BSOD crash tcpip.sys

Hi,
I have BSOD crash tcpip.sys

After BSOD windows restart and show this message:

Problem signature:
Problem Event Name: BlueScreen
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033

Additional information about the problem:
BCCode: d1
BCP1: 0000000000000000
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFF88001D82F92
OS Version: 6_1_7601
Service Pack: 1_0
Product: 256_1

Files that help describe the problem:
C:\Windows\Minidump\061311-26301-01.dmp
C:\Users\THEMARPER\AppData\Local\Temp\WER-80902-0.sysdata.xml


Is:
Windows 7 64 Bit Ultimate
Original
Full Retail

My Laptop is:
Dell XPS Laptop XPS 14 (L401X)

I provide more info in Zip file attach to this message.

I notice when I open Utorrent system crash in 5 minute.

My Antivirus is:
Pc Tool Spyware Doctor with Antivirus (original)

Please help me to find a solution.
Thanks :)

Thanks richc46 for your fast reply.
I will unistall PC Tools.

Do you think Windows Firewall and Microsoft Security Essentials are enough for security?

I'm disappointing with PC Tools software becouse i buy licence 1 year.

Thanks for your help. :)

richc46 said:

PC Tools firewall that is the cause. Uninstall completely. Use the windows firewall.
I see that you do use PCtools antivirus. I would uninstall all the PC software.
Use the Windows Firewall and Microsoft Security Essentials. All your reports point toward PC Tools.

Code:

 Microsoft (R) Windows Debugger Version 6.11.0001.404 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
 
Loading Dump File [C:\Users\richc46\AppData\Local\Temp\Temp1_Windows_NT6_BSOD_jcgriff2 (6).zip\Windows_NT6_BSOD_jcgriff2\053111-33774-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7601 (Service Pack 1) MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17592.amd64fre.win7sp1_gdr.110408-1631
Machine Name:
Kernel base = 0xfffff800`0325d000 PsLoadedModuleList = 0xfffff800`034a2650
Debug session time: Tue May 31 04:24:32.438 2011 (GMT-4)
System Uptime: 0 days 17:16:48.593
Loading Kernel Symbols
...............................................................
................................................................
............................................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {0, 2, 0, fffff88001d4df92}
Unable to load image \Device\Harddisk0\Partition3\Windows\system32\drivers\PctWfpFilter64.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for PctWfpFilter64.sys
*** ERROR: Module load completed but symbols could not be loaded for PctWfpFilter64.sys
Probably caused by : NETIO.SYS ( NETIO!NetioDereferenceNetBufferList+86 )
Followup: MachineOwner
---------
6: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001d4df92, address which referenced memory
Debugging Details:
------------------
 
