[coomdoom]

Hi,

I've had 2 Blue Screens today both to do with tcpip.sys. I don't have a clue why it's happening but it's only started doing it today. I've read a couple of topics on the forum and have downloaded BlueScreenViewer to get the details, I will also attach the dumps and a screenshot of the blue screen for you. Hope someone can help.

==================================================
Dump File : 030811-52587-01.dmp
Crash Time : 08/03/2011 18:29:19
Bug Check String : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x000000d1
Parameter 1 : fffffa80`09440000
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000000
Parameter 4 : fffff880`01754ae7
Caused By Driver : tcpip.sys
Caused By Address : tcpip.sys+87ae7
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\Minidump\030811-52587-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7601
Dump File Size : 291,440
==================================================

==================================================
Dump File : 030811-51371-01.dmp
Crash Time : 08/03/2011 14:33:12
Bug Check String : DRIVER_IRQL_NOT_LESS_OR_EQUAL
Bug Check Code : 0x000000d1
Parameter 1 : fffffa80`08dc8000
Parameter 2 : 00000000`00000002
Parameter 3 : 00000000`00000000
Parameter 4 : fffff880`0174cae7
Caused By Driver : tcpip.sys
Caused By Address : tcpip.sys+87ae7
File Description :
Product Name :
Company :
File Version :
Processor : x64
Computer Name :
Full Path : C:\Windows\Minidump\030811-51371-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 7601
Dump File Size : 291,440
==================================================

Attached Thumbnails

• 

Attached Files

•  Minidump.zip   54.22KB   101 downloads

[Advertisements]

The DRIVER_IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x000000D1. This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.


Important Information If You Have Received a STOP Code
If you have received a blue screen error, or stop code, the computer has shut down abruptly to protect itself from data loss. A hardware device, its driver, or related software might have caused this error. .

• Download and install updates and device drivers for your computer from Windows Update.
• Scan your computer for computer viruses.
• Check your hard disk for errors.

GOING ON FROM HERE
1. Check Device Manager, including on the view tab, show hidden devices - are there any error warnings pls.
If so and particularly if it is on the network adaptor, please, check for any driver updates. If none are offered, uninstall the device and reboot.

2. It could be a memory fault, but you would most likely have other symptoms. - we can look there later.

Post back with results pls.
We will I think next move to reset TCP/IP stack

[Macboatmaster]

The DRIVER_IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x000000D1. This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.


Important Information If You Have Received a STOP Code
If you have received a blue screen error, or stop code, the computer has shut down abruptly to protect itself from data loss. A hardware device, its driver, or related software might have caused this error. .

• Download and install updates and device drivers for your computer from Windows Update.
• Scan your computer for computer viruses.
• Check your hard disk for errors.

GOING ON FROM HERE
1. Check Device Manager, including on the view tab, show hidden devices - are there any error warnings pls.
If so and particularly if it is on the network adaptor, please, check for any driver updates. If none are offered, uninstall the device and reboot.

2. It could be a memory fault, but you would most likely have other symptoms. - we can look there later.

Post back with results pls.
We will I think next move to reset TCP/IP stack

[coomdoom]

The only one I have an error on is LogMeIn Kernel Information Provider. Does that help at all?

[Macboatmaster]

You have I presume at one time had this on your computer
Remote Access to Your PC or Mac
LogMeIn Free gives you remote control of your PC or Mac from any other computer with an Internet connection.




Go into your Device Manager - click on View at the top Device Manager - click show hidden devices - find and highlight LogMeIn Kernel Information Provider (one left click) - click on Action at the top of Device Manager - click on uninstall - windows will ask you to reboot - reboot.

LogMeIn Kernel Information Provider should be gone!

Edited by Macboatmaster, 08 March 2011 - 02:20 PM.

[coomdoom]

Yes, I use LogMeIn to remote into my parents laptop when they need help and also with my server I have at home, I had to remove it from this PC though because my uni halls network doesn't allow running servers.

[Macboatmaster]

Download this please.
http://www.resplendence.com/whocrashed
Run the program and click the analyse button.

Please copy and paste the opened results to your reply

[coomdoom]

Here you go. Hopefully can give more details to you.

System Information (local)
--------------------------------------------------------------------------------

computer name: JOSH-PC-WIN7
windows version: Windows 7 Service Pack 1, 6.1, build: 7601
windows dir: C:\Windows
CPU: AuthenticAMD AMD Athlon(tm) 64 X2 Dual Core Processor 6000+ AMD586, level: 15
2 logical processors, active mask: 3
RAM: 4294107136 total
VM: 2147352576, free: 1977327616



--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.


On Tue 3/8/2011 6:25:36 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\030811-52587-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640) 
Bugcheck code: 0xD1 (0xFFFFFA8009440000, 0x2, 0x0, 0xFFFFF88001754AE7)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time. 


On Tue 3/8/2011 6:25:36 PM GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: tcpip.sys (tcpip+0x87AE7) 
Bugcheck code: 0xD1 (0xFFFFFA8009440000, 0x2, 0x0, 0xFFFFF88001754AE7)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\drivers\tcpip.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: TCP/IP Driver
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system which cannot be identified at this time. 


On Tue 3/8/2011 2:27:04 PM GMT your computer crashed
crash dump file: C:\Windows\Minidump\030811-51371-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x80640) 
Bugcheck code: 0xD1 (0xFFFFFA8008DC8000, 0x2, 0x0, 0xFFFFF8800174CAE7)
Error: DRIVER_IRQL_NOT_LESS_OR_EQUAL
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This indicates that a kernel-mode driver attempted to access pageable memory at a process IRQL that was too high.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem. 
The crash took place in the Windows kernel. Possibly this problem is caused by another driver which cannot be identified at this time. 

