Please, help! BSOD because of tcpip.sys

A

atagaew

New Member
Hi guys!

I have really frustrating situation going with my computer.
Almost every day my computer is going down with BSOD that saying that something is wrong with my Tcpip.sys.

Googled for solutions for days, scanned for viruses with different programs, installed firewall, but nothing, nothing came out.

Please, help!

Below is detailed decoded error dump :
------------------------------------------------------------------------

Code: 
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
 
Loading Dump File [C:\Work\Temp\BSOD\log1\Mini042310-02.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
 
Symbol search path is: SRV*c:\websymbols*[URL="http://msdl.microsoft.com/download/symbols"]Symbol information[/URL]
Executable search path is: 
Windows Server 2008/Windows Vista Kernel Version 6002 (Service Pack 2) MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 6002.18209.amd64fre.vistasp2_gdr.100218-0019
Machine Name:
Kernel base = 0xfffff800`02c4b000 PsLoadedModuleList = 0xfffff800`02e0fdd0
Debug session time: Fri Apr 23 19:49:21.353 2010 (UTC + 3:00)
System Uptime: 0 days 1:29:35.213
Loading Kernel Symbols
...............................................................
................................................................
.................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
 
Use !analyze -v to get detailed debugging information.
 
BugCheck D1, {40, 2, 0, fffffa600117650b}
 
Unable to load image \SystemRoot\System32\drivers\tcpip.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for tcpip.sys
*** ERROR: Module load completed but symbols could not be loaded for tcpip.sys
Probably caused by : tcpip.sys ( tcpip+11550b )
 
Followup: MachineOwner
---------
 
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
 
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000040, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffffa600117650b, address which referenced memory
 
Debugging Details:
------------------
 
 
USER_LCID_STR: ENU
 
OS_SKU: 3
 
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002e72080
0000000000000040 
 
CURRENT_IRQL: 2
 
FAULTING_IP: 
tcpip+11550b
fffffa60`0117650b ?? ???
 
CUSTOMER_CRASH_COUNT: 2
 
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
 
BUGCHECK_STR: 0xD1
 
PROCESS_NAME: csrss.exe
 
TRAP_FRAME: fffffa6001922c80 -- (.trap 0xfffffa6001922c80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800d1f55e0
rdx=fffffa80051a4000 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa600117650b rsp=fffffa6001922e10 rbp=fffffa800d1f55e0
r8=fffffa800d1f58a8 r9=0000000000000001 r10=000000000000003f
r11=00000000000833c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
tcpip+0x11550b:
fffffa60`0117650b ?? ???
Resetting default scope
 
LAST_CONTROL_TRANSFER: from fffff80002ca526e to fffff80002ca54d0
 
STACK_TEXT: 
fffffa60`01922b38 fffff800`02ca526e : 00000000`0000000a 00000000`00000040 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffa60`01922b40 fffff800`02ca414b : 00000000`00000000 00000000`00000000 0b81007a`80101080 fffffa80`0d1f55e0 : nt!KiBugCheckDispatch+0x6e
fffffa60`01922c80 fffffa60`0117650b : 00000000`00000002 00000000`00000001 fffffa80`06cb9c10 fffffa80`0b038bb0 : nt!KiPageFault+0x20b
fffffa60`01922e10 00000000`00000002 : 00000000`00000001 fffffa80`06cb9c10 fffffa80`0b038bb0 00000000`00000002 : tcpip+0x11550b
fffffa60`01922e18 00000000`00000001 : fffffa80`06cb9c10 fffffa80`0b038bb0 00000000`00000002 fffff800`02d5fd02 : 0x2
fffffa60`01922e20 fffffa80`06cb9c10 : fffffa80`0b038bb0 00000000`00000002 fffff800`02d5fd02 fffffa80`03f60000 : 0x1
fffffa60`01922e28 fffffa80`0b038bb0 : 00000000`00000002 fffff800`02d5fd02 fffffa80`03f60000 00000000`00000020 : 0xfffffa80`06cb9c10
fffffa60`01922e30 00000000`00000002 : fffff800`02d5fd02 fffffa80`03f60000 00000000`00000020 fffffa60`01922e78 : 0xfffffa80`0b038bb0
fffffa60`01922e38 fffff800`02d5fd02 : fffffa80`03f60000 00000000`00000020 fffffa60`01922e78 fffff800`02c13750 : 0x2
fffffa60`01922e40 00000000`00000070 : 00000000`00000002 00000000`00000000 00000002`00000001 fffffa80`051975e8 : nt!EtwpLogKernelEvent+0x202
fffffa60`01922ee0 00000000`00000002 : 00000000`00000000 00000002`00000001 fffffa80`051975e8 fffffa60`01922f70 : 0x70
fffffa60`01922ee8 00000000`00000000 : 00000002`00000001 fffffa80`051975e8 fffffa60`01922f70 00000000`00000200 : 0x2
 
