Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When installing WinPcap 4.1.2 on Windows 7 I receive the following message

"A previous version of WinPcap has been detected on this system and cannot be
 removed because in use by another application.  Please close all the
 WinPcap-based applications and run the installer again."

I've installed and uninstalled the program several times. According to the WinPcap FAQ I need to delete packet.* and wpcap.dll as well as npf.sys. Done. Additionally, I've removed the Network Packet Filter 'device' using the device manager.

I also did a search in the registry for winpcap with no results. I searched for wpcap and found only one entry - a header file in an include directory. I renamed it to .old with no success.

Further, I downloaded the source code and searched for part of the message above hoping to find how it checks for previous versions. That string (version of WinPcap) was not found in the source code (using grep in cygwin).

Finally, I emailed the two people who are listed as contacts for the program.

I also tried installing the program as an Administrator.

No luck. You all are my last hope. :)

The question is as above - I want to remove the old version of WinPcap. But other questions that could help me are, how does a program check for previous versions? Is there something else I should be searching for in the registry? Is there a way to find out which program is using winpcap? Is there a way to see if any programs have a dependency on winpcap? Any leads would be greatly appreciated.


share|improve this question
Why do you have a "Windows 8 include directory" in Win7? – Karan Jan 3 '13 at 19:55
Are you using Windows 7 or Windows 8? This is important information. Please remove any reference to the version of Windows your not using. – Ramhound Jan 3 '13 at 19:59
Karan, The Windows 8 include directory I mentioned is likely there due to using Visual Studio 2012 which has Windows 8 functionality. Ramhound, as noted in the first sentence - I am using Windows 7. As to why I mentioned it, I was trying to ensure everyone had as much information as possible. I was not trying to confuse anyone but I clearly did. Apologies. Do you have any suggestions I might try? – CramerTV Jan 3 '13 at 21:30

I resolved this issue on Windows 7 x64 by:

  1. opening a command prompt as administrator (Win+R > cmd > Enter)
  2. navigate to \windows\syswow64
  3. delete Packet.dll
  4. reboot
  5. Install new version of Winpcap
share|improve this answer
As I noted in the question I deleted packet.* which included packet.dll. It didn't work for me. My situation may have been unique. – CramerTV Feb 14 '14 at 21:46
up vote 2 down vote accepted

While I never found a way to remove the old WinpCap my colleague suggested I boot up in safe mode in order to stop the mystery program from using it. Although I still got a warning that an old version was unable to be removed (and do I want to continue with the install?) the installation this time was successful.

So if you find yourself in this dilemma a possible workaround is to boot up in safe mode and install from there.

share|improve this answer

When I uninstalled some Netgear Wireless Adapter software, packet.dll was removed, enabling me to successfully install WinPcap.

share|improve this answer
This fixed my issue as well - I had some crummy Netgear USB software still installed, and it blocked WinPcap... uninstalling made it work, thanks! – agent86 May 7 '15 at 23:54
Use Process Explorer feature Find Handle or DLL to find the application that is using Packet.dll file. In my case it was same Netgear wifi USB adapter software. – Casey Mar 2 at 9:22

After the package removal, a reboot should be done before attempting to reinstall the package.

share|improve this answer
Thanks mdpc - rebooting is always good advice when finding strange problems but this time it has not helped. This is actually a very long standing problem for me. I first attempted using WinPcap (via Wireshark) 3 months ago and have simply been doing without it. I tried again yesterday with the same results but now I cannot just 'do without' anymore. – CramerTV Jan 3 '13 at 21:25

This worked for me.

Find and rename the following 2 files:

rename wpcap.dll to wpcap.dll.old

rename packet.dll to packet.dll.old

Try to reinstall WinpCap again.

share|improve this answer
I found that solution on the web, though it said to delete the files but alas, it didn't work for me. – CramerTV Nov 18 '13 at 23:18

as mentioned before, Packet.dll was being locked by another process. Windows 7 announces why it cannot be deleted when you try. Note which process has locked the dll and stop it (check Services and Processes) Remove the dll and restart the installation.

share|improve this answer
I did not receive an error when I deleted packet.dll. As I noted in the original post "According to the WinPcap FAQ I need to delete packet.* and wpcap.dll as well as npf.sys. Done." (and it didn't work) – CramerTV Nov 25 '13 at 18:22

I had this problem running Win 7 x86. Attempted upgrade from v4.1.2 to v4.1.3.

I uninstalled v4.1.2 succesfully using vanilla MS uninstall

Using the earlier post for x64 users as a guide I navigated to the folder containing the file packet.dll. For x86 users it is located in \windows\system32 and attempted to delete that file.

If there is an application relying on the packet.dll file you will not be able to delete it. Not so bad because you should also get a message telling you which application(s) is currently using packet.dll

Take note of that application. Open task manager. Go to services. Find the Application. Right click and stop the service.

Now you can install WinPcap successfully. In my case I did not need to do a reboot.

Lastly in task manager, restart any services you stopped previously.

share|improve this answer

You must log in to answer this question.

protected by Community Feb 5 '15 at 1:30

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .