Npcap 1.70 & 1.71 fails to uninstall

[gbloice]

Currently have 1.60 installed, Win 10 21H2 up to date.

From the uninstaller:

Reading service options from registry
Output folder: C:\Program Files\Npcap
Rename: C:\WINDOWS\system32\Npcap\wpcap.dll->C:\WINDOWS\system32\Npcap\wpcap.dll.del
Rename: C:\WINDOWS\system32\Npcap\Packet.dll->C:\WINDOWS\system32\Npcap\Packet.dll.del
Rename: C:\WINDOWS\system32\Npcap\NpcapHelper.exe->C:\WINDOWS\system32\Npcap\NpcapHelper.exe.del
Rename: C:\WINDOWS\system32\Npcap\WlanHelper.exe->C:\WINDOWS\system32\Npcap\WlanHelper.exe.del
Rename: C:\WINDOWS\system32\Npcap\wpcap.dll->C:\WINDOWS\system32\Npcap\wpcap.dll.del
Rename: C:\WINDOWS\system32\Npcap\Packet.dll->C:\WINDOWS\system32\Npcap\Packet.dll.del
Rename: C:\WINDOWS\system32\Npcap\NpcapHelper.exe->C:\WINDOWS\system32\Npcap\NpcapHelper.exe.del
Rename: C:\WINDOWS\system32\Npcap\WlanHelper.exe->C:\WINDOWS\system32\Npcap\WlanHelper.exe.del
Stopping the npcap driver
Unable to stop driver.
Rename: C:\WINDOWS\system32\Npcap\wpcap.dll.del->C:\WINDOWS\system32\Npcap\wpcap.dll
Rename: C:\WINDOWS\system32\Npcap\Packet.dll.del->C:\WINDOWS\system32\Npcap\Packet.dll
Rename: C:\WINDOWS\system32\Npcap\NpcapHelper.exe.del->C:\WINDOWS\system32\Npcap\NpcapHelper.exe
Rename: C:\WINDOWS\system32\Npcap\WlanHelper.exe.del->C:\WINDOWS\system32\Npcap\WlanHelper.exe
Rename: C:\WINDOWS\system32\Npcap\wpcap.dll.del->C:\WINDOWS\system32\Npcap\wpcap.dll
Rename: C:\WINDOWS\system32\Npcap\Packet.dll.del->C:\WINDOWS\system32\Npcap\Packet.dll
Rename: C:\WINDOWS\system32\Npcap\NpcapHelper.exe.del->C:\WINDOWS\system32\Npcap\NpcapHelper.exe
Rename: C:\WINDOWS\system32\Npcap\WlanHelper.exe.del->C:\WINDOWS\system32\Npcap\WlanHelper.exe
Unable to stop driver. Npcap service is 'Write-Host : The 'Write-Host' command was found in the module 'Boxstarter.Chocolatey', but the module could not be 
loaded. For more information, run 'Import-Module Boxstarter.Chocolatey'.
At line:1 char:41
+ Stop-Service -Name npcap -PassThru | %{ Write-Host $_.Status }
+                                         ~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Write-Host:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CouldNotAutoloadMatchingModule
 
'. Uninstall reverted.
Unable to stop driver

I've had boxstarter installed on this machine for almost 3 years.

I normally run PowerShell 7, I also attempted a command line uninstall from an elevated PowerShell 5 prompt but got the same results.

I suspect this is one of those annoying PowerShell 5\7 incompatibility issues.

Finally got uninstall to complete from a PowerShell7 elevated prompt by first running Import-Module Boxstarter.Chocolatey to pre-load the module causing issues.

[dmiller-nmap]

Thanks for this report. Can you provide a few extra diagnostic details?

• From the PS prompt where the issue occurs, output of the following commands:
  • $env:PSModulePath
  • Get-Command powershell.exe
  • Get-Command Write-Host
• Does the uninstall succeed from an elevated cmd.exe shell or via "Add and Remove Programs" or appwiz.cpl?
• Did this procedure work with previous Npcap versions (e.g. uninstalling Npcap 1.55)?

[gbloice]

Thanks for this report. Can you provide a few extra diagnostic details?

