BSOD

Inv1ctus · 07 Aug 2010

Hello, I got the following bsod, it says it has something to do with tcip.sys. In the past month I had some issues with the realtek network driver, which seemed fix. Now this bsod occured, is this connected to that driver or is it something new? Thank You.

zigzag3143 · 07 Aug 2010

Inv1ctus said:

Hello, I got the following bsod, it says it has something to do with tcip.sys. In the past month I had some issues with the realtek network driver, which seemed fix. Now this bsod occured, is this connected to that driver or is it something new? Thank You.

This cause of this crash seems to point to tcpip.sys on the surface, but on further examination was cased by a memory exception.

To test your memory
Download a copy of Memtest86 and burn the ISO to a CD using Iso Recorder or another ISO burning program. Boot from the CD, and leave it running for at least 5 or 6 passes.

Let us know the results and if you need further assistance

Ken

Code:

Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\K\Desktop\080710-32198-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*C:\symbols*http://msdl.microsoft.com/download/symbols;srv*e:\symbols
*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (2 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16539.amd64fre.win7_gdr.100226-1909
Machine Name:
Kernel base = 0xfffff800`02a54000 PsLoadedModuleList = 0xfffff800`02c91e50
Debug session time: Sat Aug  7 15:21:28.554 2010 (GMT-4)
System Uptime: 0 days 13:27:59.255
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
................................................................
......................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000007E, {ffffffffc0000005, fffff8800164a739, fffff88002fe7788, fffff88002fe6ff0}

Probably caused by : tcpip.sys ( tcpip!InetDereferenceAf+9 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck.  Usually the exception address pinpoints
the driver/function that caused the problem.  Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003.  This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG.  This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG.  This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8800164a739, The address that the exception occurred at
Arg3: fffff88002fe7788, Exception Record Address
Arg4: fffff88002fe6ff0, Context Record Address

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
tcpip!InetDereferenceAf+9
fffff880`0164a739 f00fc15910      lock xadd dword ptr [rcx+10h],ebx

EXCEPTION_RECORD:  fffff88002fe7788 -- (.exr 0xfffff88002fe7788)
ExceptionAddress: fffff8800164a739 (tcpip!InetDereferenceAf+0x0000000000000009)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

CONTEXT:  fffff88002fe6ff0 -- (.cxr 0xfffff88002fe6ff0)
rax=c001000c00000000 rbx=00000000ffffffff rcx=c001000c00000000
rdx=fffff88002f00000 rsi=fffffa8004809000 rdi=fffffa8003e738f0
rip=fffff8800164a739 rsp=fffff88002fe79c0 rbp=0000000000000000
 r8=00000000000025a8  r9=0000000000000260 r10=fffff80002a54000
r11=00000000000000f1 r12=8000000400000000 r13=000000000000afd2
r14=000000000000afd0 r15=000000000000afd6
iopl=0         nv up ei ng nz na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
tcpip!InetDereferenceAf+0x9:
fffff880`0164a739 f00fc15910      lock xadd dword ptr [rcx+10h],ebx ds:002b:c001000c`00000010=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

PROCESS_NAME:  System

CURRENT_IRQL:  0

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002cfc0e0
 ffffffffffffffff 

FOLLOWUP_IP: 
tcpip!InetDereferenceAf+9
fffff880`0164a739 f00fc15910      lock xadd dword ptr [rcx+10h],ebx

