First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

uninstall - mmdbresolve.exe could not be removed

  • retag add tags

Trying to uninstall Wireshark but getting the error above. Any thoughts?

Wheatley20's avatar
1
Wheatley20
asked 2019-02-19 23:56:22 +0000
grahamb's avatar
23.8k
grahamb
updated 2020-07-26 13:49:32 +0000
edit flag offensive 0 remove flag close merge delete

Comments

I too am having the same issue uninstalling Wireshark, at least with version 3.0.1...I confirmed no "mmdbresolve.exe" to be running by forcing a taskkill command and cannot even locate the .exe. Also, I don't believe this .exe has ever ran since I never captured packets while 3.0.1 was open and running.

I've been trying to uninstall the app as an administrator as well. Has anyone else encountered this same experience with 3.0.1 and found a resolution? I've never encountered this issue until 3.0.1.

jkang's avatar jkang (2019-04-30 17:50:01 +0000) edit

Bug opened here

Chuckc's avatar Chuckc (2020-07-24 04:14:14 +0000) edit
add a comment see more comments

3 Answers

0

(file this under "how to fix" not "why it's broke")

Testing here on Windows 10. Use the Windows App setting to invoke the uninstall.
If uninstall.exe is run from the Wireshark folder the mmdbresolve warning pops up then uninstall fails.

image description


Using the OS uninstaller "may" display a warning about not being to remove the Wireshark folder but it succeeds and the folder is gone.

image description
What the Uninstall will look like on Windows Apps page.

image description

And this is an issue with the most current 3.2.5 release if uninstall.exe is run directly:
image description

Chuckc's avatar
3k
Chuckc
answered 2020-07-23 21:42:35 +0000, updated 2020-07-23 22:01:58 +0000
edit flag offensive 0 remove flag delete link

Comments

There's nothing special about mmdbresolve.exe. It just happens to be at the top of the deletion stack:
uninstall.nsi
----------------
<snip>

Push "rawshark"
Push "reordercap"
Push "sshdump"
Push "text2pcap"
Push "tshark"
Push "udpdump"

!ifdef MMDBRESOLVE_EXE
Push "mmdbresolve"
!endif

Pop $EXECUTABLE
${DoUntil} $EXECUTABLE == ${EXECUTABLE_MARKER}

    ; IsWiresharkRunning should make sure everything is closed down so we *shouldn't* run
    ; into any problems here.
    Delete "$INSTDIR\$EXECUTABLE.exe"
    IfErrors 0 deletionSuccess
        MessageBox MB_OK "$EXECUTABLE.exe could not be removed. Is it in use?" /SD IDOK IDOK 0
        Abort "$EXECUTABLE.exe could not be removed. Aborting the uninstall process."

deletionSuccess:
    Pop $EXECUTABLE

${Loop}
Chuckc's avatar Chuckc (2020-07-23 22:21:51 +0000) edit

Having run some testing I think this issue occurs because the uninstaller doesn't request elevation so it can't delete anything from controlled directories such as "Program Files". Running the uninstall from the settings dialog runs the uninstaller with elevated privileges, or you can manually elevate the uninstaller yourself using various methods.

grahamb's avatar grahamb (2020-07-25 09:33:23 +0000) edit
add a comment see more comments
0

The problem occurs, as suggested by the answer by @Chuckc, because the uninstaller does not request privilege escalation so if it's run unelevated, e.g. by double clicking uninstall.exe, it's unable to delete files in protected directories such as "C:\Program Files\Wireshark".

Change 37955 and the related ones for other versions (3.2, 3.0 and 2.6) modifies the uninstaller to always request elevated privileges and is available now for automated builds and will be in the next releases when they are made.

Note that the uninstaller won't delete files that it doesn't know about, so if other files are in the install directory, e.g. a capture made with elevated privileges, the installer will note it was unable to delete the application directory.

grahamb's avatar
23.8k
grahamb
answered 2020-07-25 19:29:45 +0000, updated 2020-07-25 19:30:12 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments
0

I assume Wireshark isn't running when you're trying to uninstall it.

If it is still running, try shutting it down first.

If it's not still running, find mmdbresolve in Task Manager and, if it's still running, "end" it from Task Manager - and then tell us what version of Wireshark you were running. There was a bug that, in some cases, meant that mmdresolve kept running after TShark exited; that was apparently fixed in 2.6.5.

Guy Harris's avatar
19.9k
Guy Harris
answered 2019-02-20 01:08:08 +0000
edit flag offensive 0 remove flag delete link

Comments

WAs told this my issue was a duplicate of this and to continue here.
I was trying to uninstall wireshark 3.0.2 and keep getting the error that it cant find that exe is it running. I have looked and that file is not even on my pc. I have tried to reinstall on top, reboot, create a file with that name, and remove the wireshark folder from program files. This is on a win10 pc. I have also tried logging in as administrator, doing run as administrator etc.

ruebert's avatar ruebert (2019-07-03 18:22:02 +0000) edit

Having the same issue. File not on PC, there is no take or process running with that name. Can we just have an uninstaller that will not ask for that process but will remove the program and all the registry keys please.

Silvia's avatar Silvia (2020-07-23 21:04:21 +0000) edit

What happens if you create a dummy file with that name, does the uninstaller then complete?

grahamb's avatar grahamb (2020-07-23 21:43:32 +0000) edit
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer