Forums

Malwareteks :: Forums :: Help and Guidelines :: Knowledge Base		<< Previous thread \| Next thread >>
How to Rebuild Winsock2


Moderators: ShadowPuterDude, Greg, D3m3nt3d, Brandon, Vmarm, peterparker, siljaline, jholland1964, TurcoLoco, Windsor, JeanInMontana, KZ, RatHat, Jason Amison, MrCharlie	This thread is now closed

Author

Post

ShadowPuterDude

Mon May 08 2006, 09:52PM

...the Shadow knows

Registered Member #1

Joined: Thu Apr 27 2006, 04:52PM
Location: Northern NY
Posts: 251
Thanked 12 times in 12 posts

This is a Self-Help Procedure. MalwareTeks is in no way liable for anything which may go wrong.

How to rebuild Winsock2

Please print out these instructions so that you can operate with All Browser Windows CLOSED.

SYMPTOMS

When you try to release and renew the IP address using the Ipconfig program, you may receive the following error message:

An error occurred while renewing interface 'Internet': An operation was attempted on something that is not a socket.

When you start Internet Explorer, you may receive the following error message:

The page cannot be displayed

When you use your computer, you may receive the following error message:

Initialization function INITHELPERDLL in IPMONTR.DLL failed to start with error code 10107

Additionally, you may have no IP address or no Automatic Private IP Addressing (APIPA) address, and you may be receiving IP packets but not sending them.

When you use the ipconfig /renew command, you may receive the following error messages.

Message 1
An error occurred while renewing interface local area connection: an operation was attempted on something that is not a socket. Unable to contact driver Error code 2.

Message 2
The operation failed since no adapter is in the state permissible for this operation.

Message 3
The attempted operation is not supported for the type of object referenced.

In Device Manager, when you click Show Hidden Devices, the TCP/IP Protocol Driver is listed as disabled under Non-Plug and Play drivers, and you receive error code 24.

When you create a dial-up connection, you may receive the following error message:

Error 720: No PPP Control Protocols Configured

How to determine whether the Winsock2 key is corrupted

To determine if the symptoms are caused by a problem with the Winsock2 key, use one of the following methods.

Method 1: Use the Netdiag tool

To use the Netdiag tool, you must install the Microsoft Windows XP Support Tools. To do so, follow these steps.

Notes

If you already have Support Tools installed, go to the second procedure in this section.
f you do not have Support Tools installed and you do not have the Windows XP Setup CD, go to Method 2.

1. Insert your Windows XP Setup CD, and then locate the Support\Tools folder.

2. Double-click the Setup.exe file.

3. Follow the steps on the screen until you reach the Select An Installation Type screen.

4. On the Select An Installation Type screen, click Complete, and then click Next.

When the installation is complete, follow these steps:

1. Click Start, click Run, type Command, and then click OK.

2. Type netdiag /test:winsock, and then press ENTER.

The Netdiag tool will return the test results for several network components, including the Winsock. For more details about the test, use /v at the end of the netdiag command: netdiag /test:winsock /v

Method 2: Use the Msinfo32 program

Note Use this method only if you do not have a Windows XP Setup CD and you do not have Support Tools installed.

1. Click Start, click Run, type Msinfo32, and then click OK.

2. Expand Components, expand Network, and then click Protocol.

3. You will have ten sections under Protocol. The section headings will include the following names if the Winsock2 key is undamaged:

MSAFD Tcpip [TCP/IP]
MSAFD Tcpip [UDP/IP]
RSVP UDP Service Provider
RSVP TCP Service Provider
MSAFD NetBIOS [\Device\NetBT_Tcpip...
MSAFD NetBIOS [\Device\NetBT_Tcpip...
MSAFD NetBIOS [\Device\NetBT_Tcpip...
MSAFD NetBIOS [\Device\NetBT_Tcpip...
MSAFD NetBIOS [\Device\NetBT_Tcpip...
MSAFD NetBIOS [\Device\NetBT_Tcpip...

If the names are anything different from those in this list, the Winsock2 key is corrupted, or you have a third-party add-on, such as proxy software, installed. If you have a third-party add-on installed, the name of the add-on will replace the letters "MSAFD" in the list.

If there are more than ten sections in the list, you have third-party additions installed.

If there are fewer than ten sections, there is information missing.

Note These entries represent an installation with only the TCP/IP protocol installed. You can have a working Winsock and see additional entries if another protocol is installed. For example, if you install NWLink IPX/SPX, you will see 7 additional sections, for a total of 17. Below is an example heading of one of the new sections:

MSAFD nwlnkipx [IPX]

Also, each of the new sections that are created by installing NWLink IPX/SPX start with "MSAFD." Therefore, there are still only two sections that do not start with those letters.

If the Netdiag test fails, or if you determined that there is Winsock corruption by looking at Msinfo32, you must repair the Winsock2 key by using the steps in the next section.

How to recover from Winsock2 corruption

Windows XP with Service Pack 2 instructions

To repair Winsock if you have Windows XP Service Pack 2 (SP2) installed, type netsh winsock reset at the command prompt, and then press ENTER.

Note Restart the computer after you run this command. Additionally, for computers that are running Windows XP SP2, there is a new netsh command that can rebuild the Winsock key.

netsh winsock reset catalog

This command resets the Winsock catalog to the default configuration. This can be useful if a malformed LSP is installed that results in loss of network connectivity. While use of this command can restore network connectivity, it should be used with care because any previously-installed LSPs will need to be re-installed.

netsh winsock show catalog

This command displays the list of Winsock LSPs that are installed on the computer.

Warning Programs that access or monitor the Internet such as antivirus, firewall. or proxy clients may be negatively affected when you run the netsh winsock reset command. If you have a program that no longer functions correctly after you use this resolution, reinstall the program to restore functionality.

Note If these steps do not resolve the problem, follow the steps in the next section.

Windows XP without Service Pack 2 instructions

To repair Winsockif you do not have Windows XP SP2 installed, delete the corrupted registry keys, and then reinstall the TCP/IP protocol.

Step 1: Delete the corrupted registry keys

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

1. Click Start, and then click Run.

2. In the Open box, type regedit, and then click OK.

3. In Registry Editor, locate the following keys, right-click each key, and then click Delete:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2

4. When you are prompted to confirm the deletion, click Yes.

Note Restart the computer after you delete the Winsock keys. Doing so causes the Windows XP operating system to create new shell entries for those two keys. If you do not restart the computer after you delete the Winsock keys, the next step does not work correctly.

Step 2: Install TCP/IP

1. Right-click the network connection, and then click Properties.

2. Click Install.

3. Click Protocol, and then click Add.

4. Click Have Disk.

5. Type C:\Windows\inf, and then click OK.

6. On the list of available protocols, click Internet Protocol (TCP/IP), and then click OK.

7. Restart the computer.

[ Edited Mon May 08 2006, 10:02PM ]

"Only those who fail greatly can ever achieve greatly" - Robert F. Kennedy
Microsoft Most Valuable Professional - Consumer Security (2007-2008)
Member - Alliance of Security Analysis Professionals - Since 2006
Linux Registered User # 363218


Jump: Back to top