[Winpcap-users] WinPcap 4.1.2 Setup Error

[Chin Shi Hong]

On Sat, May 19, 2012 at 2:46 PM, Jay Kay <gamekid334 at gmail.com> wrote:
> Oh wow, you're awesome.  I swear there was no uninstall executable before,
> but after checking the vanilla Program Files instead of (x86) I found it.  I
> rebooted into safe mode and ran the uninstall, but when I checked the Device
> Manager it still had NetGroup Packet Filter Driver in there.  Clicked
> Uninstall for that, rebooted back to normal and tried installing again, and
> it went through with no problems!
>
> Thanks so much.  I owe you one!
>
> Hope to see you around,
>  - Jay
>
>
> On Fri, May 18, 2012 at 9:48 PM, Chin Shi Hong <cshong87 at gmail.com> wrote:
>>
>> On Sat, May 19, 2012 at 12:53 AM, Jay Kay <gamekid334 at gmail.com> wrote:
>> > Mr. Chin,
>> >
>> > I looked and yes, I do have a "NetGroup Packet Filter Driver" in my
>> > Non-Plug
>> > and Play Drivers.  What next?
>> >
>> >  - Jay
>> >
>> >
>> > On Fri, May 18, 2012 at 4:23 AM, Chin Shi Hong <cshong87 at gmail.com>
>> > wrote:
>> >>
>> >> On Fri, May 18, 2012 at 4:12 PM, Jay Kay <gamekid334 at gmail.com> wrote:
>> >> > Michael,
>> >> >
>> >> > Thanks for the quick reply.
>> >> >
>> >> > I downloaded the suite, started the install and ran procmon.exe as
>> >> > you
>> >> > instructed.  It was going a little slow at first, but soon after
>> >> > clicking
>> >> > "Filter" it hit a BSoD.  After my system restarted I tried running
>> >> > procmon
>> >> > again (forgetting to start the installation first though) and it
>> >> > almost
>> >> > immediately hit the BSoD again.  I then tested it in safe mode out of
>> >> > curiosity but apparently a necessary driver is missing when in that
>> >> > mode,
>> >> > but it didn't crash it.
>> >> >
>> >> > Any other suggestions or reasons why procmon could have crashed the
>> >> > system?
>> >> >  That is the first time this has happened to it.  It was such a good
>> >> > idea,
>> >> > too.  I should probably also note that I'm running 64-bit Windows and
>> >> > 2GB of
>> >> > RAM.
>> >> >
>> >> > Thanks,
>> >> >  - Jay
>> >> >
>> >> >
>> >> > On Fri, May 18, 2012 at 12:15 AM, Michael Lehr
>> >> > <michael at maystreet.com>
>> >> > wrote:
>> >> >>
>> >> >> Jay,
>> >> >>
>> >> >> I don't really know the answer specifically for winpcap, but
>> >> >> generally
>> >> >> I
>> >> >> would use the sysinternals suite, start the install, run procmon
>> >> >> (filter on
>> >> >> the install application), do the install, and see what files &
>> >> >> registry
>> >> >> keys
>> >> >> it is accessing to make its decision.  Maybe there is still
>> >> >> something
>> >> >> lingering.
>> >> >>
>> >> >> http://technet.microsoft.com/en-us/sysinternals/bb842062.aspx
>> >> >>
>> >> >> Michael Lehr
>> >> >>
>> >> >>
>> >> >> On Fri, May 18, 2012 at 12:35 AM, Jay Kay <gamekid334 at gmail.com>
>> >> >> wrote:
>> >> >>>
>> >> >>> Hi again,
>> >> >>>
>> >> >>> I sent this (below) into the mailing list about a month ago.  I
>> >> >>> still
>> >> >>> haven't figured out the problem.  Any help would be vastly
>> >> >>> appreciated.
>> >> >>>
>> >> >>> Oh, I'm also running Windows 7 if that helps.
>> >> >>>
>> >> >>> Thanks again,
>> >> >>>  - Jay
>> >> >>>
>> >> >>> ___
>> >> >>>
>> >> >>>> Hi,
>> >> >>>>
>> >> >>>> I've had WinPcap installed on my computer before but uninstalled
>> >> >>>> it
>> >> >>>> at
>> >> >>>> some point, or so I thought.  I recently tried reinstalling
>> >> >>>> WinPcap
>> >> >>>> 4.1.2,
>> >> >>>> but whenever I do, I get the message:
>> >> >>>>
>> >> >>>> "A previous version of WinPCap has been detected on the system and
>> >> >>>> cannot be removed because in use by another application. Please
>> >> >>>> close
>> >> >>>> all
>> >> >>>> the WinPcap-based applications and run the installer again."
>> >> >>>>
>> >> >>>> One problem:  I can't seem to find any traces of WinPcap on my
>> >> >>>> computer.
