Windows 7 BSOD with tcpip.sys after desktop appears

Hi,

I recently started getting a BSOD which mentions tcpip.sys, on Windows 7 soon after the Windows desktop appears after boot-up. This happens every time.

This started happening after I updating my Avast antivirus software to the latest version.

Using System Restore (from Safe Mode) to rollback before the update, my PC runs OK and I can reboot without incident. I have updated Avast and then used System Restore 3 or 4 times the last couple of weeks.

Before the Avast update my PC had been running 24x7 for several months (excluding vacations) with an occasional reboot.

I have used a tool from the Avast website to completely uninstall Avast. My PC now BSODs again after the windows desktop appears.

Can anyone help?

Kind regards,
dr1ver

Hi dr1ver.

The BSODs (all them) are causing by VirtualBox network driver.

First of all, uninstall NetWorx. It causes network related BSODs wherever it is present.

Next, Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

Also, if available, update the version of VirtualBOX. But dont let it run alongwith windows. Also, better you set the guest networks to "host only".

Let us know the results.
________________________________________________________

Code:

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {1c, 2, 1, fffff880018630be}

*** WARNING: Unable to verify timestamp for VBoxNetFlt.sys
*** ERROR: Module load completed but symbols could not be loaded for VBoxNetFlt.sys
Probably caused by : VBoxNetFlt.sys ( VBoxNetFlt+3e49 )

Followup: MachineOwner
---------

0: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 000000000000001c, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff880018630be, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003100100
GetUlongFromAddress: unable to read from fffff800031001c0
 000000000000001c Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
tcpip!TcpBeginTcbSend+33e
fffff880`018630be f083401c01      lock add dword ptr [rax+1Ch],1

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

ANALYSIS_VERSION: 6.3.9600.16384 (debuggers(dbg).130821-1623) amd64fre

DPC_STACK_BASE:  FFFFF80000BA2FB0

TRAP_FRAME:  fffff80000b9aef0 -- (.trap 0xfffff80000b9aef0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800db51f30
rdx=fffffa800db51fe8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880018630be rsp=fffff80000b9b080 rbp=fffff80000b9b190
 r8=fffffa800db51f20  r9=fffffa800db51f30 r10=fffffa800db51e60
r11=fffff80000b9b220 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na pe nc
tcpip!TcpBeginTcbSend+0x33e:
fffff880`018630be f083401c01      lock add dword ptr [rax+1Ch],1 ds:00000000`0000001c=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002ec8169 to fffff80002ec8bc0

