Skip to content

Npcap 0.995 crashes IRQL_NOT_LESS_OR_EQUAL in NPF_DetachAdapter #347

Closed

Description

@dmiller-nmap

This is a separate issue from some of the widely reported crashes when attempting to install or upgrade Npcap 0.995. Future installers will address that issue by offering to disable Npcap until reboot, upon which the installation/upgrade can be reattempted, avoiding a crash.

This issue, solved in 88b8c89, is due to the driver unloading before all filter modules have finished detaching, and was introduced in Npcap 0.994.

Activity

  1. dmiller-nmap commented on Jun 15, 2019

    @dmiller-nmap
    ContributorAuthor

    This issue is resolved in Npcap 0.996, released today. https://npcap.org/#download

    Because Npcap 0.995 consistently crashes some systems, the Npcap 0.996 installer will offer to disable the npcap driver service on the next boot so that the installation can be reattempted. You can also manually disable it by following these steps:

    1. In an Administrator command shell, run: sc.exe config npcap start=disabled
    2. If Npcap was installed in WinPcap API-compatible mode, also run: sc.exe config npf start=disabled
    3. Reboot. There may be one more BSoD crash at this point, but it will be the last one.
    4. Run the Npcap installer to upgrade Npcap, or uninstall it via "Add or Remove Programs" control panel. Since the service is disabled, it can safely be removed.
  2. transferred this issue fromnmap/nmapon May 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions