NPcap upgrade from 1.81 → 1.83 intermittently fails with exit code 2

[vitezslav-popovsky-solarwinds]

Describe the bug
NPcap OEM 1.83 silent upgrade fails randomly with exit code 2
With the following error in the install.log

Sleep(100)
File: overwriteflag=0, allowskipfilesflag=0, name="Uninstall.exe"
File: error creating "C:\Program Files\Npcap\Uninstall.exe"
File: error, user abort

Install options (both installers):
/S /loopback_support=no /dlt_null=no /admin_only=yes /dot11_support=yes /winpcap_mode=no

To Reproduce

1. Uninstall npcap (Uninstall.exe /S)
2. Install 1.81 with the above options
3. Install 1.83 with the above options
4. Repeat until failure (loop)

Expected behavior
Npcap 1.83 should install successfully during the upgrade process without errors, handling file operations reliably and completing the installation in a consistent and resilient manner.

Diagnostic information

• Windows version from winver (e.g. Windows 11 Version 21H2, OS Build 22000.795)
  Windows Server 2019 Version 1809 (OS Build 17763.7792)

• Output of DiagReport
  DiagReport-20250919-201005.txt

• Installation logs
  install.log
  NPFInstall.log

• If installation failed, include SetupApi.dev.log
  setupapi.dev.log

• Any special hardware or software that may be relevant: VPN, firewall, antivirus, virtualization (SR-IOV passthrough, etc).
  VMware vSphere

Additional context
Repro-NpcapUpgrade.txt

PS C:\> .\Repro-NpcapUpgrade.ps1
========== Attempt #1 ==========
Uninstall exit code: 0
1.81 install exit code: 0
1.83 install exit code: 0
========== Attempt #2 ==========
Uninstall exit code: 0
1.81 install exit code: 0
1.83 install exit code: 0
========== Attempt #3 ==========
Uninstall exit code: 0
1.81 install exit code: 0
1.83 install exit code: 0
========== Attempt #4 ==========
Uninstall exit code: 0
1.81 install exit code: 0
1.83 install exit code: 0
========== Attempt #5 ==========
Uninstall exit code: 0
1.81 install exit code: 0
1.83 install exit code: 0
========== Attempt #6 ==========
Uninstall exit code: 0
1.81 install exit code: 0
1.83 install exit code: 2
Done. Final 1.83 exit code: 2

[vitezslav-popovsky-solarwinds]

Update: I reproduced this bug even when performing a silent upgrade from 1.80 → 1.81. (That means it is not only a problem with the 1.83 installer)

[dmiller-nmap]

Thanks for reporting this. We will investigate and respond with our findings.

[guyharris]

The email I got from GitHub said it was "Closed ... as completed via 128f9122d784832b30d3c51a26c9da8a3532c6a5.", but I'm not seeing that commit in the Npcap repository.

[fyodor]

Hi @guyharris. Since this is an installer change, the commit is in the npcap-build repo rather than plain npcap. I think we limited access to npcap-build to just developers some years ago to make it a bit harder for malicious folks to build trojan Npcap installers and such. I can certainly answer any questions you might have about this fix or even add you to that repo if it would be helpful.

[guyharris]

I can certainly answer any questions you might have about this fix or even add you to that repo if it would be helpful.

No, it was more out of curiosity what the fix was for this problem.

[dmiller-nmap]

@guyharris The basic gist is this:

1. When Npcap is upgraded, the installer runs the existing Uninstall.exe with the _?=$INSTDIR argument, which prevents it from relocating to a temp directory, in order to be able to wait for the process to complete.
2. The uninstaller itself removes the previous install, but cannot remove itself.
3. When the uninstaller returns, the installer removes the Uninstall.exe. The logs show that removing Uninstall.exe succeeds, but some part of the process is still around, keeping the file locked. This might be because of AV scanning, filesystem cache/MRU/accesstime changes pending, leftover threads, or some other reason.
4. When installer tries to unpack its own Uninstall.exe, it fails.

The solution is to copy the uninstaller to our temporary directory and run it from there. That way the copy in $INSTDIR can be deleted without issues.

[vitezslav-popovsky-solarwinds]

@dmiller-nmap Thank you for fixing this! If I’m not mistaken, the actual fix should be included in the next release. Is there an ETA for Npcap 1.85? We’re looking forward to testing it.

[vitezslav-popovsky-solarwinds]

@dmiller-nmap @bonsaiviking I tested the upgrade from npcap-1.81-oem.exe to npcap-1.85-oem.exe and was able to reproduce the issue. My understanding is that this behavior is expected because the root cause lies in the npcap-1.81-oem uninstaller. Therefore, the problem should not occur when upgrading from npcap-1.85-oem or later. Could you confirm if that interpretation is correct?

Could you also suggest a scenario to verify that the issue is truly resolved?