[Winpcap-users] Error Starting NPF

[Andy Merrill]

I checked the c:\windows\system32\drivers\npf.sys and it looks to be the x32 driver and my OS is 32-bit. 
I'll go ahead and follow the steps for submitting a bug from that link.
 
Thanks,
Andy Merrill
 
____________________________________________________________________
 
Date: Wed, 27 May 2009 08:27:01 -0700
From: "Gianluca Varenni" <gianluca.varenni at cacetech.com>
Subject: Re: [Winpcap-users] Error Starting NPF
To: <winpcap-users at winpcap.org>
Message-ID: <28A8B9CA0DAB437D9C656D2E5899516D at nelson2>
Content-Type: text/plain; format=flowed; charset="iso-8859-1";
        reply-type=original

It can definitely be.

Can you please check the properties of c:\windows\system32\drivers\npf.sys?

In the case of the x64 driver, the description of the driver should be

npf.sys (NT5/6 AMD64) Kernel Driver

Have a nice day
GV


----- Original Message -----
From: "Fish" <fish at infidels.org>
To: <winpcap-users at winpcap.org>
Sent: Tuesday, May 26, 2009 8:34 PM
Subject: Re: [Winpcap-users] Error Starting NPF


>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> I am not saying this is what the problem is, but I can state that I
> personally experienced this very issue a long time ago whenever I
> first began playing around with x64. In my particular case it was x64
> windows complaining that the driver it was trying to load was not a
> 64-bit driver. Somehow things got setup such that the 32-bit driver
> was always trying to be loaded which does not work on 64-bit Windows.
> On 64-bit Windows all drivers must be 64-bit. Either that or the
> opposite: a 64-bit driver was trying to be loaded by 32-bit Windows.
>
> Again, I'm not stating that is your problem, only that the "Driver
> has been blocked from loading" error message you mention was
> experienced by myself for the reasons described.
>
> Hope that helps.
>
> - --
> "Fish" (David B. Trout) - fish at softdevlabs.com
> Fight Spam! Join CAUCE! <http://www.cauce.org/ <https://exg4.exghost.com/exchweb/bin/redir.asp?URL=http://www.cauce.org/> >
> 7 reasons why HTML email is a bad thing
> http://www.georgedillon.com/web/html_email_is_evil.shtml <https://exg4.exghost.com/exchweb/bin/redir.asp?URL=http://www.georgedillon.com/web/html_email_is_evil.shtml> 
> PGP key fingerprints:
> RSA: 6B37 7110 7201 9917 9B0D 99E3 55DB 5D58 FADE 4A52
> DH/DSS: 9F9B BAB0 BA7F C458 1A89 FE26 48F5 D7F4 C4EE 3E2A
>
>  -----Original Message-----
>  From: winpcap-users-bounces at winpcap.org
> [mailto:winpcap-users-bounces at winpcap.org]On Behalf Of Andy Merrill
>  Sent: Tuesday, May 26, 2009 10:49 AM
>  To: winpcap-users at winpcap.org
>  Subject: [Winpcap-users] Error Starting NPF
>
>
>  I'm getting an odd error when I try to run WireShark. So I started
> doing some digging and found that WinPcap 4.0.2 is not starting up.
> I've used it plenty of times in the past on other systems, but on
> this specific box I get an error in the Event Logs that says:
>
>  "The NetGroup Packet Filter Driver service failed to start due to
> the following error:
>  This driver has been blocked from loading "
>
>  So I tried to start it via command line with "net start npf" and
> got pretty much the same error of:
>
>  "System error 1275 has occurred.
>
>  This driver has been blocked from loading"
>
>
>
>  Anyone have an idea why the drivers might be failing to load?
>
>
>
>  This is on a Windows Server 2003 system running in a VPS.
>
>
>  Thanks,
>  Andy Merrill
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 8.1
>
> iQA/AwUBShy0vkj11/TE7j4qEQKH/wCfSjB3mQq09LmPKnRJvVp9H1Yth1wAnj1t
> cm1CMEKzZsQW5dT0km1kAJni
> =ExiA
> -----END PGP SIGNATURE-----
>


--------------------------------------------------------------------------------


> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users <https://exg4.exghost.com/exchweb/bin/redir.asp?URL=https://www.winpcap.org/mailman/listinfo/winpcap-users> 
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090527/6ae936dc/attachment.htm