Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Faulty uninstall #1767

Open
Aptimex opened this issue Sep 30, 2019 · 5 comments

Comments

@Aptimex
Copy link

commented Sep 30, 2019

During a recent install of Wireshark on Win10 I selected the "Restrict Npcap driver's access to Administrators only" option. However, opening Wireshark caused a bunch of repeated UAC prompts to be triggered. I can't remember the exact next sequence of events, but I eventually tried to reinstall npcap with that box unchecked. I remember the uninstall reporting success, but all attempts to reinstall with the standalone 0.9983 now fail:
npcap

I went on an npcap purge and manually deleted every reference to it that I could find: the Program Files folder that still existed, the loopback driver in device manager, all the .dll files for it, several registry keys referencing the drivers, and probably a few other things that I can't remember. Install still fails at this screen.

I reinstalled Wireshark several times, and each time it detects that the 0.9982 is still installed. I went so far as to look at the source code that Wireshark uses to detect whether it's already installed and found that it opens up a specific registry key. However, when I try to look that key up in RegEdit it doesn't even exist. So I have no idea why Wireshark thinks it's still installed or why the standalone installer just aborts when trying to stop the npcap driver.

Any help would be appreciated.

@dmiller-nmap

This comment has been minimized.

Copy link

commented Sep 30, 2019

Please attach your install.log and NPFInstall.log files as described in the Npcap Guide section on reporting issues. You may need to do a manual uninstall, including DLLs in SYSWOW64 and registry entries in WOW6432NODE, which we can assist with if there's not an underlying bug we can resolve by looking at the logs.

@dmiller-nmap dmiller-nmap added the Npcap label Sep 30, 2019
@CDBridger

This comment has been minimized.

Copy link

commented Oct 1, 2019

I have the same problem. I also went through deleting the DLL's, folders and registry keys and still get the same problem.

Here is the install log.

Call: 726
Jump: 755
Jump: 758
detailprint: Windows CurrentVersion: 10.0 (Win10)
Call: 62
Call: 1000
IfFileExists: file "C:\WINDOWS\system32\wpcap.dll" does not exist, jumping 194
IfFileExists: file "C:\npcap_install_options.txt" does not exist, jumping 199
Call: 200
Jump: 217
Jump: 234
Call: 238
Jump: 328
Call: 238
Call: 238
Call: 238
Call: 238
Call: 238
Call: 238
Call: 238
Call: 238
Call: 238
Call: 119
Jump: 175
Call: 119
Jump: 175
Call: 1338
File: overwriteflag=1, allowskipfilesflag=2, name="C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\SimpleSC.dll"
File: wrote 62976 to "C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\SimpleSC.dll"
Call: 119
Jump: 517
Call: 1338
File: overwriteflag=0, allowskipfilesflag=2, name="C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\modern-header.bmp"
File: wrote 70976 to "C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\modern-header.bmp"
WriteINIStr: wrote [Field 1] State=0 in C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\options.ini
Jump: 533
WriteINIStr: wrote [Field 2] State=0 in C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\options.ini
Jump: 546
WriteINIStr: wrote [Field 3] State=0 in C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\options.ini
Jump: 559
WriteINIStr: wrote [Field 4] State=0 in C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\options.ini
Jump: 576
Call: 1338
File: overwriteflag=1, allowskipfilesflag=2, name="C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\InstallOptions.dll"
File: wrote 14848 to "C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\InstallOptions.dll"
Jump: 599
Jump: 610
New install of "Npcap 0.9983" to "C:\Program Files\Npcap"
Section: "WinPcap"
Call: 1079
Jump: 1094
detailprint: Stopping the npcap driver
Call: 1338
File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\SimpleSC.dll"
File: skipped: "C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\SimpleSC.dll" (overwriteflag=1)
Jump: 1166
settings logging to 0
logging set to 1
Jump: 1327
Aborting: ""
Delete: DeleteFile("C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\final.ini")
Delete: DeleteFile("C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\InstallOptions.dll")
Delete: DeleteFile("C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\modern-header.bmp")
Delete: DeleteFile("C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\nsExec.dll")
Delete: DeleteFile("C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\options.ini")
Delete: DeleteFile("C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\SimpleSC.dll")
Delete: DeleteFile("C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\System.dll")
RMDir: RemoveDirectory("C:\Users\charl\AppData\Local\Temp\nse5E52.tmp\")

EDIT: I realise mine differs a little, I did not attempt to install wit restrictions left to admin. My issue is like #1762

@Fently

This comment has been minimized.

