It appears that Microsoft has disabled raw sockets completely when the new MS05-019 (kb, exploit) patch is applied. This originally only affected XP SP2 but now affects SP1. Windows 2003 is still unaffected. The quote from the SP2 page is:

Restricted traffic over raw sockets

A very small number of Windows applications make use of raw IP sockets, which provide an industry-standard way for applications to create TCP/IP packets with fewer integrity and security checks by the TCP/IP stack. The Windows implementation of TCP/IP still supports receiving traffic on raw IP sockets. However, the ability to send traffic over raw sockets has been restricted in two ways:

• TCP data cannot be sent over raw sockets.
• UDP datagrams with invalid source addresses cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped.

Why is this change important? What threats does it help mitigate?

This change limits the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets, which are TCP/IP packets with a forged source IP address.

Thsi doesn't make sense to me or others (Fydor of nmap fame). First, I don't think disabling a useful feature to prevent it from being used maliciously is a good way to do things. Second, if the Windows TCP/IP stack wasn't broken this wouldn't be a particularly big problem. Finally, almost every other OS allows the use of raw sockets, which means that the 'malicious behaviour' they discuss can still be pursued. Then in a bizzarre twist, Microsoft allows W2K3 to still use raw sockets? I think they are hoping to reduce the amount of malicious traffic coming from unpatched home machines. If this is the case it would be nice if they could provide an optional 'allow raw sockets' patch.