Ntkrnlpa.exe and tcpipreg.sys BSODS

[rudy108]

So this started out with the occasional BSOD, with various causes, such as Bad Pool Caller and Memory Management. The BSODs seem to mostly happen right when I clicked in the address bar of a new tab in Firefox. But not always. And few times, I've just had a black screen occur.

I did Scannow a bunch of times, and it does say some sectors are corrupt. I've done Chkdsk, and it says everything is fine. Then I got into Driver Verifier. A problem seem to be present with tcpipreg.sys. Just doing Verifier with that driver causes a BSOD.

However, tcpipreg.sys does not always show as the cause. What shows up on every BSOD as a cause is ntkrnlpa.exe.

I have attached the diagnostic zip. If someone knows what going on here, that would be great.

Thanks, Rudy.

P.S. It's an Asus netbook, running Windows 7 Home.

 

[x BlueRobot]

Welcome to the forums rudy108,

[COLOR="red"]BugCheck C4[/COLOR], {0, 0, 0, 0}

Probably caused by : [COLOR="red"][COLOR="red"]tcpipreg.sys[/COLOR][/COLOR] ( tcpipreg!InterfaceAddressRegKeyChangeHandler+b5 )

The driver being nominated as a possible cause by Driver Verifier, seems to be a key Windows file named the TCP/IP Registry Compatibility Driver, the registry cleaners used may be a cause of this.

Scan for any missing, modified or corrupted protected Windows files with:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

I understand you have ran this command previously, but you will need to upload the sfcdetails.txt file which is produced (read Option Three of the tutorial)

Remove:

Start Menu\Programs\Norton Internet Security
Start Menu\Programs\Norton

Norton is known to cause BSODs with Windows 7, please remove the programs entirely using the Norton Removal Tool, and then install and run full scans with these alternatives which work best with the operating system due to their lightweight nature on system resources and compatibility.

Install and perform full scans with:

• Malwarebytes : Free anti-malware download
• Microsoft Security Essentials | Protect against viruses, spyware, and other malware

   Information

Remember to install the free version of Malwarebytes not the free trail; untick the free trial box during installation. MSE is the most lightweight and compatible with the Windows 7 operating system

You can also view this thread for a complete free and lightweight security protection combination:

• http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

Remove:

Start Menu\Programs\ParetoLogic
Start Menu\Programs\ParetoLogic\RegCure Pro
Start Menu\Programs\SlimCleaner
Start Menu\Programs\SlimComputer
Start Menu\Programs\SlimDrivers

Remove with - Revo Uninstaller Pro - Uninstall Software, Remove Programs easily, Forced Uninstall, Leftovers Uninstaller

Windows 7 doesn't require any programs which make changes to the operating system and registry, these programs tend to cause problems by modifying and deleting files.

It is most likely the reason for the corrupted files reported by the System File Checker.

• http://www.sevenforums.com/performa...registry-cleaner-tests-why-not-use-one-2.html

Windows is a closed source system. Developers of registry cleaners do not have the core code of Windows 7 and are not working on definitive information, but rather they are going on past knowledge and experience. Automatic cleaners will usually have to do some guesswork.

Modifying registry keys incorrectly can cause Windows instability, or make Windows unbootable. No registry cleaner is completely safe and the potential is ever present to cause more problems than they claim to fix.

Registry cleaners cannot distinguish between good and bad. If you run a registry cleaner, it will delete all those keys which are obsolete and sitting idle; but in reality, those keys may well be needed by some programs or windows at a later time.

Windows 7 is much more efficient at managing the registry than previous Windows versions. If you run any other registry cleaner and do not know precisely what you are doing, you will have problems down the road. There are no gains to be had from using a registry cleaner and the risk is great.

Reduce the number of programs at startup, to avoid any driver or program conflicts:

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html

 

[rudy108]

Thanks kindly for the advice Bluerobot. I will work through those.

 

[x BlueRobot]

I will look forward to the results

 

[rudy108]

Okay. So a few things. Those utilities shouldn't be causing anything. Basically, I downloaded those to hopefully fix the problem. I never used Regcure Pro and its deleted now, but I did use Slimdrivers to update all the drivers.

I think the BSODs were occurring before I got Norton (about 3 months ago). My older dump files have all disappeared, so it's tough to make completely sure of that. Any idea what might have happened to them? Are they temporary files?

I attached the report from the Scannow, and had a look at it myself. It is saying that autochk.exe and icm32.dll are corrupt.

 

[x BlueRobot]

The files within the store also seems to be corrupted, therefore I don't think Windows will be able to repair the files itself at all.

I would suggest attempting a http://www.sevenforums.com/tutorials/3413-repair-install.html or restoring from the factory partition.

The .dmp files will be deleted by the Windows Disk Cleanup program if ran, or by any third-party file/registry cleaner programs.

The corrupt Windows files are most likely one or the possible cause for the BSODs.

 

[rudy108]

Thank you, Bluerobot. So I tried a whole bunch of stuff.

I tried repair from the partition, though I'm not sure I have that option. I did "Startup Repair," but that didn't work. Ran scannow, but still bad.