Copy link

commented Oct 2, 2019

Indeed, also having this issue. Much sadness.
Call: 764 Jump: 793 Jump: 796 detailprint: Windows CurrentVersion: 10.0 (Win10) Call: 85 Call: 1044 Jump: 1057 Jump: 1069 IfFileExists: file "C:\Windows\system32\wpcap.dll" does not exist, jumping 219 IfFileExists: file "C:\npcap_install_options.txt" does not exist, jumping 224 Call: 225 Jump: 242 Jump: 259 Call: 263 Jump: 353 Call: 263 Call: 263 Call: 263 Call: 263 Call: 263 Call: 263 Jump: 283 Jump: 421 Call: 263 Call: 263 Call: 263 Call: 263 Call: 144 Jump: 200 Call: 144 Jump: 200 MessageBox: 292,"Npcap 0.9982 is already installed. Reinstall (possibly with different options)?" Call: 1391 File: overwriteflag=0, allowskipfilesflag=2, name="C:\Users\*****\AppData\Local\Temp\nsg164.tmp\modern-header.bmp" File: wrote 70976 to "C:\Users\*****\AppData\Local\Temp\nsg164.tmp\modern-header.bmp" WriteINIStr: wrote [Field 1] State=1 in C:\Users\*****\AppData\Local\Temp\nsg164.tmp\options.ini Jump: 570 WriteINIStr: wrote [Field 2] State=0 in C:\Users\*****\AppData\Local\Temp\nsg164.tmp\options.ini Jump: 583 WriteINIStr: wrote [Field 3] State=1 in C:\Users\*****\AppData\Local\Temp\nsg164.tmp\options.ini Jump: 596 WriteINIStr: wrote [Field 4] State=0 in C:\Users\*****\AppData\Local\Temp\nsg164.tmp\options.ini Jump: 613 Call: 1391 File: overwriteflag=1, allowskipfilesflag=2, name="C:\Users\*****\AppData\Local\Temp\nsg164.tmp\InstallOptions.dll" File: wrote 14848 to "C:\Users\*****\AppData\Local\Temp\nsg164.tmp\InstallOptions.dll" Jump: 637 Jump: 648 New install of "Npcap OEM 0.9982" to "C:\Program Files\Npcap" Section: "WinPcap" Call: 1132 Jump: 1147 detailprint: Stopping the npcap driver Call: 1391 File: overwriteflag=1, allowskipfilesflag=0, name="C:\Users\*****\AppData\Local\Temp\nsg164.tmp\SimpleSC.dll" File: wrote 62976 to "C:\Users\*****\AppData\Local\Temp\nsg164.tmp\SimpleSC.dll" Jump: 1219 settings logging to 0 logging set to 1 Jump: 1380 Aborting: "" Delete: DeleteFile("C:\Users\*****\AppData\Local\Temp\nsg164.tmp\final.ini") Delete: DeleteFile("C:\Users\*****\AppData\Local\Temp\nsg164.tmp\InstallOptions.dll") Delete: DeleteFile("C:\Users\*****\AppData\Local\Temp\nsg164.tmp\modern-header.bmp") Delete: DeleteFile("C:\Users\*****\AppData\Local\Temp\nsg164.tmp\nsExec.dll") Delete: DeleteFile("C:\Users\*****\AppData\Local\Temp\nsg164.tmp\options.ini") Delete: DeleteFile("C:\Users\*****\AppData\Local\Temp\nsg164.tmp\SimpleSC.dll") Delete: DeleteFile("C:\Users\*****\AppData\Local\Temp\nsg164.tmp\System.dll") RMDir: RemoveDirectory("C:\Users\*****\AppData\Local\Temp\nsg164.tmp\")

I don't have the original install anymore, and I can't reinstall it. Tried removing registries, checking network adapters, removing npcap drivers, trying in safe mode. The program can't be reinstalled at all

My Scenario is almost exactly the same as OP. Enabled ADMIN ONLY mode by accident, tried to reinstall for wireshark and nmap (because nmap was having DNET errors or something) and now I'm stuck. Back to Linux for now!

@pechezerov

This comment has been minimized.

Copy link

commented Oct 4, 2019

My way to solve was to copy uninstaller files from another computer and use it through Programs and Components - Remove

@CDBridger

This comment has been minimized.

Copy link

commented Oct 7, 2019

is there anywhere I can download the uninstaller?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants
You can’t perform that action at this time.