[nordvark]

Hi, I'm currently in Geek uni and looking at a FRST log file from a win7 pro 64 pc and under system errors is listed

 

The WinPcap Packet Driver (NPF) service failed to start due to the following error:
%%2

 

I do not believe this is a malware issue, but guessing it might be yet another lingering relic from my trial of "Private Internet Access" a vpn service which has left mess everywhere.

 

A little research has revealed there is 3 entries for winpcap in the registry under services/npf, and the path shown is Windows/sys32/drivers/npf.sys. That file does not exist on 3 of my win7 pc's. Im now assuming when I uninstalled (haha) private internet access it took the file out without taking the corresponding regfiles. 

 

Does my theory stand up? and thanks

 

PS: this is not a practice log question of any sort.

Edited by nordvark, 21 June 2015 - 12:40 AM.

[Advertisements]

Winpcap is not part of WIndows. It's used by network applications that require packet capture, filtering and injection (Wireshark uses it I think). If you have no apps that use it, you can uninstall

[azarl]

Winpcap is not part of WIndows. It's used by network applications that require packet capture, filtering and injection (Wireshark uses it I think). If you have no apps that use it, you can uninstall

[Ztruker]

Web page for it is here: http://www.winpcap.org/

[nordvark]

Winpcap is not part of WIndows. It's used by network applications that require packet capture, filtering and injection (Wireshark uses it I think). If you have no apps that use it, you can uninstall

Theres nothing to uninstall, never had wireshark. Im thinking it was part of Private internet access, but then I dont know for sure. I have since backed up and removed the registry references to it. Will watch for a while before deleting the reg backups.

 

I see youre involved in the malware side of things here even though im yet to inflict myself upon you. Can I ask what maybe a stupid question? Even though Im currently working with otl and hjt logs, I have however been playing with frst logs to look at the differences. I notice with frst logs there are the latest 10 errors listed in a logfile. Is there a way to clear those errors from the pc to start fresh. With regard to the winpcap error, there is no reference i can find of it in my event viewer logs.

 

Thank you.

[nordvark]

Web page for it is here: http://www.winpcap.org/

Thank you for the link, although I did look at the site before deciding to backup and remove the registry entries for winpcap.

 

I also found this link supposedly listing all applications that use it WinPcap · Links Dont know how accurate that list is but Ive never used any of the listed software. The only network scanning tool I ever use is a portable app called netscan because I have an extensive wired home network and sometimes I need to remind myself of an IP.

 

Thanks again

[azarl]

Theres nothing to uninstall, never had wireshark. Im thinking it was part of Private internet access, but then I dont know for sure. I have since backed up and removed the registry references to it. Will watch for a while before deleting the reg backups.

 

Winpcap  usually has it's own uninstaller
 

I see youre involved in the malware side of things here even though im yet to inflict myself upon you. Can I ask what maybe a stupid question? Even though Im currently working with otl and hjt logs, I have however been playing with frst logs to look at the differences. I notice with frst logs there are the latest 10 errors listed in a logfile. Is there a way to clear those errors from the pc to start fresh. With regard to the winpcap error, there is no reference i can find of it in my event viewer logs.
 
Thank you.

 

Take a look at http://www.sevenforu...all-events.html

[Ztruker]

Post #7 in that thread provides a little batch file that clears all event viewer areas. Works great.

[nordvark]

Take a look at http://www.sevenforu...all-events.html

 

 

Post #7 in that thread provides a little batch file that clears all event viewer areas. Works great.

 

Thank you both, even though I couldn't see a relationship in any event logs clearing them also removed removed them from a fresh FRST scan.

 

Thank you both, slowly learning.

[azarl]

Me too