite="mid:4F0B55C7.email@example.com" type="cite">
<meta content="text/html; charset=ISO-8859-1"
<font size="-1"><font face="Courier New">Fish,<br>
Great advice. I was able to transfer an npf.sys from another
system of the same type.<br>
As I said before, I have a more or less identical system Win7
64 which has it installed and working fine!<br>
But now I'm getting (which I guess I was getting before):<br>
Error opening file for writing:<br>
Click Abort to stop the installation,<br>
Retry to try again, or<br>
Ignore to skip this file.<br>
Now, I guess I'd have to ask: Why would an install try to open
an existing .dll for writing .. well, unless it's just trying
to put it in the directory?<br>
So, I did the same thing with this one and copied it from my
other Win7 64 system.<br>
Then I reinstalled Wireshark / WinPCAP. Since I know that
Packet.dll is there, I skipped the issue when it popped up.<br>
This worked to a point but the npf driver isn't running.<br>
So then I ran <br>
net start npf <br>
The service cannot be strted, either because it is disabled or
because it has no enabled devices associated with it.</font></font><br>
On 1/8/2012 8:38 PM, "Fish" (David B. Trout) wrote:
<pre wrap="">Fred Marshall wrote:
<pre wrap="">If I run
net start npf
I get Syhstem error 2 has occurred
The system cannot find the file specified. !!!!!!
<pre wrap="">Well THAT'S not good.
<pre wrap="">So, it appears there is a difference between
sc qc npf
net start npf
<pre wrap="">"sc qc npf" simply queries the Service Control Manager's database and
displays the entry for that service name. It does not otherwise do anything.
It is a query function. It is not an action function. It does not stop or
start a service. It simply DISPLAYS it.
The "net start" command actually starts the service, and does so according
to the information as registered in the Service Control Manager's database
(which is really just a few keys and values in the
HKLM\System\CurrentControlSet\Services branch of the registry).
<pre wrap="">I've also looked at the ... well I can't find the full steps
but it's like in the not plugnplay, hidden, etc.
and it's not showing there.......
Everything has been run as Administrator, etc.
<pre wrap="">Perhaps you're thinking of the "msinfo32" command?
Start -> Run: msinfo32.
Expand the "Software Environment" branch, and select the first entry called
In the list of drivers, locate the one for Name = "NPF", Description =
"NetGroup Packet Filter Driver".
The "Type" should be "Kernel Driver", the Start Mode should be "Auto"
(possibly; depends on user preference). The "Started" will be "Yes" if the
driver has been started, but on your troublesome system it's more than
Now, go back to your Administrator Command Prompt (where you originally
entered your "sc qc npf" command from) and notice the path that's displayed:
C:\Windows\system32>sc qc npf
[SC] QueryServiceConfig SUCCESS
TYPE : 1 KERNEL_DRIVER
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : system32\drivers\npf.sys
TAG : 0
DISPLAY_NAME : NetGroup Packet Filter Driver
This means the driver called "npf.sys" SHOULD be in your
%SystemRoot%\system32\drivers directory. Change to that directory and do a
'dir' (or 'dir /b | find /i "npf"). You SHOULD see two drivers listed:
The second one listed (npfs.sys) is NOT the one we're interested in.
It is the FIRST one that we are interested in: the "npf.sys" driver.
If it is not listed in your dir display (if it does not exist in your
system32\drivers directory), then THAT is your problem. (and from the sounds
of everything you've told us so far that *IS* indeed your problem).
Now, the question then becomes, *WHY* isn't it there?! :)
The installation of WinPCap *should* have placed it there.
If, after installing WinPCap , it is still not there, then either:
a) something is broken with the WinPCap installer (unlikely)
b) something on your system is preventing the WinPCap installer from being
able to write to that directory (much more likely)
Check you driver and/or directory permissions to make sure they're correct.
Maybe you changed them a long time ago and forgot you did so.
Or perhaps you changed some system policy (Group Policy) related to
installing device drivers a long time ago and forgot you did so.
It could be anything.
You need to dig through your memory and try to remember what it was you did
(or what some other piece of software that you installed may have done).
AS A QUICK TEST, you might consider *manually* copying the npf.sys driver to
there from a known working system. (Just make sure it's for the same
architecture: x64). The try starting the npf service again: "net start npf".
It SHOULD work.
Then all we would need to do is determine WHY the WinPCap installation is
unable to accomplish the same thing. THAT'S the mystery it seems.
I also STRONGLY suggest (and this is good advice not just for you but for
EVERYONE who manages a computer system, which includes your personal
computer) that you begin keeping a LOG of everything you do from now on.
I've been doing it for years now and it has saved my butt on more than one
Just create a "_Windows Changes.txt" file somewhere (e.g. in your Documents
folder) and keep a shortcut to it on your desktop. Then whenever you change
ANYTHING on your system, be it a simple tweaking of a system service, the
installation of a program (or even Microsoft Updates) or the changing a
registry entry, etc... just type a new entry.
It doesn't have to be much.
Just a few lines.
Date, time, and what you did, etc.
Sort of like a "diary" of daily events in the life of your system. :)
But just get in the habit of doing it!
Don't think you can get away with NOT doing it, because it's easy to forget
days or weeks later when you're having trouble that several days/weeks ago
you changed something on your system and it's only NOW coming back to bite
Trust me. You'll thank me for it later. :)
Let us know how it goes!
Winpcap-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Winpcapfirstname.lastname@example.org">Winpcapemail@example.com</a>
<a class="moz-txt-link-freetext" href="https://www.winpcap.org/mailman/listinfo/winpcap-users">https://www.winpcap.org/mailman/listinfo/winpcap-users</a>