Windows 10 npcap 0.992 npf & npcapservice cannot be started after reboot

[libertyx82]

After i installed npcap with WinPcap compatibile Mode option the npf service can not be startet.

The Service is installed and the npf.sys exitst at "C:\Windows\system32\drivers" but if i try to start the service i get the error

"The system cannot find the file specified"

C:\WINDOWS\system32>sc qc npf
[SC] QueryServiceConfig ERFOLG

SERVICE_NAME: npf
        TYPE               : 1  KERNEL_DRIVER
        START_TYPE         : 1   SYSTEM_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : \SystemRoot\system32\DRIVERS\npf.sys
        LOAD_ORDER_GROUP   : NDIS
        TAG                : 51
        DISPLAY_NAME       : Npcap Packet Driver (NPF)
        DEPENDENCIES       :
        SERVICE_START_NAME :

C:\WINDOWS\system32>sc start npf
[SC] StartService FEHLER 2:

Das System kann die angegebene Datei nicht finden.

I have removed / installed npcap several times but always the same , i have also disabled the AV software during installation.

install.log
NPFInstall.log

I am running Windows 10 Pro Build 17763.rs5 (1809) 64bit

[gpotter2]

Edit: sorry I had missed that you were under the compatibility mode 😄

npf was the Winpcap service.
It was renamed to npcap in the case of Npcap

It's written in the doc: https://nmap.org/npcap/guide/npcap-devguide.html

[libertyx82]

From the Doc
Npcap requires the npcap service to be running. If installed in “WinPcap Compatible Mode”, the npf service can be started instead. Given that npcap service is always installed in both modes, a good practice is just trying the npcap service first. If it fails, then try the npf service. This is also what most of our users do in their software based on our investigation. A code sample from Nmap is here.

I have installed it with "WinPcap Compatible Mode" so the npf service will also be installed and i need the npf service since the Software i use does only support npf (WinPcap)

The only thing i have noticed:
When i install winpcap the binary path for the npf service will be set to \system32\npf.sys

When i install npcap with WinPcap Mode the binary path for the npf service will be set to \systemroot\system32\npf.sys

Could this be the Problem?

[libertyx82]

Now i have seen that also the npcap service can not be startet with the same error.

C:\WINDOWS\system32>sc qc npcap
[SC] QueryServiceConfig ERFOLG

SERVICE_NAME: npcap
        TYPE               : 1  KERNEL_DRIVER
        START_TYPE         : 1   SYSTEM_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : \SystemRoot\system32\DRIVERS\npcap.sys
        LOAD_ORDER_GROUP   : NDIS
        TAG                : 64
        DISPLAY_NAME       : Npcap Packet Driver (NPCAP)
        DEPENDENCIES       :
        SERVICE_START_NAME :

C:\WINDOWS\system32>sc start npcap
[SC] StartService FEHLER 2:

Das System kann die angegebene Datei nicht finden.


C:\WINDOWS\system32>

[libertyx82]

Still exists in Version 0.993

After a reboot of windows both services (npcap & npf) can not be startet.

"The system cannot find the file specified"

DiagReport-20190428-112014.txt
install.log
NPFInstall.log

[libertyx82]

This Problem was caused by AV Software Avast after removing Avast npcap is working fine.

[kmahyyg]

Met the same problem here. Windows 8.1 Pro, today. Maybe we need to submit a bug report to Avast or trying to notice Avast user at the homepage of npcap.

[kmahyyg]

https://forum.avast.com/index.php?topic=229610.msg1521334#msg1521334

This problem is caused by very mysterious conflict between our firewall driver and the NPCAP. This is pretty weird because our driver is not loaded in the time when NPCAP initialization (DriverEntry) is failing in the function WSKBind (STATUS_ACCESS_DENIED) and in addition, Bind function is not filtered by our firewall.
There is only one possible cause of this problem - our firewall is using so called boot-time WFP rules, but all of them are set as pass-thru if our driver is not running.
Good news is that some workaround exists. Please, rename attached file to npcap.reg and import it to the Registry by double-click. After reboot, loading of NPCAP driver will be postponed to the time when our firewall is running and boot-time WFP rules are out of game.

The temporary workaround is copied here from Avast forum. Either uninstall Avast or save the text below into a avast-npcap-conflict-fix.reg and then double-click to solve this problem, it depends on you.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap]
"Start"=dword:00000002

[Aholicknight]

I am currently having this problem also. If I remove the firewall component for Avast, will this work?

[kmahyyg]

I am currently having this problem also. If I remove the firewall component for Avast, will this work?

I don't know. Since recently, Avast and AVG are exposed to selling personal privacy information, I strongly suggest any of you here remove Avast/AVG completely.

[Aholicknight]

Thank god I pirated avast. @kmahyyg