>> >> >>>>  No uninstallation executables, no DLLs, no registry keys.  What's
>> >> >>>> even more
>> >> >>>> interesting is the fact that Wireshark denies its existence,
>> >> >>>> SmartSniff
>> >> >>>> seems to recognise its presence but can't seem to use it and Cain
>> >> >>>> can
>> >> >>>> use it
>> >> >>>> with absolutely no problems.
>> >> >>>>
>> >> >>>> I've tried everything I could dig up but to no avail, and I was
>> >> >>>> hoping
>> >> >>>> that someone here could help me.  Any suggestions?
>> >> >>>>
>> >> >>>> Thanks!
>> >> >>>>  - Jay
>> >> >>>
>> >> >>>
>> >> >>>
>> >> >>> _______________________________________________
>> >> >>> Winpcap-users mailing list
>> >> >>> Winpcap-users at winpcap.org
>> >> >>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >> >>>
>> >> >>
>> >> >>
>> >> >> _______________________________________________
>> >> >> Winpcap-users mailing list
>> >> >> Winpcap-users at winpcap.org
>> >> >> https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >> >>
>> >> >
>> >> >
>> >> > _______________________________________________
>> >> > Winpcap-users mailing list
>> >> > Winpcap-users at winpcap.org
>> >> > https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >> >
>> >>
>> >> Jay,
>> >>
>> >> Firstly, reboot your computer. Then, run Device Manager, enable "Show
>> >> Hidden Devices" by click on View -> Show Hidden Devices, Then, in
>> >> "Non-Plug and Play Drivers", look for "NetGroup Packet Filter Driver",
>> >> see whether it is there or not.
>> >>
>> >> Regards,
>> >> Just call me Mr. Chin
>> >> _______________________________________________
>> >> Winpcap-users mailing list
>> >> Winpcap-users at winpcap.org
>> >> https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >
>> >
>> >
>> > _______________________________________________
>> > Winpcap-users mailing list
>> > Winpcap-users at winpcap.org
>> > https://www.winpcap.org/mailman/listinfo/winpcap-users
>> >
>>
>> That means your previous uninstallation of WinPcap not successful.
>>
>> Try to reboot your computer into safe mode. If you don't know how to
>> do it, follow the following steps:
>>
>> 1. Reboot your computer.
>> 2. Before Windows boot, hold down the key or keep on pressing the key
>> F8 until you see an option like "Safe Mode". But, depending on our
>> computer, some computer may go into BIOS setup screen when you press
>> F8 key at POST screen. If that is the case, when your computer reboot,
>> you may have to wait until the POST screen disappear, then keep on
>> pressing F8 key before windows start booting,
>> 3. When you see something like "safe mode", press the up/down arrow
>> key to select it, then press Enter.
>> 4. Login with an administrator account.
>>
>> Then, try to uninstall Winpcap by follow these steps:
>> 1. Go to Control Panel -> Programs and Features, look for "WinPcap" in
>> the list of programs.
>> 2. If it is there, uninstall it by selecting it and then click the
>> "Uninstall" button.
>>
>> If "WinPcap" not exist in "Programs and Features", follow the following
>> steps:
>> 1. Go to the directory where you previously installed WinPcap. The
>> default directory should be "C:\Program Files (x86)\WinPcap\".
>> 2. If there is a file named "Uninstall" or "Uninstall.exe", run it to
>> start uninstallation.
>>
>> If the "Unintall" or "Uninstall.exe" does not exist, or the directory
>> does not exist, follow the following steps:
>> 1. Run Device Manager, use the steps I stated in my previous email to
>> find "NetGroup Packet Filter Driver".
>> 2. Right click on it, then click "Uninstall".
>>
>> Regardless of whether the above uninstallation method success or fail,
>> you can try to run the WinPcap setup file to re-install it.
>>
>> Regards,
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>

If you use the uninstall.exe, to make the "NetGroup Packet Filter
Driver" automatically disappear from the Device Manager instead of you
done it yourself through Device Manager, you have to reboot.