Fix LSP Corruption Caused by an Outdated Third-Party Firewall on Windows 11

Your internet stops working after uninstalling an old firewall like ZoneAlarm or Norton on Windows 11. Web pages fail to load, but other network devices work fine. This happens because the firewall installed a Layered Service Provider, or LSP, that becomes corrupted when the firewall is removed incompletely. The LSP is a DLL that intercepts network traffic, and a broken LSP entry in the Winsock catalog blocks all TCP/IP connections. This article explains how to identify LSP corruption from a third-party firewall and restore network connectivity by resetting Winsock and removing orphaned LSP entries.

Why an Outdated Firewall Corrupts LSP on Windows 11

A Layered Service Provider is a DLL that sits between the Winsock API and the TCP/IP stack. Third-party firewalls install LSPs to inspect and filter network traffic at a low level. When you uninstall the firewall without using its official removal tool, the LSP DLL may remain registered in the Winsock catalog. The catalog is a database of service providers stored in the Windows Registry under HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9.

If the firewall is outdated and does not support Windows 11, its uninstaller may fail to remove the LSP entry. The DLL file itself might be deleted, leaving a broken reference in the catalog. Any application that tries to use Winsock, including web browsers, email clients, and system services, will fail when it attempts to load the missing or damaged LSP. The result is a complete loss of internet connectivity even though the network adapter shows as connected.

Common Firewalls That Cause LSP Corruption

Firewalls known to leave behind corrupted LSP entries on Windows 11 include ZoneAlarm versions older than 2021, Norton Internet Security 2019 or earlier, McAfee Personal Firewall, and Comodo Firewall versions before 2022. These products use kernel-mode LSPs that are tightly integrated with the TCP/IP stack. If you upgraded to Windows 11 without first uninstalling the firewall, the LSP may have been carried over and then broken during the upgrade process.

Steps to Reset Winsock and Remove Orphaned LSP Entries

Follow these steps in order. Do not skip the Winsock reset even if you have tried it before.

1. Open Command Prompt as Administrator
   Press the Windows key, type cmd, right-click Command Prompt, and select Run as administrator. Confirm the User Account Control prompt.
2. Reset the Winsock Catalog
   Type netsh winsock reset and press Enter. Wait for the message “Successfully reset the Winsock Catalog.” This command removes all third-party LSP entries and restores the default catalog.
3. Reset the TCP/IP Stack
   Type netsh int ip reset and press Enter. This resets TCP/IP parameters affected by the corrupted LSP. Reboot your computer when prompted.
4. Verify Connectivity
   After the reboot, open a web browser and try to load a site. If internet works, no further steps are needed. If it still fails, proceed to manually remove orphaned LSP entries.
5. Open Registry Editor
   Press Windows key + R, type regedit, and press Enter. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9.
6. Identify Orphaned LSP Entries
   In the right pane, look for entries under the CatalogEntries subkey. Each entry has a binary value named PackedCatalogItem. Double-click each entry and look for the firewall name or a path to a DLL that no longer exists. Entries from a removed firewall will reference a missing file or an outdated vendor name.
7. Delete Orphaned Entries
   Right-click each orphaned entry and select Delete. Confirm the deletion. Do not delete entries that reference valid system DLLs such as msafd.dll or fwpuclnt.dll.
8. Run Another Winsock Reset
   Close Registry Editor and open Command Prompt as Administrator again. Run netsh winsock reset one more time. Reboot your computer.

Alternative: Use the Winsock Catalog Viewer Tool

If editing the Registry is not comfortable, you can use Microsoft’s wsnmp32.dll viewer. Open Command Prompt as Administrator and type regsvr32 /u wsnmp32.dll to unregister the Windows SNMP service temporarily. Then type net start snmp if the service is stopped. However, the Registry method above is safer and more direct for removing specific LSP entries.

If Windows 11 Still Has Issues After the Main Fix

Network Adapter Shows Limited Connectivity After Winsock Reset

A Winsock reset can sometimes reset the IP address configuration. Open Settings > Network & internet > Advanced network settings > More network adapter options. Right-click your adapter, select Properties, double-click Internet Protocol Version 4, and ensure Obtain an IP address automatically and Obtain DNS server address automatically are selected. If you use a static IP, re-enter the values.

Firewall Service Still Running After Uninstall

Some firewalls leave a background service that re-registers the LSP on reboot. Open Task Manager, go to the Services tab, and look for any service with the firewall vendor name. Right-click it and select Stop. Then open Services.msc, find the service, set its startup type to Disabled, and reboot. Run the Winsock reset again.

DNS Resolution Fails After LSP Fix

A corrupted LSP may have altered DNS settings. Open Command Prompt as Administrator and type ipconfig /flushdns. Then type ipconfig /registerdns. Reboot and test connectivity.

Winsock Reset vs Manual Registry Cleanup: Effectiveness Comparison

Item	Winsock Reset (netsh winsock reset)	Manual Registry Cleanup
Scope	Removes all third-party LSP entries	Removes only specific orphaned entries you identify
Risk of breaking other apps	Low; resets to Windows default	Moderate; deleting wrong entry can break VPN or proxy software
Time required	5 minutes	15-30 minutes including Registry navigation
Effectiveness for stubborn corruption	Fails if LSP entry is not removed by the command	Removes entries that Winsock reset misses

You can now fix LSP corruption caused by an outdated third-party firewall on Windows 11. Start with the Winsock reset command, then manually clean the Registry only if needed. After restoring connectivity, consider using Windows Defender Firewall, which does not install LSPs and avoids this class of problem entirely. As an advanced tip, run netsh winsock show catalog after the fix to verify that only Microsoft entries remain in the catalog.