STACK_TEXT:  
fffff800`00b9ada8 fffff800`02ec8169 : 00000000`0000000a 00000000`0000001c 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff800`00b9adb0 fffff800`02ec6de0 : 00000000`00000000 fffff880`0185fe3a 00000000`00000007 00000000`00000001 : nt!KiBugCheckDispatch+0x69
fffff800`00b9aef0 fffff880`018630be : 00000000`00000001 fffffa80`09a86cf0 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x260
fffff800`00b9b080 fffff880`018675b9 : fffff880`04f8e5a2 fffff880`0188b512 fffffa80`0a65b980 00000000`00000001 : tcpip!TcpBeginTcbSend+0x33e
fffff800`00b9b300 fffff880`018877c6 : 00000000`00000000 00000000`00000001 fffff880`01967128 00000000`00000000 : tcpip!TcpTcbSend+0x1d9
fffff800`00b9b580 fffff880`01862b65 : fffff880`04f8e500 00000000`00000000 00000000`00000000 fffff800`00b9b800 : tcpip!TcpFlushDelay+0x316
fffff800`00b9b660 fffff880`0185af17 : fffffa80`0a65b980 fffffa80`0a7b2733 fffffa80`0000350b 00000000`0000350b : tcpip!TcpPreValidatedReceive+0x3e5
fffff800`00b9b730 fffff880`0185aa8a : 00000000`00000000 fffff880`0196d9a0 fffff800`00b9b8f0 fffffa80`09a62a30 : tcpip!IppDeliverListToProtocol+0x97
fffff800`00b9b7f0 fffff880`0185a089 : fffff880`0196d9a0 fffffa80`09ad38c0 00000000`00000011 fffff800`00b9b8e0 : tcpip!IppProcessDeliverList+0x5a
fffff800`00b9b890 fffff880`01857d2f : 00000000`fe01a8c0 fffff880`0196d9a0 fffff880`0196d9a0 00000000`00000000 : tcpip!IppReceiveHeaderBatch+0x23a
fffff800`00b9b970 fffff880`01857302 : fffffa80`0c8fdcd0 00000000`00000000 fffffa80`0c8ec001 00000000`00000001 : tcpip!IpFlcReceivePackets+0x64f
fffff800`00b9bb70 fffff880`0185672a : fffffa80`0c8ec010 fffff800`00b9bca0 fffffa80`0c8ec010 00000010`00000000 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
fffff800`00b9bc50 fffff800`02ed4878 : fffffa80`09a62a30 00000000`00004800 fffff800`03051cc0 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
fffff800`00b9bca0 fffff880`01856e22 : fffff880`01856650 fffff880`01765395 00000000`00000002 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff800`00b9bd80 fffff880`0175c0eb : fffffa80`0c8fa680 00000000`00000000 fffffa80`0bfca1a0 fffffa80`0bfca1a0 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff800`00b9bdf0 fffff880`01725ad6 : fffffa80`00000000 00000000`00000000 00000000`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff800`00b9be60 fffff880`016a85d4 : fffffa80`0bfca1a0 00000000`00000002 00000000`00000001 00000000`00000000 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
fffff800`00b9c2e0 fffff880`0175cbb5 : 00000000`00000001 fffffa80`00000000 fffffa80`0bfca1a0 00000000`00000000 : ndis!ndisMTopReceiveNetBufferLists+0x24
fffff800`00b9c320 fffff880`049aae49 : fffffa80`0c4ef020 fffffa80`0a60a240 fffff800`00000001 fffffa80`00000000 : ndis!ndisMIndicatePacketsToNetBufferLists+0x105
fffff800`00b9c3c0 fffffa80`0c4ef020 : fffffa80`0a60a240 fffff800`00000001 fffffa80`00000000 fffff800`00b9c4f0 : VBoxNetFlt+0x3e49
fffff800`00b9c3c8 fffffa80`0a60a240 : fffff800`00000001 fffffa80`00000000 fffff800`00b9c4f0 fffffa80`0a60a1d0 : 0xfffffa80`0c4ef020
fffff800`00b9c3d0 fffff800`00000001 : fffffa80`00000000 fffff800`00b9c4f0 fffffa80`0a60a1d0 00000000`00000000 : 0xfffffa80`0a60a240
fffff800`00b9c3d8 fffffa80`00000000 : fffff800`00b9c4f0 fffffa80`0a60a1d0 00000000`00000000 fffffa80`0bf7a100 : 0xfffff800`00000001
fffff800`00b9c3e0 fffff800`00b9c4f0 : fffffa80`0a60a1d0 00000000`00000000 fffffa80`0bf7a100 fffffa80`0c4eea10 : 0xfffffa80`00000000
fffff800`00b9c3e8 fffffa80`0a60a1d0 : 00000000`00000000 fffffa80`0bf7a100 fffffa80`0c4eea10 fffffa80`0c4ef8d0 : 0xfffff800`00b9c4f0
fffff800`00b9c3f0 00000000`00000000 : fffffa80`0bf7a100 fffffa80`0c4eea10 fffffa80`0c4ef8d0 fffffa80`0a60a240 : 0xfffffa80`0a60a1d0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
VBoxNetFlt+3e49
fffff880`049aae49 ??              ???

SYMBOL_STACK_INDEX:  13

SYMBOL_NAME:  VBoxNetFlt+3e49

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: VBoxNetFlt

IMAGE_NAME:  VBoxNetFlt.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  51d57f28

FAILURE_BUCKET_ID:  X64_0xD1_VBoxNetFlt+3e49

BUCKET_ID:  X64_0xD1_VBoxNetFlt+3e49

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:x64_0xd1_vboxnetflt+3e49

FAILURE_ID_HASH:  {5440eeab-1ec2-c465-2404-e10097cf560a}

Followup: MachineOwner
---------

0: kd> lmvm VBoxNetFlt
start             end                 module name
fffff880`049a7000 fffff880`049cf000   VBoxNetFlt T (no symbols)           
    Loaded symbol image file: VBoxNetFlt.sys
    Image path: VBoxNetFlt.sys
    Image name: VBoxNetFlt.sys
    Timestamp:        Thu Jul 04 19:26:56 2013 (51D57F28)
    CheckSum:         0002F464
    ImageSize:        00028000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Host only: Chapter 6. Virtual networking

Free up the startup. Windows does not need any other program to auto start with it, but the auto start programs often conflicts and causes various problems including BSODs.

1. Click on the Start button
2. Type “msconfig (without quotes), click the resulting link. It will open the System Configuration window.
3. Select the “Startup” tab.
4. Deselect all items other than the antivirus.
5. Apply > OK
6. Accept then restart.

This action will remove all possible VBox entries from startup, too.

You are welcome.

Let us know for any further issue.