RE: I cannot get Nmap and WinPcap off my computer

["Rob Nicholls" <robert () robnicholls co uk>]

Hi Holli,

You can manually delete the WinPcap service under Windows XP onwards by
running the following command from the Command Prompt (if you're on Windows
7 or Vista you'll need to right click Command Prompt and select "Run as
administrator" to launch an elevated privilege version of the command
prompt):

To stop the service (in case it's already running):
sc stop npf

You should then see something like:
SERVICE_NAME: npf
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 1  STOPPED
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

To delete the service, now that it's stopped, run this command:
sc delete npf

I'm assuming you're running a 32-bit version of Windows.

It should then be safe to delete the WinPcap files that will be located at:

C:\Windows\system32\packet.dll
C:\Windows\system32\pthreadVC.dll
C:\Windows\system32\wpcap.dll

If you're running a 64-bit version, these files may end up in
C:\Windows\SysWOW64.

The registry keys for Nmap and WinPcap are located at:
HKEY_LOCAL_MACHINE Software\Microsoft\Windows\CurrentVersion\Uninstall\Nmap
and
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WinPc
apInst

If you delete those keys, the applications should not show up in Add/Remove
programs.

If you're running a 64-bit version of Windows try looking in the registry
at:
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uni
nstall\Nmap
and
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uni
nstall\WinPcapInst

Afterwards, you should be able to remove any files that are left in the
installation directories, which are (by default):
C:\Program Files\Nmap
C:\Program Files\WinPcap

There might be some Start Menu entries left for Nmap that you can right
click and delete.

If you're using 64-bit Windows, try looking in C:\Program Files (x86) if you
can't find them in "Program Files" (IIRC WinPcap still ends up in in the
Program Files directory on x64).

Good luck! It's possible (but unlikely) that another application you have
installed requires WinPcap and is automatically setting WinPcap up again
when it launches, but I'd be surprised if anything was putting Nmap back on
the system automatically. 

Rob

-----Original Message-----
From: nmap-dev-bounces () insecure org [mailto:nmap-dev-bounces () insecure org]
On Behalf Of Holli Robinson
Sent: 11 February 2012 00:19
To: nmap-dev () insecure org
Subject: I cannot get Nmap and WinPcap off my computer

Please help, please.

 

I've tried every possible way I know to remove these programs from my
computer.  Even with Revo Uninstaller, all steps are taken to remove the
programs, but they always return upon reboot.

 

They appear uninstalled through their own uninstaller and/or remove
programs/uninstall = they're back at the first chance possible, i.e. reboot.


 

This is way beyond my knowledge.   I will never, never, never poke around
places again if I downloaded this program myself.  Please share the registry
code or whatever to make it go away..please.

 

Kind regards,

 

Holli Robinson

Hollirobinson () frontier com

503-625-7040

 

 

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/