 
STACK_COMMAND: kb
 
FOLLOWUP_IP: 
tcpip+11550b
fffffa60`0117650b ?? ???
 
SYMBOL_STACK_INDEX: 3
 
SYMBOL_NAME: tcpip+11550b
 
FOLLOWUP_NAME: MachineOwner
 
MODULE_NAME: tcpip
 
IMAGE_NAME: tcpip.sys
 
DEBUG_FLR_IMAGE_TIMESTAMP: 4b7d2c05
 
FAILURE_BUCKET_ID: X64_0xD1_tcpip+11550b
 
BUCKET_ID: X64_0xD1_tcpip+11550b
 
Followup: MachineOwner
---------
 
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
 
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000040, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffffa600117650b, address which referenced memory
 
Debugging Details:
------------------
 
 
USER_LCID_STR: ENU
 
OS_SKU: 3
 
READ_ADDRESS: 0000000000000040 
 
CURRENT_IRQL: 2
 
FAULTING_IP: 
tcpip+11550b
fffffa60`0117650b ?? ???
 
CUSTOMER_CRASH_COUNT: 2
 
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
 
BUGCHECK_STR: 0xD1
 
PROCESS_NAME: csrss.exe
 
TRAP_FRAME: fffffa6001922c80 -- (.trap 0xfffffa6001922c80)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800d1f55e0
rdx=fffffa80051a4000 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa600117650b rsp=fffffa6001922e10 rbp=fffffa800d1f55e0
r8=fffffa800d1f58a8 r9=0000000000000001 r10=000000000000003f
r11=00000000000833c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
tcpip+0x11550b:
fffffa60`0117650b ?? ???
Resetting default scope
 
LAST_CONTROL_TRANSFER: from fffff80002ca526e to fffff80002ca54d0
 
STACK_TEXT: 
fffffa60`01922b38 fffff800`02ca526e : 00000000`0000000a 00000000`00000040 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffffa60`01922b40 fffff800`02ca414b : 00000000`00000000 00000000`00000000 0b81007a`80101080 fffffa80`0d1f55e0 : nt!KiBugCheckDispatch+0x6e
fffffa60`01922c80 fffffa60`0117650b : 00000000`00000002 00000000`00000001 fffffa80`06cb9c10 fffffa80`0b038bb0 : nt!KiPageFault+0x20b
fffffa60`01922e10 00000000`00000002 : 00000000`00000001 fffffa80`06cb9c10 fffffa80`0b038bb0 00000000`00000002 : tcpip+0x11550b
fffffa60`01922e18 00000000`00000001 : fffffa80`06cb9c10 fffffa80`0b038bb0 00000000`00000002 fffff800`02d5fd02 : 0x2
fffffa60`01922e20 fffffa80`06cb9c10 : fffffa80`0b038bb0 00000000`00000002 fffff800`02d5fd02 fffffa80`03f60000 : 0x1
fffffa60`01922e28 fffffa80`0b038bb0 : 00000000`00000002 fffff800`02d5fd02 fffffa80`03f60000 00000000`00000020 : 0xfffffa80`06cb9c10
fffffa60`01922e30 00000000`00000002 : fffff800`02d5fd02 fffffa80`03f60000 00000000`00000020 fffffa60`01922e78 : 0xfffffa80`0b038bb0
fffffa60`01922e38 fffff800`02d5fd02 : fffffa80`03f60000 00000000`00000020 fffffa60`01922e78 fffff800`02c13750 : 0x2
fffffa60`01922e40 00000000`00000070 : 00000000`00000002 00000000`00000000 00000002`00000001 fffffa80`051975e8 : nt!EtwpLogKernelEvent+0x202
fffffa60`01922ee0 00000000`00000002 : 00000000`00000000 00000002`00000001 fffffa80`051975e8 fffffa60`01922f70 : 0x70
fffffa60`01922ee8 00000000`00000000 : 00000002`00000001 fffffa80`051975e8 fffffa60`01922f70 00000000`00000200 : 0x2
 
