Reference Manual Reference ManualThe l0phtcrack products write the following fake key into the NT registry, and leave it there, even after the user uninstalls the l0phtcrack applications:
HKLM\SYSTEM\CurrentControlSet\Services\NDIS3PktWhen nat32.exe or setup.exe run, the above key indicates that NDIS3PKT.SYS is present on the System. Because this is not the case, you should search for the above key with regedit.exe and delete it. Then reboot your system and run setup.exe.
Note the spelling (case) of the above key. If your registry contains this key:
HKLM\SYSTEM\CurrentControlSet\Services\Ndis3pktthen that is a genuine key indicating that NDIS3PKT.SYS really is installed on your system.
Another way to detect the fake key is that its DisplayName is: NDIS 3.0 Packet Driver, whereas the genuine key has the Display Name: ndis3pkt.
BACKGROUND
The reason why the l0phtcrack author has done this is unclear.
Given that his programs use two drivers based on source code I originally
posted on the WEB a few years back, it is most surprising that he refuses
to remove this deliberate bug from his programs.