[Macboatmaster]

I do not really expect Who Crashed to help a lot.
I expect the report to say that the error may have been caused by a fault in a kernel driver that cannot be identified at this stage. OR words to that effect.
HOWEVER it was worth running just in case.

If I am right to save you waiting

1. Uninstall the driver for the network adaptor. -Device manager, open device. Driver tab, uninstall
Reboot and Windows will reinstall the driver.

2. If that does not work check please for any driver updates that have been installed on automatic updates if you have those configured.
Also check pls if any new software has been installed.

[coomdoom]

Well I've already checked for driver updates. Also I had a Netgear WPN111 USB stick installed which I've uninstalled in case that was the cause too. I can't do it with my motherboard's onboard network card yet because I'm currently downloading a file I need to get for my uni work. Once that is done, I will try the other one, then it's just a matter of waiting as it was quite a few hours between blue screens (and it only started today).

[Macboatmaster]

Further to my last AND if there are no identifable updates or new software, please run chdsk /r. That is a five stage check pls do not interrupt it.
Right click the hard drive with windows. - C. click properties, tools, error checking, check now, click to check both boxes - file errors
and attempt repair of bad sectors, click start and agree to run on restart.

After that is complete pls run system file checker.
Use the System File Checker tool (SFC.exe) to determine which file is causing the issue, and then replace the file. To do this, follow these steps:

• Open an elevated command prompt. To do this, click Start, click All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator. If you are prompted for an administrator password or for a confirmation, type the password, or click Allow.
• Type the following command, and then press ENTER: sfc /scannow. The sfc /scannow command scans all protected system files and replaces incorrect versions with correct Microsoft versions.

Edited by Macboatmaster, 08 March 2011 - 03:09 PM.

[coomdoom]

Before I perform a disk check, why would that have any effect on/or hint to a problem to do with networking? I would have thought the tcpip.sys would be to do with the TCP/IP Protocol service on the network adapter?

Edited by coomdoom, 08 March 2011 - 03:06 PM.

[Macboatmaster]

From Microsoft.

Bug Check 0xA: IRQL_NOT_LESS_OR_EQUAL
The IRQL_NOT_LESS_OR_EQUAL bug check has a value of 0x0000000A. This indicates that Microsoft Windows or a kernel-mode driver accessed paged memory at DISPATCH_LEVEL or above.


Important Information If You Have Received a STOP Code
If you have received a blue screen error, or stop code, the computer has shut down abruptly to protect itself from data loss. A hardware device, its driver, or related software might have caused this error. If your copy of Windows came with your computer, call the manufacturer of your computer. If you purchased Windows separately from your computer, Microsoft provides support.


If you have experience with computers and want to try to recover from this error, follow the steps provided in the Microsoft article Resolving STOP (Blue Screen) Errors in Windows.

The following actions might prevent an error like this from happening again:

• Download and install updates and device drivers for your computer from Windows Update.
• Scan your computer for computer viruses.
• Check your hard disk for errors.

FROM ME
The first thing was to check for errors notified by Windows on Device Manager.
You said there was only ONE, that was not relevant to this.
It was as you know from a previous software installation.

The second matter was to uninstall and reinstall the driver for the network adaptor, in case that was causing the error.

The third approach was to check for any updates on drivers.

Next was to look at anything you had installed which had caused this error, due to incompatability etc with your system.#
Registry cleaners, boosters, are favourites.

Also if Windows update was used and any hardware updates were offered and accepted these can sometimes be the wrong ones.
I recently worked on a computer that had suddenl;y developed an error on the PCI wirless card. The cause was found to be a Hardware update from windows, for the wirless card that was the wrong one. It is NEVER advisable to update hardware drivers from anywhere except the manufacturers site. or the computer manufacturer in the case of OEM systems with no additional installations.

After you have done all I suggested prior to the chkdsk, I recommend you do that, it is an effective simple way of checking for file corruption. If windows finds that it repairs the files using data from various places. Just as system restore works by using data from restore points.

I then suggest you run the system file checker, as this checks that all system files are in their correct place and that thery are intact.


I provide the above to reassure you that my advice is correct,
HOWEVER from my signature notes you were of course quite correct in your query

Please query any of my advice that you are not entirely happy with, or if you require further confirmation of how to proceed.

Edited by Macboatmaster, 08 March 2011 - 04:17 PM.

[coomdoom]

Ah fair enough, I'll run it tomorrow morning while I'm at uni. Thanks for your help so far, it's appreciated

[Macboatmaster]

Please do check carefully first for any new software - programs downloaded, updates from windows.
What anti-virus pls

Also I had a Netgear WPN111 USB stick installed

Was this installed BEFORE the BSOD and when you checked device manager tonight - was it THEN installed.
Quite frequent reports of such symptoms with this.

Try a driver reinstall for it.
http://kb.netgear.co...tail/a_id/17205

Edited by Macboatmaster, 08 March 2011 - 04:34 PM.

[coomdoom]

I did a disk check this morning which was ok, my pc is also up to date, although I've got a couple of new updates which have appeared today which I'm installing now. The anti-virus I use is avast and firewall I use Comodo. So far, the computer has been on for longer than it was yesterday with no problems. If the problem comes back I will update this thread. Thanks for your help.