How to recover from Winsock Error

This is a real incident reported by one of my client. Appearantly his 14 year old son has been using his office computers and after he left, the internet connection on that computer stops working.

• Cannot get IP Address (DHCP - no dns resolution) ipconfig /renew command, you may receive an error message.
• PING error.
• FTP any site, it return with a socket error.
• Browser cannot display pages.

The kid may have been visiting some website or download some software. The problem looks like anti virus and anti spyware on the computer detected it (see log) and removed the virus/spyware. But in the process, it may have caused the TCP/IP stack to be corrupted.

Windows’ network socket facility for applications, is extensible by a mechanism known as a Layered Service Provider (LSP). Winsock LSPs are available for a wide range of useful purposes, including internet parental controls, and web content filtering. Sometimes in removing a malformed (also known as "buggy") LSP could result in corruption of the Winsock catalog in the registry, potentially resulting in a loss of all network connectivity. Winsock now has the ability to self-heal after a user uninstalls such an LSP.

I ran the cexx.org LSPFix.exe it was able to detect malform LSP and I promptly have it removed. The system was able to perform IPCONFIG /renew (get IP) and able to ping but still cannot connect to websites.

After some research, I found the following solution. As the computer had SP2 install, the problem was quickly resolved.

If you have Windows XP with Service Pack 2 it have the new "Network Protection Technology" which allows you to recover from winsock related error. Type netsh winsock reset catalog at the command prompt, and then press ENTER. Then reboot the computer.

The netsh winsock reset catalog command (Microsoft calls this Winsock Self Healing) resets the Winsock catalog to the default configuration. This can be useful if a malformed LSP is installed that results in loss of network connectivity. While use of this command can restore network connectivity, it should be used with care because any previously-installed LSPs will need to be re-installed.

The netsh winsock show catalog command displays the list of Winsock LSPs that are installed on the computer.

The following 2 steps procedure is for you to fix this problem manually.

Step 1: Delete the corrupted registry keys

Note: remember to backup your registry first.

1. Click Start, and then click Run.
2. In the Open box, type regedit, and then click OK.
3. In Registry Editor, locate the following keys, right-click each key, and then click Delete:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2
4. When you are prompted to confirm the deletion, click Yes.

Note Restart the computer after you delete the Winsock keys. Doing so causes the Windows XP operating system to create new shell entries for those two keys. If you do not restart the computer after you delete the Winsock keys, the next step does not work correctly.

Step 2: Install TCP/IP

1. Right-click the network connection, and then click Properties.
2. Click Install.
3. Click Protocol, and then click Add.
4. Click Have Disk.
5. Type C:\Windows\inf, and then click OK.
6. On the list of available protocols, click Internet Protocol (TCP/IP), and then click OK.
7. Restart the computer.

Updated On: 15.02.17