BUGCHECK_STR:  0x7E

LAST_CONTROL_TRANSFER:  from fffff880016aa240 to fffff8800164a739

STACK_TEXT:  
fffff880`02fe79c0 fffff880`016aa240 : fffffa80`03dc4068 00000000`00000000 fffffa80`04809000 00000000`00000000 : tcpip!InetDereferenceAf+0x9
fffff880`02fe79f0 fffff880`01667115 : fffff880`02fe7b60 fffffa80`03e6d5c0 00000000`0000afd1 fffffa80`03e6d5c0 : tcpip! ?? ::FNODOBFM::`string'+0x2d799
fffff880`02fe7a90 fffff880`01667169 : 00000000`0000afd2 fffffa80`03e6d4a0 00000000`0000afd1 00000000`0000afd1 : tcpip!TcpCloseEndpoint+0x95
fffff880`02fe7b00 fffff880`02ca96c3 : 00000000`0000afd1 fffffa80`03e6d5c0 00000000`00000000 00000000`000006b1 : tcpip!TcpTlEndpointCloseEndpoint+0x9
fffff880`02fe7b30 fffff880`02cb3e41 : fffffa80`03e6d5c0 fffff880`02cae7f0 fffff880`02c9dc90 fffff880`02cb3e20 : afd! ?? ::NNGAKEGL::`string'+0x13ac
fffff880`02fe7be0 fffff880`02c79ff7 : fffffa80`03e6d5c0 fffffa80`03e6d5c0 fffff880`02cae7f0 fffff880`02c9dc90 : afd!AfdFreeEndpointTditl+0x21
fffff880`02fe7c10 fffff800`02dc1827 : fffffa80`04e5c2a0 fffffa80`04e82060 fffff800`02c695f8 fffffa80`039e1b60 : afd!AfdDoWork+0x67
fffff880`02fe7c40 fffff800`02ad1861 : fffff800`02c69500 fffff800`02dc1804 fffffa80`039e1b60 00000000`00000000 : nt!IopProcessWorkItem+0x23
fffff880`02fe7c70 fffff800`02d69a86 : 1019911c`301005c0 fffffa80`039e1b60 00000000`00000080 fffffa80`039cd040 : nt!ExpWorkerThread+0x111
fffff880`02fe7d00 fffff800`02aa2b06 : fffff880`009e4180 fffffa80`039e1b60 fffff880`009eef40 7ff7ff7f`fbf7ffff : nt!PspSystemThreadStartup+0x5a
fffff880`02fe7d40 00000000`00000000 : fffff880`02fe8000 fffff880`02fe2000 fffff880`02fe7820 00000000`00000000 : nt!KxStartSystemThread+0x16


SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  tcpip!InetDereferenceAf+9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME:  tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a5bc26e

STACK_COMMAND:  .cxr 0xfffff88002fe6ff0 ; kb

FAILURE_BUCKET_ID:  X64_0x7E_tcpip!InetDereferenceAf+9

BUCKET_ID:  X64_0x7E_tcpip!InetDereferenceAf+9

Followup: MachineOwner
---------

Jonathan_King · 07 Aug 2010

In addition to Ken's good advice, try removing Avast. In my personal experience, I have noticed that frequently when the dump blames a Windows networking driver, it is either a network adapter driver issue, or a third-party security program.

Here is the Avast removal tool: http://files.avast.com/files/eng/aswclear5.exe

Replace it with Microsoft Security Essentials, which is also free: http://www.microsoft.com/security_essentials

Your Realtek drivers are older:

Code:

RTKVHD64.sys Tue Aug 04 05:50:52 2009
RtNdPt60.sys Sun Jul 19 22:27:32 2009

I suspect you should be able to find an update for them, check on your computer manufacturer's site and also here: Realtek

Inv1ctus · 08 Aug 2010

Zigzag3143 I tested the ram with memtest and it went from test 1-7 without any problems. Luckily the memory isn't the issue looks like.

Jonathan_King I do have the latest drivers from the link You gave me, the realtek network adapter driver is Rt64win7.sys, the RTKVHD64 is the driver for high definition audio function. RtNdPt60.sys is the driver for NDIS protoco,l how this is connected to realtek network adapter I do not know, I hope You will tell me. Ok I have Avast installed and You said it could be an issue, so I'll have to look into that.

Otherwise I had no Rt64win7.sys driver issues for the past three days, since I installed the proper drivers and removed daemon tools and uninstalled the sptd. Two days ago I had the tcip.sys bsod which happened only once before since I have this computer, so for about 50 days now. Once again I do not know if this issues are connected. Thank You guys for all the help. If another BSOD occurs I'll try to remove the Avast AV and replace it.