 
STACK_COMMAND: kb
 
FOLLOWUP_IP: 
tcpip+11550b
fffffa60`0117650b ?? ???
 
SYMBOL_STACK_INDEX: 3
 
SYMBOL_NAME: tcpip+11550b
 
FOLLOWUP_NAME: MachineOwner
 
MODULE_NAME: tcpip
 
IMAGE_NAME: tcpip.sys
 
DEBUG_FLR_IMAGE_TIMESTAMP: 4b7d2c05
 
FAILURE_BUCKET_ID: X64_0xD1_tcpip+11550b
 
BUCKET_ID: X64_0xD1_tcpip+11550b
 
Followup: MachineOwner
---------
 
1: kd> lmvm tcpip
start end module name
fffffa60`01061000 fffffa60`011d7000 tcpip T (no symbols) 
Loaded symbol image file: tcpip.sys
Image path: \SystemRoot\System32\drivers\tcpip.sys
Image name: tcpip.sys
Timestamp: Thu Feb 18 14:01:09 2010 (4B7D2C05)
CheckSum: 0015E59F
ImageSize: 00176000
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
1: kd> .trap 0xfffffa6001922c80
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800d1f55e0
rdx=fffffa80051a4000 rsi=0000000000000000 rdi=0000000000000000
rip=fffffa600117650b rsp=fffffa6001922e10 rbp=fffffa800d1f55e0
r8=fffffa800d1f58a8 r9=0000000000000001 r10=000000000000003f
r11=00000000000833c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
tcpip+0x11550b:
fffffa60`0117650b ?? ???
 

My Computer

System One

First off, detail how frequently this happens. What connectivity software are you running? Does your computer come with preinstalled Internet connectivity software that generally runs in the background like AOL or HP Connect or Intel ProSet? Also give us the brand and model of the problem computer.

Next, go to "Device Manager," found in the Control Panel, and select "Network Adapters." You'll see a list of the hardware your computer can choose from to open Internet communications. Double-click on each one and see if "This device is working properly."

If all them are "working properly" then write down the names and models of all the devices in the list. Google up each one's manufacturer page and search for the latest drivers for each device. Download but do not install them. Shut down the computer.

Now reboot into Safe Mode. Install the drivers. Shut down and reboot into regular mode and see if this corrects the problem.

Also, read this thread. This solved that guy's problem, though his wasn't a BSOD, which to me hints toward a system file or driver software corruption of some kind.
 
Last edited:

My Computer

System One

  • Manufacturer/Model
    Hewlett-Packard dv6936us
    CPU
    Intel Core 2 Duo "Merom" T5750, 2 GHz, stock clocking
    Motherboard
    stock Quanta 30D2, v.792E
    Memory
    4 GHz, 667 MHz bus speed
    Graphics Card(s)
    NVIDIA GeForce 8400M GS, stock
    Sound Card
    stock Realtek software-based
    Monitor(s) Displays
    stock 15.4" widescreen
    Screen Resolution
    stock 1280 X 800
    Hard Drives
    stock Toshiba MK2546GSX and a Western Digital 1TB MyBook
    PSU
    stock
    Case
    stock
    Cooling
    stock plus Rocketfish model RF-LAPCOL
    Keyboard
    stock
    Mouse
    stock Synaptics Pointing Device
    Internet Speed
    Ludicrous Speed (~10.9 Mbps, more or less)
    Other Info
    Browser: Namoroka v1.9.2.3666 64-bit build. Computer specs:
    http://h10025.www1.hp.com/ewfrf/wc/document?docname=c01485288&tmp_task=prodinfoCategory&lc=en&dlc=en&cc=us&product=3747246
    I like chocolate milk!
Hello,

