Tcpip.sys BSOD

[MoonTears]

Hi all, im having a BSOD with this .sys

I read many thread about this issue, and none seemed to help me

please check my dumps, maybe you see something that I didnt see

I think its one of my HDs (the maxtor one), since it's SMART isnt too perfect

thanks

 

[raybay]

Replace that hard Maxtor hard drive, and the BSOD's will likely disappear.
You will usually still be able to access the drive to recover your data by placing it in an external USB enclosure.
Certain Maxtors are infamous for these BSOD's, and only the evil TriGem hard drive is less reliable.
Out count seems to verify that hard drives are the most common cause of BSOD in both laptop and desktop... EIDE, and SATA, but there are also other hardware failures that are guilty.

 

[MoonTears]

i started the pc without that HD, and the BSOD keeps appearing

i think its related to some kind of multi tasking

if i activate utorrent, there is WAY much more risk that the bsod appears

reason? dont know

 

[LookinAround]

Replace that hard Maxtor hard drive, and the BSOD's will likely disappear.
<snip>
Our count seems to verify that hard drives are the most common cause of BSOD in both laptop and desktop...

@raybay
"Post hoc ergo propter hoc"
Latin for "Don't be simplistic in diagnosing cause and effect"

Huh? #2 (until i can go back and add in the rest to give you the count)

Of course, your repairs reach that conclusion because you seldom, if ever, diagnose for software problems and/or file corruption issues that are the most common cause instead of simply saying "replace hardware". Do you know how to look at software?? so you can put away your sledgehammer for a debugging tool

Did you even bother to note the failing program was tcpip.sys???????

@MoonTears
TCP/IP is the protocol used around the world for networking on the internet.

Without even looking at your minidumps, i'll venture to guess your tcpip.sys BSOD may be network related. (Duh)

I'd suggest you first try:
> Uninstalling your utorrent software
> Reinstalling all your network drivers (LAN and wireless)
> Then reinstall drivers only (not utorrent) and see if the problem returns

/* edit */
Tho at the same time, i don't want to ignore your SMART data either. Could you post just the error counts? The question is what errors occur and where are they wrt to the thresholds

 

[MoonTears]

tried those 3 steps, same issue, just less often (especially when multitasking, say coding a movie for the psp while i play a game on a screen and watch a movie on the other screen)

as for smart...

MAXTOR STM3500320AS Health

ID Current Worst ThresholdData Status
(01) Raw Read Error Rate 117 93 6 131161481 begin_of_the_skype_highlighting**************117 93 6 131161481******end_of_the_skype_highlighting ok
(03) Spin Up Time 94 91 0 0 ok
(04) Start/Stop Count 99 99 20 1588 ok
(05) Reallocated Sector Count 100 100 36 0 ok
(07) Seek Error Rate 74 61 30 99070913 ok
(09) Power On Hours Count 84 84 0 14374 ok
(0A) Spin Retry Count 100 100 97 4 warning
(0C) Power Cycle Count 100 37 20 550 ok
(B8) (unknown attribute) 100 100 99 0 ok
(BB) Reported Uncorrectable Errors 16 16 0 84 ok
(BC) Command Timeout 100 100 0 0 ok
(BD) (unknown attribute) 100 100 0 0 ok
(BE) Airflow Temperature 59 49 45 689307689 ok
(C2) Temperature 41 51 0 41 ok
(C3) Hardware ECC Recovered 29 25 0 131161481 ok
(C5) Current Pending Sector 100 100 0 2 warning
(C6) Offline Uncorrectable 100 100 0 2 ok
(C7) Ultra DMA CRC Error Count 200 200 0 0 ok

Health Status : warning


thanks a lot for your help

 

[Route44]

Don't mean to step in and interfere but if you are getting warnings from S.M.A.R.T. then by all means back up everything important to you -- NOW.

Then go to Seagate's website and down load their Seatools harddrive diagnostics utility to your desktop. This is free and safe to use. It is an ISO file so place a blank CD in your drive and click on the ISO file. Then with newly burned CD in drive reboot your computer and the test will kick in in a few seconds. Run both Short and Long tests. You may have to set your DVD drive as first bootable in your BIOS to work.

@raybay and LookinAround - all three minidump error codes are 0xD1 and all cite the tdx.sys Windows driver as the cause and from what i can gather updating the NIC drivers is the first, best step to rectify.

However, it was also noted that the NetLimiter driver nltdi.sys by Locktime Software is being blocked by tdx.sys which would make sense considering the need might be NIC drivers.

One other thing, in my short research another issue with this error is that antiviruses can play a part and in one dump it cited the Avast driver aswTdi.sys as unable to load. However, I believe this is a result of other causes and not the cause itself.

 

[LookinAround]

@route44
Not interfering. Au contraire, your opinion is always welcome

@MoonTears
I agree with Route44's assessment as I think you have two separate problems here.

