Help!! Sudden network failure: Possible winsock error?

[Arschloch]

Hello all.

Here are my pertinent system specs:
Win98SE
Duron 700 MHz
192 Megs RAM
3com 10mbit network card

I am at a university that uses Ethernet for its internet connection method for us students.

This problem seemingly came out of nowhere. I rebooted my computer this evening, and when I got into Windows, my Email notifying program gave me some kind of "socket error" and crashed. Then I tried opening up INternet Explorer, which crashed immediately. Then I tried opening telnet, which crashed as soon as I tried to connect to anything.

When I opened Audiogalaxy Satellite, it says something to the effect that it "Cannot open any more sockets! Run the WInsock 2 update if you are running windows 95." Of course, I'm in 98SE, so this should not be an issue.

My newsreader, XNews, says that it is unable to open a new socket. Serv-U FTP says that it is unable to open a listening socket.

That is pretty much the rundown of my internet utilities. I figured that this might be a winsock error. I did a search for "wsock32.dll" on my hard drive, and it only found one, a 40kb file, in the windows/system directory, which I believe is correct.

I did not delete or run any programs right before that last reboot -- as I said, it was completely sudden.

Given that it's giving me all of these socket errors or the applications are just crashing immediately, what do you think the problem is? Any suggestions? Has anyone seen anything similar? I'm desperate for help here.

Thanks.
-Arschloch

 

[BlueTDimly]

Try reinstalling 98? Have you checked your network settings to make sure they're still OK? Have you run a virus scanner? If you do a logged boot (F8) do you notice anything failing?

BlueT.

 

[FirmPete]

Yup, check for viruses. There are a lot of them who infect wsock32.dll

if it's not a virus, you can use system file checker (Start-run-sfc) to reinstall the mentioned dll

 

[Arschloch]

I did the following things:

My network settings still appear to be fine. As I said, I did not change any of the network settings, but I checked to make sure they hadn't changed themselves, and they still appear to be fine.

I ran Norton AntiVirus (although an older version, as I cannot get virus updates without access to the internet), and it found no virii on the system.

I ran a logged boot, and all of the network setup stuff loaded without a problem. The only devices that failed were ndis2sup.vxd and SDVXD. However, my roommate's computer has the same two devices failing on his, and his network still works just fine.

I used the system file checker, and it did not find any system files corrupted.

Obviously, I would like to avoid reinstalling Win98 at pretty much all costs...

Does anyone have any more ideas? Please?

This has to be fixed today (Thursday)... I'm desperate.

 

[Arschloch]

I forgot to mention this:

The "PING" command at the MS-DOS prompt works just fine. I get responses and everything. No crashes or anything of that sort. I understand that PING uses 16-bit winsock, whereas all of the programs I mentioned in my first post use 32-bit winsock. This also leads me to believe that it is a problem with the 32-bit winsock, but I am still not sure...

Any more ideas?

 

[Ladi]

Give me 10 minutes here...

[edit #1]If this is the same issue that has hit my resnet lately (I'm tier 2 support here), then reinstalling drivers and tcp/ip will NOT work. So far, the only solution we've found is to reinstall windows from a freshly formatted drive. However, I *may* have a better solution in a few minutes[/edit]

[edit #2]This has NOT been tested and is NOT guaranteed to not kill your machine:
-Back up your registry.
-Delete ALL entries under Network Properties (ethernet adapter, protocols, etc)
-Delete the following keys from your registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\MSTCP
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\MSTCP\ServiceProvider
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VXD\AFVXD
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VXD\DHCP
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VXD\Winsock
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VXD\Winsock2
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\RemoteAccess\Authentication\SMM_Files
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\netTrans\000n
-If Win.com exists outside of your windows directory, delete it.
-Reboot
-Allow redetection and reinstallation of network card and protocol(s)
-Reboot
-If issues continue, boot into DOS with cdrom
-----Navigate to windows\system32
-----Use the following commands:
ren vip.386 vip.old
ren vtcp.386 vtcp.old
ren vtdi.386 vtdi.old
ren vudp.386 vudp.old
ren vdhcp.386 vdhcp.old
ren vnbt.386 vnbt.old
-----Reboot into Windows
-----Extract the files from your Windows cab files (from a DOS prompt) using the following format:
extract /a a:\win95_02.cab unidrv.dll /l c:\windows\system where "a:\win98_02.cab" is replaced by the first cab file listed and where "unidrv.dll" is replaced by every file renamed above
-----Reboot once more
[/edit]


~Ladi

 

[FirmPete]

ndis2sup.vxd smells like a corrupted driver for your nic. You can try to reinstall it.

