The process known as npf.sys (NT5/6 AMD64) Kernel Driver or npf.sys (NT5/6 (version x86) Kernel Driver) or WinPcap Packet Driver (NPF) belongs to software NetGroup Packet Filter Driver or WinPcap Netgroup Packet Filter Driver or WinPcap Packet Driver (NPF) by CACE Technologies (Riverbed Product Catalog) or Riverbed Technology.
There is definitely a signed version of that driver available - either the program is using an old version or it's a fake.
Please run the script in BSOD - Posting Instructions - Windows 10 Forums while the error message is on the screen, if possible, to collect information about the current running processes and post the zip file to this thread.
Last edited by Brink; 12 Feb 2018 at 12:32. Reason: fixed quote box
To know which program using WinPcap driver first you need to understand why programs are using this driver.
WinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocol stack, and has additional useful features, including kernel-level packet filtering, a network statistics engine and support for remote packet capture
Usually, it's because you're running a program like Wireshark which wants to see everything coming into your network interface. FreeBooter's point might also be that something illicit or unwanted might be using it without your knowledge. OTH, you can always disable it and just wait for something to break! I just went looking for WinPcap in DevMgr on my protocol analyzer machine, though, and I don't see it under network adapters or system devices. Am I looking in the wrong place?
--Ed--
Last edited by EdTittel; 12 Feb 2018 at 16:15. Reason: Fix typo
Usually you can uninstall WinPcap driver from Start Menu > Control Panel > Programs and Features.
You can also disable or enable WinPcap service from Services manger. Type Services.msc into Start Menu and press Enter key to open Services manger. There should also be a WinPcap service that allows remote access to your computer using WinPcap driver if its not used it should be disabled for security reasons.
Yes, thanks FreeBooter! Just looked in Programs and Features where, thanks to the miracle of the ASCII collating sequence, here's what I see:
And while it is a driver (of sorts, because it plugs into the IP stack at Layer 2) Windows treats it as a program, which is why it shows up in "Programs and Features." Doh! Thanks for helping me to once again belabor the obvious.
Best wishes,
--Ed--
Quote