Your SMART data indicates it's probably a good time and wise to get a new hard drive but your BSOD is due to something else.

re: your earlier question if getting Win 7 would fix the problem...

It's possible that reinstalling either of XP or Win 7 will fix the problem as either will do a fresh install and correct any software/driver corruption. So you might
> Simply reinstall XP first (save the $$ if possible as well as rule out any machine defect before spending $$ for an OS for a faulty system)
> If you do reinstall (either XP or Win7) is prudent to first create a backup cloned image of your hardrive (EASUS To Do backup is a good freeware tool to that)

Also, since there's some failures on the drive as revealed by SMART data I'd also be cautious and be sure to use the Sector-by-Sector backup method when you backup and create the clone drive image

So let us know what you're thinking as if you thinking to do clean reinstall (XP or Win7) is no need to continue to look further into the BSOD for now

/* edit */
OOOppps! I just realized it was someone else in ANOTHER thread that asked about fixing things by just upgrading and installing to Win 7! (as i just re-read their last post!) See Route44, i sometimes get confused and lose track between my threads too! LOL

 

[Broni]

I apologize for butting in, but I'd like to add, that tcpip.sys file is one of files targeted by bad guys. That may cause BSOD with tcpip.sys file listed as the cause.

If you don't mind...

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Vista users:: Right click on SystemLook.exe, click Run As Administrator
• Copy the content of the following box into the main textfield:
  

  :filefind
  tcpip.sys

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

 

[Route44]

That's okay Broni, I already did a butt-insky and LookinAround absolved me of any guilt. :grinthumb

Anyway, good to see you and advice always welcomed.

 

[Broni]

...........

 

[LookinAround]

tcpip.sys file is one of files targeted by bad guys. That may cause BSOD with tcpip.sys file listed as the cause.

That's okay Broni,<snip> good to see you and advice always welcomed.

Absolutely. And agree on both of those good points!! :grinthumb

 

[MoonTears]

thanks a lot for your help, guys

i already uninstalled avast (didnt like it anyways). what's your favourite AV to replace it?

btw, i have win7, not xp

as for the systemlook log, here you go:

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 18:18 on 30/05/2010 by Catharsis (Administrator - Elevation successful)

========== filefind ==========

Searching for "tcpip.sys"
C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16385_none_0f1303f98017479d\tcpip.sys --a--- 1898576 bytes [23:25 13/07/2009] [01:45 14/07/2009] 912107716BAB424C7870E8E6AF5E07E1

-=End Of File=-

 

[Broni]

Thanks guys

It looks like you have tcpip.sys file missing from its correct location.
Open Windows Explorer, navigate to:
C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16385_none_0f1303f98017479d
Copy tcpip.sys file from there and paste it to:
C:\Windows\System32\drivers folder

Restart computer.

 

[MoonTears]

thats sys is already in the drivers folder, its duplicated

exactly same info on file (date, size..)

 

[Broni]

Hmmm....very interesting...I wonder, why SystemLook didn't see it
Let's take a look...

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Vista users:: Right click on SystemLook.exe, click Run As Administrator
• Copy the content of the following box into the main textfield:
  

  :file
  C:\Windows\System32\drivers\tcpip.sys

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

 

[MoonTears]

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 20:40 on 30/05/2010 by Catharsis (Administrator - Elevation successful)

========== file ==========

C:\Windows\System32\drivers\tcpip.sys - Unable to find/read file.

-=End Of File=-

 

[Broni]

Please, go back to C:\Windows\System32\drivers folder and make sure, the file, you apparently see, has exact same name and extension. Letter by letter.

 

[MoonTears]

exactly, if i copy the one in the other folder, it asks for overwrite confirmation

 

[Broni]

Can you zip your file from C:\Windows\System32\drivers folder an upload it here?

 

[MoonTears]

cant, winrar says it cant be found

totally broken file?

 

[Broni]

if i copy the one in the other folder, it asks for overwrite confirmation

Do it. Restart computer and see about new BSODs.

 

[MoonTears]

cant, "file cant be found"

and if i change anything else, access denied, even if i harvest the auth

im going to reformat...

 

[Broni]

No, no, don't be silly. Hold on...

 

[Broni]

Please download OTM

• Save it to your desktop.
• Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes

:Services

:Reg

:Files
C:\Windows\System32\drivers\tcpip.sys|C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16385_none_0f1303f98017479d\tcpip.sys /replace
      
:Commands
[purity]
[resethosts]
[emptytemp]
[Reboot]

• Return to OTM, right click in the Paste Instructions for Items to be Movedwindow (under the yellow bar) and choose Paste.
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

 

[MoonTears]

All processes killed
========== PROCESSES ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
Unable to replace file: C:\Windows\System32\drivers\tcpip.sys with C:\Windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16385_none_0f1303f98017479d\tcpip.sys without a reboot.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Catharsis


---


rebooted, keeps happening