(Just a thought)

Also, you can re-install windows without losing all your settings. Just run setup and let windows install in your old windows directory. You won't lose any settings that way.

 

[Arschloch]

Ladi,

Thanks for the suggestion. I'm deciding now whether or not I want to take the chance.

However, you said to delete win.com if it exists. If win.com isn't there anymore, then how will Win98SE be able to start again?

 

[Arschloch]

Ladi,

Also, you said that this problem has hit your resnet lately? Is that to say that this problem has JUST started where you are? If so, is it possible that there is some sort of problem with the University's network system?

 

[Ladi]

win.com is not a necessary system file (info here)

I've added a few more things...let me know how it goes

[edit]I know that it is recent, but I don't have dates. It's not my network, though [/edit]

[edit #2]Do you have BearShare installed?[/edit]

~Ladi

 

[Arschloch]

Ladi,

First, YES, I do have Bearshare installed. The error message it says is, "Couldn't listen on port 6346 because WSASYSNOTREADY.

Secondly, I tried the second of your suggestions (renaming all those v___.386 files to v____.old, then extracting back from the CD to the HD). This did not work -- the problem still persists. Again, I am still deciding whether or not I want to hack the registry in the way you described, because I'm afraid of not being able to get back into windows and save my important files...

Any more suggestions? Does the Bearshare thing help?

 

[Ladi]

BearShare may be the cause of the problem.

By backing up your registry, IF the regedit fails and you are unable to boot to windows, you can boot to DOS and restore your old registry using "scanreg /restore"

~Ladi

 

[Arschloch]

Ladi,

Okay, thank you for the suggestions. I will now do the following things:

1) Uninstall Bearshare completely and reboot. If the problem still persists, then...

2) Hack the registry in the manner you described. When I am done, I will come back and post the results...

-Arschloch

 

[Arschloch]

Ladi,

You are amazing. I did the first method you suggested -> removing all of my network stuff in the control panel, and deleting all of those registry keys -- and when I rebooted, it re-detected my NIC, etc.... and following another reboot, everything worked just fine again! Thanks a bunch -- looks like you have found the solution to the problem! Although I am still wondering about the cause...?

----


Anyway, I now have another question... perhaps it would be better if I posted it to another thread, but I thought I'd give it a whirl here since I already have a thread going here.

My "Folder Options" seemingly has disappeared from my "View" pull-down menu. I would like to access this, because my folders insist on being "viewed as a web page", and I want to set it so that ALL of them are not viewed as a web page. Does anyone know of a registry key, or something like that, that would re-enable Folder Options?

--Arschloch

 

[lamplighter]

Oh man... I think you are right Ladi, it is Bearshare. I checked out the forums there and there are a few threads on this topic (such as this one). The latest version of Bearshare must be overloaded with so much spyware it destroyed Winsock haha. I am going to try removing all the network stuff, it should be the same process in Win2k right?

 

[Arschloch]

Well, I removed Bearshare and it didn't help...

However, it's possible that installing Bearshare installed some registry keys that weren't removed when I uninstalled, so maybe that has something to do with it.

 

[lamplighter]

Right, it also seems from reading in the Bearshare forum it has something to do with the combination of Bearshare and a firewall. Are you using one? I am using BlackIce. And it sounds like the only way to fix it is remove all the network settings as Ladi said.

 

[Arschloch]

Nope... I'm not even using a firewall.

So if it IS Bearshare... well, I'll be very upset.

 

[lamplighter]

I'm gonna email Bearshare and ask them to make some sort of public statement about this (assuming they agree their software caused the mess). I can't imagine how the average computer user will be able to figure this out, and Bearshare has become pretty mainstream.

 

[Arschloch]

That is a very good idea.

My question, though, is this: I've had Bearshare on my computer for about a month now. Why in the world did this problem just start tonight? And why is this problem happening for so many people all of a sudden? That is my question.

 

[lamplighter]

I don't know Doesn't make much sense does it. Maybe it does have something to do with XX days being up? I can't remember when I got the latest version of Bearshare but seems to be around 2 weeks ago. Hopefully they can answer this.

 

[Ladi]

From what I know of the issue here on campus, it must be a recent release of BearShare, as it hasn't BEEN an issue at all until lately. My guess is that some of the adware that it installs does not make changes to certain system files until after a reboot.

I've checked my 2K machines and many of the same TCP/IP registry keys exist. My guess would be that deleting what registry keys you do have from the list above would have the same effect.

~Ladi