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000350c100
 0000000000000000 
CURRENT_IRQL:  2
FAULTING_IP: 
tcpip! ?? ::FNODOBFM::`string'+5f94
fffff880`01d4df92 488b01          mov     rax,qword ptr [rcx]
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT
BUGCHECK_STR:  0xD1
PROCESS_NAME:  System
TRAP_FRAME:  fffff8800816d580 -- (.trap 0xfffff8800816d580)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa801afcd770 rbx=0000000000000000 rcx=0000000000000000
rdx=fffffa801afcd771 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001d4df92 rsp=fffff8800816d710 rbp=0000000000000000
 r8=fffffa801afcd770  r9=00000000000000d0 r10=fffff880036f9e80
r11=fffffa800dfc8a20 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
tcpip! ?? ::FNODOBFM::`string'+0x5f94:
fffff880`01d4df92 488b01          mov     rax,qword ptr [rcx] ds:11b0:00000000`00000000=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER:  from fffff800032dc2a9 to fffff800032dcd00
STACK_TEXT:  
fffff880`0816d438 fffff800`032dc2a9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`0816d440 fffff800`032daf20 : 00000000`00000000 fffffa80`14ef3c40 00000000`00000002 fffffa80`11411030 : nt!KiBugCheckDispatch+0x69
fffff880`0816d580 fffff880`01d4df92 : fffffa80`11411030 fffff880`0458eaca fffff880`206c644d fffffa80`16751e20 : nt!KiPageFault+0x260
fffff880`0816d710 fffff880`01a03336 : fffffa80`11411030 00000000`00000005 00000000`00000001 fffffa80`e0000001 : tcpip! ?? ::FNODOBFM::`string'+0x5f94
fffff880`0816d760 fffff880`01a02a92 : 00000000`00000000 fffffa80`16751e20 00000000`00000000 fffffa80`16751e20 : NETIO!NetioDereferenceNetBufferList+0x86
fffff880`0816d790 fffff880`01d03986 : 00000000`00000000 fffffa80`07dbee01 fffff880`0816d800 fffffa80`07db1000 : NETIO!NetioDereferenceNetBufferListChain+0x332
fffff880`0816d860 fffff880`01cf730b : fffffa80`16751e20 fffff880`01e279a0 fffff880`01e279a0 00000000`00000000 : tcpip!IppCompleteAndFreePacketList+0xc6
fffff880`0816d890 fffff880`01de41e2 : fffffa80`0c944f50 00000000`00000000 fffffa80`1d613001 00000000`00001988 : tcpip! ?? ::FNODOBFM::`string'+0x3265b
fffff880`0816da90 fffff880`01ec3af6 : fffffa80`0c71ad02 fffffa80`0c71ad10 00000000`00000002 00000000`00000000 : tcpip!IppInspectInjectReceive+0xf2
fffff880`0816dad0 fffff880`0458771d : fffffa80`0a8ef650 fffffa80`1d613010 00000000`c0000000 fffff880`00000000 : fwpkclnt!FwpsInjectTransportReceiveAsync0+0x256
fffff880`0816db80 fffffa80`0a8ef650 : fffffa80`1d613010 00000000`c0000000 fffff880`00000000 fffffa80`0e3c0002 : PctWfpFilter64+0xd71d
fffff880`0816db88 fffffa80`1d613010 : 00000000`c0000000 fffff880`00000000 fffffa80`0e3c0002 fffffa80`00000001 : 0xfffffa80`0a8ef650
fffff880`0816db90 00000000`c0000000 : fffff880`00000000 fffffa80`0e3c0002 fffffa80`00000001 fffffa80`0000000c : 0xfffffa80`1d613010
fffff880`0816db98 fffff880`00000000 : fffffa80`0e3c0002 fffffa80`00000001 fffffa80`0000000c fffffa80`00000000 : 0xc0000000
fffff880`0816dba0 fffffa80`0e3c0002 : fffffa80`00000001 fffffa80`0000000c fffffa80`00000000 fffffa80`00000000 : 0xfffff880`00000000
fffff880`0816dba8 fffffa80`00000001 : fffffa80`0000000c fffffa80`00000000 fffffa80`00000000 fffff880`04587250 : 0xfffffa80`0e3c0002
fffff880`0816dbb0 fffffa80`0000000c : fffffa80`00000000 fffffa80`00000000 fffff880`04587250 fffffa80`1d613010 : 0xfffffa80`00000001
fffff880`0816dbb8 fffffa80`00000000 : fffffa80`00000000 fffff880`04587250 fffffa80`1d613010 00000000`53636670 : 0xfffffa80`0000000c
fffff880`0816dbc0 fffffa80`00000000 : fffff880`04587250 fffffa80`1d613010 00000000`53636670 fffffa80`16751e20 : 0xfffffa80`00000000
fffff880`0816dbc8 fffff880`04587250 : fffffa80`1d613010 00000000`53636670 fffffa80`16751e20 fffff880`04596338 : 0xfffffa80`00000000
fffff880`0816dbd0 fffffa80`1d613010 : 00000000`53636670 fffffa80`16751e20 fffff880`04596338 00000000`00000000 : PctWfpFilter64+0xd250
fffff880`0816dbd8 00000000`53636670 : fffffa80`16751e20 fffff880`04596338 00000000`00000000 00000000`00000000 : 0xfffffa80`1d613010
fffff880`0816dbe0 fffffa80`16751e20 : fffff880`04596338 00000000`00000000 00000000`00000000 00000000`53636670 : 0x53636670
fffff880`0816dbe8 fffff880`04596338 : 00000000`00000000 00000000`00000000 00000000`53636670 fffffa80`0c2e6530 : 0xfffffa80`16751e20
fffff880`0816dbf0 00000000`00000000 : 00000000`00000000 00000000`53636670 fffffa80`0c2e6530 fffff880`04599128 : PctWfpFilter64+0x1c338
 
STACK_COMMAND:  kb
FOLLOWUP_IP: 
NETIO!NetioDereferenceNetBufferList+86
fffff880`01a03336 4885ff          test    rdi,rdi
SYMBOL_STACK_INDEX:  4
SYMBOL_NAME:  NETIO!NetioDereferenceNetBufferList+86
FOLLOWUP_NAME:  MachineOwner
MODULE_NAME: NETIO
IMAGE_NAME:  NETIO.SYS
DEBUG_FLR_IMAGE_TIMESTAMP:  4ce79381
FAILURE_BUCKET_ID:  X64_0xD1_NETIO!NetioDereferenceNetBufferList+86
BUCKET_ID:  X64_0xD1_NETIO!NetioDereferenceNetBufferList+86
Followup: MachineOwner
---------

I use PC Tools like anti spyware and antivirus but not as Firewall.

richc46 said:

The only think that I can tell you is that consistently the driver causing the problem was from PC Tools. Make a system restore point, in case you want to reinstall, then uninstall using the uninstall tool from their website.
Replace as mentiioned in my above post.

Thanks for your help.

I just uninstall PC Tools and activate Windows Defender.

I will make a test about 24h and update you.

Look like work already fine becouse uTorrent download at High Speed and i dont see any BSOD.

After a one day test. I confirm my system is stable.
Thanks for your help richc46.