[Winpcap-users] WinPcap 4.1.2 Setup Error

[Chin Shi Hong]

On Sat, May 19, 2012 at 12:53 AM, Jay Kay <gamekid334 at gmail.com> wrote:
> Mr. Chin,
>
> I looked and yes, I do have a "NetGroup Packet Filter Driver" in my Non-Plug
> and Play Drivers.  What next?
>
>  - Jay
>
>
> On Fri, May 18, 2012 at 4:23 AM, Chin Shi Hong <cshong87 at gmail.com> wrote:
>>
>> On Fri, May 18, 2012 at 4:12 PM, Jay Kay <gamekid334 at gmail.com> wrote:
>> > Michael,
>> >
>> > Thanks for the quick reply.
>> >
>> > I downloaded the suite, started the install and ran procmon.exe as you
>> > instructed.  It was going a little slow at first, but soon after
>> > clicking
>> > "Filter" it hit a BSoD.  After my system restarted I tried running
>> > procmon
>> > again (forgetting to start the installation first though) and it almost
>> > immediately hit the BSoD again.  I then tested it in safe mode out of
>> > curiosity but apparently a necessary driver is missing when in that
>> > mode,
>> > but it didn't crash it.
>> >
>> > Any other suggestions or reasons why procmon could have crashed the
>> > system?
>> >  That is the first time this has happened to it.  It was such a good
>> > idea,
>> > too.  I should probably also note that I'm running 64-bit Windows and
>> > 2GB of
>> > RAM.
>> >
>> > Thanks,
>> >  - Jay
>> >
>> >
>> > On Fri, May 18, 2012 at 12:15 AM, Michael Lehr <michael at maystreet.com>
>> > wrote:
>> >>
>> >> Jay,
>> >>
>> >> I don't really know the answer specifically for winpcap, but generally
>> >> I
>> >> would use the sysinternals suite, start the install, run procmon
>> >> (filter on
>> >> the install application), do the install, and see what files & registry
>> >> keys
>> >> it is accessing to make its decision.  Maybe there is still something
>> >> lingering.
>> >>
>> >> http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx
>> >>
>> >> Michael Lehr
>> >>
>> >>
>> >> On Fri, May 18, 2012 at 12:35 AM, Jay Kay <gamekid334 at gmail.com> wrote:
>> >>>
>> >>> Hi again,
>> >>>
>> >>> I sent this (below) into the mailing list about a month ago.  I still
>> >>> haven't figured out the problem.  Any help would be vastly
>> >>> appreciated.
>> >>>
>> >>> Oh, I'm also running Windows 7 if that helps.
>> >>>
>> >>> Thanks again,
>> >>>  - Jay
>> >>>
>> >>> ___
>> >>>
>> >>>> Hi,
>> >>>>
>> >>>> I've had WinPcap installed on my computer before but uninstalled it
>> >>>> at
>> >>>> some point, or so I thought.  I recently tried reinstalling WinPcap
>> >>>> 4.1.2,
>> >>>> but whenever I do, I get the message:
>> >>>>
>> >>>> "A previous version of WinPCap has been detected on the system and
>> >>>> cannot be removed because in use by another application. Please close
>> >>>> all
>> >>>> the WinPcap-based applications and run the installer again."
>> >>>>
>> >>>> One problem:  I can't seem to find any traces of WinPcap on my
>> >>>> computer.
>> >>>>  No uninstallation executables, no DLLs, no registry keys.  What's
>> >>>> even more
>> >>>> interesting is the fact that Wireshark denies its existence,
>> >>>> SmartSniff
>> >>>> seems to recognise its presence but can't seem to use it and Cain can
>> >>>> use it
>> >>>> with absolutely no problems.
>> >>>>
>> >>>> I've tried everything I could dig up but to no avail, and I was
>> >>>> hoping
>> >>>> that someone here could help me.  Any suggestions?
>> >>>>
>> >>>> Thanks!
>> >>>>  - Jay
>> >>>
>> >>>
>> >>>
>> >>> _______________________________________________
>> >>> Winpcap-users mailing list
>> >>> Winpcap-users at winpcap.org
>> >>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >>>
>> >>
>> >>
>> >> _______________________________________________
>> >> Winpcap-users mailing list
>> >> Winpcap-users at winpcap.org
>> >> https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >>
>> >
>> >
>> > _______________________________________________
>> > Winpcap-users mailing list
>> > Winpcap-users at winpcap.org
>> > https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >
>>
>> Jay,
>>
>> Firstly, reboot your computer. Then, run Device Manager, enable "Show
>> Hidden Devices" by click on View -> Show Hidden Devices, Then, in
>> "Non-Plug and Play Drivers", look for "NetGroup Packet Filter Driver",
>> see whether it is there or not.
>>
>> Regards,
>> Just call me Mr. Chin
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>

That means your previous uninstallation of WinPcap not successful.

Try to reboot your computer into safe mode. If you don't know how to
do it, follow the following steps:

1. Reboot your computer.
2. Before Windows boot, hold down the key or keep on pressing the key
F8 until you see an option like "Safe Mode". But, depending on our
computer, some computer may go into BIOS setup screen when you press
F8 key at POST screen. If that is the case, when your computer reboot,
you may have to wait until the POST screen disappear, then keep on
pressing F8 key before windows start booting,
3. When you see something like "safe mode", press the up/down arrow
key to select it, then press Enter.
4. Login with an administrator account.

Then, try to uninstall Winpcap by follow these steps:
1. Go to Control Panel -> Programs and Features, look for "WinPcap" in
the list of programs.
2. If it is there, uninstall it by selecting it and then click the
"Uninstall" button.

If "WinPcap" not exist in "Programs and Features", follow the following steps:
1. Go to the directory where you previously installed WinPcap. The
default directory should be "C:\Program Files (x86)\WinPcap\".
2. If there is a file named "Uninstall" or "Uninstall.exe", run it to
start uninstallation.

If the "Unintall" or "Uninstall.exe" does not exist, or the directory
does not exist, follow the following steps:
1. Run Device Manager, use the steps I stated in my previous email to
find "NetGroup Packet Filter Driver".
2. Right click on it, then click "Uninstall".

Regardless of whether the above uninstallation method success or fail,
you can try to run the WinPcap setup file to re-install it.

Regards,