uninstall - mmdbresolve.exe could not be removed
Trying to uninstall Wireshark but getting the error above. Any thoughts?
Trying to uninstall Wireshark but getting the error above. Any thoughts?
The problem occurs, as suggested by the answer by @Chuckc, because the uninstaller does not request privilege escalation so if it's run unelevated, e.g. by double clicking uninstall.exe, it's unable to delete files in protected directories such as "C:\Program Files\Wireshark".
Change 37955 and the related ones for other versions (3.2, 3.0 and 2.6) modifies the uninstaller to always request elevated privileges and is available now for automated builds and will be in the next releases when they are made.
Note that the uninstaller won't delete files that it doesn't know about, so if other files are in the install directory, e.g. a capture made with elevated privileges, the installer will note it was unable to delete the application directory.
(file this under "how to fix" not "why it's broke")
Testing here on Windows 10
. Use the Windows App setting to invoke the uninstall.
If uninstall.exe
is run from the Wireshark folder the mmdbresolve
warning pops up then uninstall fails.
Using the OS uninstaller "may" display a warning about not being to remove the Wireshark folder but it succeeds and the folder is gone.
What the Uninstall will look like on Windows Apps page.
And this is an issue with the most current 3.2.5 release if uninstall.exe
is run directly:
There's nothing special about mmdbresolve.exe
. It just happens to be at the top of the deletion stack:
uninstall.nsi
----------------
<snip>
Push "rawshark"
Push "reordercap"
Push "sshdump"
Push "text2pcap"
Push "tshark"
Push "udpdump"
!ifdef MMDBRESOLVE_EXE
Push "mmdbresolve"
!endif
Pop $EXECUTABLE
${DoUntil} $EXECUTABLE == ${EXECUTABLE_MARKER}
; IsWiresharkRunning should make sure everything is closed down so we *shouldn't* run
; into any problems here.
Delete "$INSTDIR\$EXECUTABLE.exe"
IfErrors 0 deletionSuccess
MessageBox MB_OK "$EXECUTABLE.exe could not be removed. Is it in use?" /SD IDOK IDOK 0
Abort "$EXECUTABLE.exe could not be removed. Aborting the uninstall process."
deletionSuccess:
Pop $EXECUTABLE
${Loop}
Having run some testing I think this issue occurs because the uninstaller doesn't request elevation so it can't delete anything from controlled directories such as "Program Files". Running the uninstall from the settings dialog runs the uninstaller with elevated privileges, or you can manually elevate the uninstaller yourself using various methods.
I assume Wireshark isn't running when you're trying to uninstall it.
If it is still running, try shutting it down first.
If it's not still running, find mmdbresolve in Task Manager and, if it's still running, "end" it from Task Manager - and then tell us what version of Wireshark you were running. There was a bug that, in some cases, meant that mmdresolve kept running after TShark exited; that was apparently fixed in 2.6.5.
WAs told this my issue was a duplicate of this and to continue here.
I was trying to uninstall wireshark 3.0.2 and keep getting the error that it cant find that exe is it running. I have looked and that file is not even on my pc. I have tried to reinstall on top, reboot, create a file with that name, and remove the wireshark folder from program files. This is on a win10 pc. I have also tried logging in as administrator, doing run as administrator etc.
Please start posting anonymously - your entry will be published after you log in or create a new account.
Asked: 2019-02-19 23:56:22 +0000
Seen: 30,013 times
Last updated: Jul 26 '20
I too am having the same issue uninstalling Wireshark, at least with version 3.0.1...I confirmed no "mmdbresolve.exe" to be running by forcing a taskkill command and cannot even locate the .exe. Also, I don't believe this .exe has ever ran since I never captured packets while 3.0.1 was open and running.
I've been trying to uninstall the app as an administrator as well. Has anyone else encountered this same experience with 3.0.1 and found a resolution? I've never encountered this issue until 3.0.1.
Bug opened here