Wireshark 3.0.5 Release: Potential Windows Crash when Updating

Participate: Learn more about our honeypot network
https://isc.sans.edu/tools/honeypot/

Handler on Duty: Didier Stevens

Threat Level: green

Wireshark 3.0.5 Release: Potential Windows Crash when Updating
Wireshark 3.0.5 was just released. There's a warning for Windows users: you might need to perform a manual uninstall of Npcap to avoid a potential Windows crash. From the release notes: If you have Npcap 0.994 or 0.995 installed, your system might crash when upgrading. We recommend that you uninstall these versions manually prior to installing Wireshark. See Npcap bugs 1591 and 1675 for more details. You can uninstall either version manually by doing the following: Open a command or PowerShell prompt as Administrator and run `sc.exe config npcap start=disabled`. Run `sc.exe config npf start=disabled`. This will fail if WinPcap compatibility mode isn’t enabled, but is otherwise harmless. Reboot (optional). Open “Programs and Features” in the Control Panel or “Apps & features” in Settings and uninstall Npcap. Open “Device Manager” (`devmgmt.msc`) in the Control Panel and expand the “Network adapters” section. Uninstall each “Npcap Loopback Adapter” that you find. Didier Stevens Senior handler Microsoft MVP blog.DidierStevens.com DidierStevensLabs.com	DidierStevens 675 Posts ISC Handler Sep 21st 2019
Thread locked Subscribe	Sep 21st 2019 3 years ago