[Winpcap-users] Cannot get npf to start

[Mike Sutliff]

I apologize for that - I did misname it. It's actually 'Generic Packet
Classifier'.
The Gpc service. It shows up on other PC's that run Ethereal.

NPF.sys is in the \windows\system32\drivers directory. It's version: 3.1.0.27
The registry entry also shows the correct path.
I will gather the bug report info and send it off.

A side note: a few weeks ago, I had a bad virus. I finally had it removed after
about 10+ hours of scanning. I'm now looking at a possible rootkit infestation.

Thanks for your input.

On 3/12/06, Gianluca Varenni <gianluca.varenni at cacetech.com> wrote:
> Uhm, do you have any idea what this "generic packet interpreter" is(the name
> is quite misleading, especially in the hidden list of devices in the Device
> manager)?
>
> Can you please perform these two steps?
>
> 1. check that you have a file named npf.sys under
> c:\windows\system32\drivers and check the version number of this file
> (right-click, Properties, Version tab).
> 2. use the bug report procedure explained at http://www.winpcap.org/bugs.htm
> and send all the files (*including* the .reg ones) to either me directly, or
> to winpcap-bugs at winpcap.org.
>
> Hope it helps
> GV
>
>
>
>
> ----- Original Message -----
> From: "Mike Sutliff" <old531 at gmail.com>
> To: <winpcap-users at winpcap.org>
> Sent: Wednesday, March 08, 2006 4:31 PM
> Subject: Re: [Winpcap-users] Cannot get npf to start
>
>
> Loris:
>
> I have uninstalled and reinstalled. It's just weird. After
> re-installing, it still won't start.
> I think I broke something by installing Network General Sniffer and/or
> Fluke's Observer.
> But I have removed both of those applications. I've cleaned out the
> registry. I've
> uninstalled the 'generic packet interpreter' from the hidden view in
> device manager. No luck.
> I'm at a loss and need Ethereal to work again.
>
> Mike-
>
> On 3/8/06, Loris Degioanni <loris.degioanni at gmail.com> wrote:
> > Mike,
> > when you say "unistalled", do you mean "reinstalled"? Otherwise, if you
> > removed winpcap, it's pretty normal that the service doesn't start any
> > more.
> >
> > Loris
> >
> >
> > Mike Sutliff wrote:
> > > Running XP SP2 with no MS firewall. I have lightly perused the
> > > wincap-users archives and didn't find anything about this type of
> > > error. Ethereal was running
> > > at one time on my machine. I uninstalled other sniffers and network
> > > monitors.
> > > I have uninstalled Ethereal and Winpcap. Cannot do a 'net start' for npf
> > > or
> > > manually run npf_mgm to get it to start. Error indicates that it cannot
> > > find the
> > > file. The system log shows an event ID: 7000 Service Control Manager
> > > error -
> > > 'The NetGroup Packet Filter Driver service failed to start due to the
> > > following
> > > error: The system cannot find the file specified'. I've tried turning
> > > off my
> > > anti-virus and anti-spyware software. I've also removed other
> > > 'protocols' from
> > > my network configuration setup. Any clues?
> > >
> > > _______________________________________________
> > > Winpcap-users mailing list
> > > Winpcap-users at winpcap.org
> > > https://www.winpcap.org/mailman/listinfo/winpcap-users
> > >
> > _______________________________________________
> > Winpcap-users mailing list
> > Winpcap-users at winpcap.org
> > https://www.winpcap.org/mailman/listinfo/winpcap-users
> >
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>