This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Uninstall leaves packet.dll behind in system32 folder of Windows

0

1.I uninstalled Wireshark from my Windows 10 Laptop but I see packet.dll still installed. I tried the following:

C:\Windows\System32>driverquery | findstr /i winpcap WPRO_41_2001 WinPcap Packet Driver Kernel 11/7/2011 4:04:48 PM

C:\Windows\System32>del Packet.dll C:\Windows\System32\Packet.dll Access is denied.

I tried to reinstall Wireshark then Winpcap and uninstall it, nothing helped. Can you please tell me how to get rid of driver

asked 27 Sep '17, 11:23

relahi's gravatar image

relahi
6112
accept rate: 0%


One Answer:

0

Packet.dll is usually installed by WinPcap, but can sometimes be installed by other applications that may have "borrowed" or re-implemented it (e.g. Npcap).

Have you tried uninstalling WinPcap on its own? Do you have other capture drivers installed, e.g. Npcap which is part of Nmap?

answered 27 Sep '17, 15:15

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

I did reinstall winpcap and removed it, but packet.dll stays there. I currently do not have any other packet capturing software installed.

Thanks Rahat

(28 Sep '17, 07:16) relahi

The digital signature tab of the properties screen says, it is signed by Riverbed Technologies Inc.

(28 Sep '17, 07:18) relahi

I suspect this is installed by something other than WinPcap, possibly something from Riverbed (or another licencee) that uses "WinPCap Pro" the commercial version.

In WinPcap, packet.dll is the user mode portion of the packet capture API and isn't installed as a driver and so does not show up in driverquery. The WinPcap driver is npf.sys that shows up as NPF NetGroup Packet Filter Kernel 01/03/2013 01:31:24.

Try using Driver Store Explorer(RAPR) (with care) and see what that says about the issue. RAPR can also remove drivers.

(28 Sep '17, 08:21) grahamb ♦

Thank you for your response, I just tested that on another system, installed winpcap only and uninstall winpcap leaves packet.dll behind as well. I have sent the same question to Riverbed Technologies.

Using RAPR on my system does not list packet.dll installed. It does not list anything from Riverbed Technologies.

Thanks Rahat

(28 Sep '17, 09:11) relahi

Can you move (or delete) the packet.dll file on the other system you tested on?

(28 Sep '17, 09:26) grahamb ♦

I just tried uninstalling Winpcap on my system and packet.dll was left behind, but it could be deleted, so there does seem to be an uninstaller issue.

The issue is unlikely to be fixed, all work on WinPCap has ceased.

(28 Sep '17, 09:42) grahamb ♦

It was Windows Server 2012 I was able to delete it.

I went back to Win 10, started command prompt with "run as" Administrator and was able to delete there as well.

Issue resolved.

Thanks for your help.

Rahat

(28 Sep '17, 09:58) relahi
showing 5 of 7 show 2 more comments