Re: WinPcap setup issue in Nmap Windows installer

[LevelZero <levelzero () retry org>]

On Fri, 14 Dec 2007 11:50:22 +0000, jah <jah () zadkiel plus com> wrote:
> On 14/12/2007 06:58, levelzero () retry org wrote:
> >
> Hi there!
>
> I'm attempting to reproduce the issue you've encountered, but at the
> moment I cannot.  Here's what I see:
> After allowing nmap upgrade winpcap by clicking yes to the message
> dialog that pops-up similar to "WinPcap version 4.01 exists on this
> system. Replace with version 4.02?" I briefly see the nmap-winpcap 4.02
> installer appear, but then the focus is stolen by the winpcap
> uninstaller for 4.01 which pops-up and prompts for an uninstall.  Once
> that is complete and the window closed, installation of nmap-winpcap
> 4.02 can be continued by pressing Next and proceeds without issue.  In
> your case, did the uninstaller window close before you proceeded with
> the nmap-winpcap install?
> I agree that it's possible to perform these actions in a different order
> as there is nothing to prevent the install of nmap-winpcap 4.02 before
> uninstalling the previous version, but it seems that some manual
> intervention is needed to make this happen.
> Is it possible that your windows setup disallows the stealing of focus
> and instead you get flashing taskbar buttons?  This might prevent the
> installers/uninstallers appearing on the desktop in the order that was
> intended.  What do you think?
This isn't quite what I saw happening. The 4.01 deinstall actually got the
focus and came to the foreground, with the 4.02 install running along
happily in the background, without waiting for the deinstall to finish.

> > Similarly, the 4.01 uninstaller seems to require a reboot to be
> completely
> > finished.
> This is not normally required for winpcap, but may be a result of the
> installers being executed in the wrong order and a file locking clash.
> > After this, WinPcap 4.02 was visible in the "Add/Remove Programs" list,
> but
> > wasn't uninstallable (gave an error that it might have been uninstalled
> > already, could then only remove it from the list of installed programs).
> This is entirely consistent with the nmap-winpcap installer being run
> and installing the files which are then removed by the winpcap
> uninstaller.  The registry keys for Add/Remove programs are different
> for the two installations and so the nmap-winpcap are not removed by the
> winpcap uninstaller and remain there, but without any files installed.
> Please let us know whether you agree, or not, that this is what may have
> happened.
> > Uninstalling Nmap, completing the required 4.01 uninstall reboot and
> then
> > restarting the install of Nmap 4.50 + WinPcap 4.02 works :).
> We perhaps need to look at the nmap-winpcap installer again and only do
> an upgrade if the previous version detected is an nmap-winpcap one thus
> not executing a separate uninstaller.
> If a different (eg a wireshark winpcap) install is found, we should
> perhaps prompt the user to uninstall it themselves and rerun nmap
> installation again, aborting nmap-winpcap at that time.
I ran into another issue with the nmap-winpcap install ...
When trying to deinstall nmap + winpcap (and ethereal) to try and duplicate
the issue, the 4.02 version of nmap-winpcap refused to deinstall cleanly.
The DLLs of 4.02 remained in the system32 directory after deinstall (and
even after reboot). This made it impossible to reinstall 4.01, since 4.01
detects the DLLs and aborts install. Renaming the DLLs leads to an error
when the 4.01 installer tries to register the NPF driver. The 4.02
installer I downloaded from winpcap.org now also gives errors on the NPF
driver when installing.

Somehow the deinstaller doesn't quite deinstall cleanly. Is it really
necessary to repackage the original WinPcap installer?

I'll report back when I've managed to sort out the mess I've gotten my
laptop in now :)

-- 
Ignorance is no Excuse


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org