Sysinternals Homepage
Forum Home Forum Home > Sysinternals Utilities > Autoruns
  New Posts New Posts RSS Feed - Autoruns Bug when deleting Winsock entries
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Autoruns Bug when deleting Winsock entries

 Post Reply Post Reply Page  12>
Author
Message
cnschindler View Drop Down
Newbie
Newbie


Joined: 24 February 2010
Location: Vienna
Status: Offline
Points: 5
Post Options Post Options   Thanks (1) Thanks(1)   Quote cnschindler Quote  Post ReplyReply Direct Link To This Post Topic: Autoruns Bug when deleting Winsock entries
    Posted: 24 February 2010 at 3:23pm
Today I came across a bug in the latest Version of Autoruns.
 
I used Autoruns to delete the Winsock entry of the Apple "Bonjour" Service(uninstall left it over). After that my system was nearly unusable. Meaning that normal user accounts couldn't logon anymore(System Event Notification Service Timeout). Services were not starting, no Internet Access. etc.
 
I tried resetting Winsock with "netsh winsock reset" but got an error "impossible to start initialization function InitHelperDll into NSHHTTP.DLL error code 11003".
 
Finally I found the reason for all the issues: When Autoruns deletes the Winsock entry in the Registry, it doesn't update a value in the Registry, which tells the System how many providers are installed. So there was a discrepancy between the providers installed and this registry value. When I corrcted this value, everything started working again.
 
The registry value I'm talking about is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Num_Catalog_Entries64 (I'm working on x64)

All the providers are stored in this registry location as Sub-Keys(again for x64 system):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64
 
So the number of providers(=Subkeys) in the latter location has to match the (decimal)value of
Num_Catalog_Entries64.
 
Hopefully this get's fixed in a future release as this cost me hours...
Back to Top
Moses Yoon View Drop Down
Newbie
Newbie


Joined: 06 May 2010
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote Moses Yoon Quote  Post ReplyReply Direct Link To This Post Posted: 06 May 2010 at 5:19pm

Wow~ Thanks! You save my time.

Back to Top
Edward View Drop Down
Newbie
Newbie


Joined: 10 June 2008
Location: Canada
Status: Offline
Points: 18
Post Options Post Options   Thanks (0) Thanks(0)   Quote Edward Quote  Post ReplyReply Direct Link To This Post Posted: 08 May 2010 at 9:29pm
Could the Mods please check this out?  It looks like a serious bug.  Judging by the lack of replies, this seems to be the first report of this problem.

Is Molotov available to check this?  He is quite good at sorting these issues out.


Edited by Edward - 13 May 2010 at 6:22pm
Back to Top
Paly View Drop Down
Newbie
Newbie


Joined: 09 May 2010
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote Paly Quote  Post ReplyReply Direct Link To This Post Posted: 09 May 2010 at 11:39pm
Wow--thanks!
 
New member here.  I was just about to also remove Bonjour from Winsock, but happily I decided to read some posts before getting started.  Sure glad I stumbled across this thread!!
Back to Top
Moses Yoon View Drop Down
Newbie
Newbie


Joined: 06 May 2010
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote Moses Yoon Quote  Post ReplyReply Direct Link To This Post Posted: 10 May 2010 at 2:01am
In my case, I'm using Windows 7 64bit and Autoruns v9.57(latest one).
Back to Top
comste View Drop Down
Newbie
Newbie


Joined: 24 June 2015
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote comste Quote  Post ReplyReply Direct Link To This Post Posted: 24 June 2015 at 10:42pm
This bug is still present in the current version. You still have to fix Num_Catalog_Entries64 manually after disabling entries in "Winsock Providers". Otherwise Winsock and many Windows Services won't run anymore.
Back to Top
IronEagle View Drop Down
Newbie
Newbie
Avatar

Joined: 27 March 2016
Location: Texas
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote IronEagle Quote  Post ReplyReply Direct Link To This Post Posted: 27 March 2016 at 10:28am
YOU WERE SPOT ON WITH THE COUNT. I changed the numeric's and its never worked better, thanks
Mike
Back to Top
jabiilord View Drop Down
Newbie
Newbie


Joined: 07 January 2016
Status: Offline
Points: 3
Post Options Post Options   Thanks (0) Thanks(0)   Quote jabiilord Quote  Post ReplyReply Direct Link To This Post Posted: 06 April 2016 at 6:47pm
On one windows 7 64bit i got the same issue. 
Back to Top
Kalterherberger View Drop Down
Newbie
Newbie


Joined: 19 May 2016
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote Kalterherberger Quote  Post ReplyReply Direct Link To This Post Posted: 19 May 2016 at 10:36am
More than six years ago ... same problem on Windows 10/64 after deleting the "File not found" entries from DnsBlockA|B.

AdwCleaner found and deleted DnsBlockA|B a few month ago but did not delete these four Registry-Entries. 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5]
"Num_Catalog_Entries"=dword:00000009
"Num_Catalog_Entries64"=dword:00000009

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005]
"LibraryPath"="C:\\WINDOWS\\system32\\DnsBlockA.dll"
"DisplayString"="DnsBlockANSP"
"ProviderId"=hex:80,cf,a7,ec,69,26,79,44,a3,74,27,97,45,a3,10,95
"SupportedNameSpace"=dword:0000000c
"Enabled"=dword:00000001
"Version"=dword:00000001
"StoresServiceClassInfo"=dword:00000000
"ProviderInfo"=hex:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000009]
"LibraryPath"="C:\\WINDOWS\\system32\\DnsBlockB.dll"
"DisplayString"="DnsBlockBNSP"
"ProviderId"=hex:c7,c6,72,b0,95,14,ee,43,90,b5,c9,80,16,82,02,f9
"SupportedNameSpace"=dword:0000000c
"Enabled"=dword:00000001
"Version"=dword:00000001
"StoresServiceClassInfo"=dword:00000000
"ProviderInfo"=hex:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000005]
"LibraryPath"="C:\\WINDOWS\\system32\\DnsBlockA.dll"
"DisplayString"="DnsBlockANSP"
"ProviderId"=hex:80,cf,a7,ec,69,26,79,44,a3,74,27,97,45,a3,10,95
"SupportedNameSpace"=dword:0000000c
"Enabled"=dword:00000001
"Version"=dword:00000001
"StoresServiceClassInfo"=dword:00000000
"ProviderInfo"=hex:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries64\000000000009]
"LibraryPath"="C:\\WINDOWS\\system32\\DnsBlockB.dll"
"DisplayString"="DnsBlockBNSP"
"ProviderId"=hex:c7,c6,72,b0,95,14,ee,43,90,b5,c9,80,16,82,02,f9
"SupportedNameSpace"=dword:0000000c
"Enabled"=dword:00000001
"Version"=dword:00000001
"StoresServiceClassInfo"=dword:00000000
"ProviderInfo"=hex:

So I deleted these entries with autoruns a few times, wondering what happened with the network after this and thought, that AdwCleaner was the reason of my problems. And each time only a systemrecovery get the network working again.

Today I understand the problem and with the search word "num_catalog_entries" I found this thread.

More than 6 years to not fix a bug! Good job.
Back to Top
ken1943 View Drop Down
Newbie
Newbie


Joined: 26 May 2016
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote ken1943 Quote  Post ReplyReply Direct Link To This Post Posted: 26 May 2016 at 8:37pm
And this is why there are areas in Windows that people should keep their fingers out of.
Ken
Back to Top
 Post Reply Post Reply Page  12>
  Share Topic   

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 11.06
Copyright ©2001-2016 Web Wiz Ltd.