Can you please upload the actual minidump as we can often get more out of them than just that basic analysis. Also, press the Windows Key + R to open the Run dialogue. Type "cmd" and press enter. In Command Prompt, type "sfc /scannow" without the quotes and press enter. This scan will take about 15 minutes. If integrity violations are found, parse and upload the logs. See here for full details: http://www.vistax64.com/tutorials/66978-system-files-sfc-command.html

Good luck,

Richard
 

My Computer

System One

  • Manufacturer/Model
    Dell XPS 420
    CPU
    Intel Core 2 Quad Q9300 2.50GHz
    Motherboard
    Stock Dell 0TP406
    Memory
    4 gb (DDR2 800) 400MHz
    Graphics Card(s)
    ATI Radeon HD 3870 (512 MBytes)
    Sound Card
    Onboard
    Monitor(s) Displays
    1 x Dell 2007FP and 1 x (old) Sonic flat screen
    Screen Resolution
    1600 x 1200 and 1280 x 1204
    Hard Drives
    1 x 640Gb (SATA 300)
    Western Digital: WDC WD6400AAKS-75A7B0

    1 x 1Tb (SATA 600)
    Western Digital: Caviar Black, SATA 6GB/S, 64Mb cache, 8ms
    Western Digital: WDC WD1002FAEX-00Z3A0 ATA Device
    PSU
    Stock PSU - 375W
    Case
    Dell XPS 420
    Cooling
    Stock Fan
    Keyboard
    Dell Bluetooth
    Mouse
    Advent Optical ADE-WG01 (colour change light up)
    Internet Speed
    120 kb/s
    Other Info
    ASUS USB 3.0 5Gbps/SATA 6Gbps - PCI-Express Combo Controller Card (U3S6)
Thank you for your help, Guys.

I found the solution.

It seems it was my firewall application.

I've been using Outpost Firewall Pro for year without any problems, but now it seems that this program is the reason of BSOD

Last weekend, I turned it off and switched back to the windows default one.

During the week there was not any problems at all
 

My Computer

System One

Really glad you have solved the problem!
 

My Computer

System One

  • Manufacturer/Model
    Dell XPS 420
    CPU
    Intel Core 2 Quad Q9300 2.50GHz
    Motherboard
    Stock Dell 0TP406
    Memory
    4 gb (DDR2 800) 400MHz
    Graphics Card(s)
    ATI Radeon HD 3870 (512 MBytes)
    Sound Card
    Onboard
    Monitor(s) Displays
    1 x Dell 2007FP and 1 x (old) Sonic flat screen
    Screen Resolution
    1600 x 1200 and 1280 x 1204
    Hard Drives
    1 x 640Gb (SATA 300)
    Western Digital: WDC WD6400AAKS-75A7B0

    1 x 1Tb (SATA 600)
    Western Digital: Caviar Black, SATA 6GB/S, 64Mb cache, 8ms
    Western Digital: WDC WD1002FAEX-00Z3A0 ATA Device
    PSU
    Stock PSU - 375W
    Case
    Dell XPS 420
    Cooling
    Stock Fan
    Keyboard
    Dell Bluetooth
    Mouse
    Advent Optical ADE-WG01 (colour change light up)
    Internet Speed
    120 kb/s
    Other Info
    ASUS USB 3.0 5Gbps/SATA 6Gbps - PCI-Express Combo Controller Card (U3S6)
You must log in or register to reply here.
Back
Top