• From the PS prompt where the issue occurs, output of the following commands:

  • $env:PSModulePath

C:\Users\<myUserName>\Documents\PowerShell\Modules;C:\Program Files\PowerShell\Modules;c:\program files\powershell\7\Modules;C:\Users\<myUserName>\Documents\WindowsPowerShell\Modules;C:\ProgramData\Boxstarter;C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules

• Get-Command powershell.exe

> Get-Command powershell.exe | ft -AutoSize

CommandType Name           Version        Source
----------- ----           -------        ------
Application powershell.exe 10.0.19041.546 C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe

• Get-Command Write-Host

> Get-Command Write-Host | ft -AutoSize

CommandType Name       Version Source
----------- ----       ------- ------
Alias       Write-Host 2.13.0  Boxstarter.Chocolatey

• Does the uninstall succeed from an elevated cmd.exe shell or via "Add and Remove Programs" or appwiz.cpl?

Nope. All fail with the uninstaller displaying "Unable to stop driver".

• Did this procedure work with previous Npcap versions (e.g. uninstalling Npcap 1.55)?

Hadn't had any issues with all the previous versions that I'd installed.

[rknall]

Do you guys need more information on fixing this? Would like to update the Wireshark builder for 1.70 and holding off atm.

[dmiller-nmap]

I think we have a solution. We have switched to using fully-qualified command names (e.g. Microsoft.PowerShell.Security\Set-Acl) to avoid running commands from modules that have clobbered built-in command names. Npcap 1.55 was the first release to use the -NoProfile option when invoking PowerShell, in order to address #529. This is probably why BoxStarter is not able to autoload, since something in the user's profile is likely required (setting $PSModuleAutoLoadingPreference perhaps). The failure here is in the Npcap 1.55 uninstaller, unfortunately, which means that the problem will continue to present any time Npcap 1.55 is uninstalled. We'll continue looking into options to work around this, such as replacing the uninstaller during upgrades.

[dmiller-nmap]

Relevant npcap-build (private) commit: nmap/npcap-build@170e850e92c5e67056a50e719723105f30c9282f

[gbloice]

Issue still present with 1.71, the workaround I noted above still works (install from a a PowerShell7 elevated prompt by first running Import-Module Boxstarter.Chocolatey to pre-load the module causing issues, then run npcap-1.71.exe

[dmiller-nmap]

@gbloice Can you clarify whether the issue is present when trying to uninstall Npcap 1.71 or when trying to upgrade to 1.71 from an earlier version? Can you provide the install.log from uninstalling Npcap 1.71?

[guyharris]

Can you clarify whether the issue is present when trying to uninstall Npcap 1.71 or when trying to upgrade to 1.71 from an earlier version?

I.e., it sounds as if uninstalling 1.60, as part of the process of installing 1.70 or 1.71, is what's failing.

[gbloice]

Sorry for the delay in responding.

The issue came up when upgrading 1.60 to 1.70 and again when upgrading 1.70 to 1.71.

The issue seemed to me to be a clash of external PS cmdlets such that the uninstall script failed to run.

[Walter784]

I just upgraded from 1.60 to 1.70 on Win10 64-bit machine and had same problem. Initially unable to unstall Npcap either via Wireshark upgrade or via Windows Application uninstall. But I rebooted my machine and was finally able to properly uninstall Npcap 1.60 and then successfully upgrade to 1.70.

Cheers,

[vp-trellix]

I am unable to uninstall npcap with 1.7x versions. Isnt there a cleanup utility?

[Walter784]

I performed a reboot, followed by opening up Windows application manager and manually uninstalling it from Windows. I tried it before rebooting the PC but it wouldn't work. But after rebooting the PC, it finally worked. Then you can re-install Wireshark with no problem.

[fyodor]

Hi all. I'm closing this as we haven't heard anything more about the issue since 2022. Maybe @dmiller-nmap's improved uninstaller (which was included one newer Npcap's released since then) resolved it, or maybe BoxInstaller made a change which prevented the interference. If anyone is still experiencing the problem, please leave the details here so we can re-open or just create a new ticket. Thanks!