I looked into the ISO thing. But since Windows came pre-installed, I'm not sure I can get an ISO.

I also found a site with all the windows files, DLL EXE Free download, and downloaded fresh copies of the 2 corrupt files. I took ownership of the corrupt files, renamed them to "old," and then copied the new files in. Then ran scannow, but it still showed them as corrupt. (Or do I have to use "takedown" command perhaps?)

I also tried some software from tweaking.com, All In One Windows Repair, but that didn't work either.

 

[x BlueRobot]

Don't download Windows .DLL files from other websites, they will cause more problems than good, you will be able to get a .ISO for your installation, by following these steps outlined within this tutorial:

• http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

There's a special note for Acer computers at the bottom of the tutorial page, outlining where to find the factory recovery partition, if you wish to perform a factory restore. Remember to backup all your personal data beforehand.

 

[rudy108]

I may have misunderstood you. I was thinking that there was a "Windows Repair" option from the partition or the USB ISO. But I'm going to have totally redo Windows, it sounds like. Save all my files and all that. Is that right?

And I do have the partition to restore from. I did figure that out. I was on the F8, but found the F9 eventually.

 

[VistaKing]

rudy108

Have you ran any Antivirus software ?

 

[rudy108]

Never mind that. I guess there is a "Repair Install." Found this page:

http://www.sevenforums.com/tutorials/3413-repair-install.html

 

[rudy108]

rudy108

Have you ran any Antivirus software ?

Yes, Norton.

 

[VistaKing]

Try running Malwarebytes

Malwarebytes

Download Link :ar: MalwareBytes

When the installation is done uncheck Enable free trial of Malwarebytes (see image below )

Update the definitions and do a full scan

:ar: On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.
:ar: If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
:ar: The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
:ar: When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
:ar: Click OK to close the message box and continue with the removal process.
:ar: Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
:ar: Make sure that everything is checked, and click Remove Selected.
:ar: When removal is completed, a log report will open in Notepad.
:ar: The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
:ar: Copy and paste the contents of that report in your next reply and exit MBAM.

 

[x BlueRobot]

Never mind that. I guess there is a "Repair Install." Found this page:

http://www.sevenforums.com/tutorials/3413-repair-install.html

Have you managed to run a Repair Install?

 

[rudy108]

Okay. So I ran Malwarebytes, and it looks clean. I attached the log file.

With the repair install, I downloaded the Windows 7 ISO from the link the how-to guide gave. Not sure if I should be doing some other, newer link perhaps. Anyways, it took a while, and suddenly had a problem 2 minutes before completion - something about not being able to read the source file.

But it was showing in Downloads, and I thought I might as well try it. So I downloaded that eicfg_remover.exe tool, and ran it. It wouldn't work though, saying I didn't have write access, or the file was corrupted, or some other program had it locked. I do appear to have write access. I checked that.

 

[x BlueRobot]

The download link is fine, and could you post a screenshot of the error message produced?

• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

 

[Britton30]

Thank you, Bluerobot. So I tried a whole bunch of stuff.

I tried repair from the partition, though I'm not sure I have that option. I did "Startup Repair," but that didn't work. Ran scannow, but still bad.

I looked into the ISO thing. But since Windows came pre-installed, I'm not sure I can get an ISO.

I also found a site with all the windows files, DLL EXE Free download, and downloaded fresh copies of the 2 corrupt files. I took ownership of the corrupt files, renamed them to "old," and then copied the new files in. Then ran scannow, but it still showed them as corrupt. (Or do I have to use "takedown" command perhaps?)

I also tried some software from tweaking.com, All In One Windows Repair, but that didn't work either.

Okay. So I ran Malwarebytes, and it looks clean. I attached the log file.

With the repair install, I downloaded the Windows 7 ISO from the link the how-to guide gave. Not sure if I should be doing some other, newer link perhaps. Anyways, it took a while, and suddenly had a problem 2 minutes before completion - something about not being able to read the source file.

But it was showing in Downloads, and I thought I might as well try it. So I downloaded that eicfg_remover.exe tool, and ran it. It wouldn't work though, saying I didn't have write access, or the file was corrupted, or some other program had it locked. I do appear to have write access. I checked that.

Those dll sites are usually overrun with Trojans, rootkits, viruses, etc. The eicfg tool won't help, it's for creating Universal install media. Ask before you try something, these people are trying to help you.

Why is it significant the iso was in downloads? A bootable flash drive or DVD is to be made with it according to the linked tutorial.

 

[rudy108]

Thanks Bluerobot. I have attached the image of the eicfg tool error message. Not sure if you meant the download error or the eicfg tool error. I don't have the download error anymore.

Britton30, the eicfg tool is part of that tutorial Bluerobot recommended, for making a USB Windows ISO, if I have OEM. Actually, the important part about it being in Downloads was that it appeared to be whole. I started downloading it again, but cancelled, and that showed as "part." After the 2 hour ISO download, I figured I might as well try the eicfg tool on the possibly completed download.

 

[x BlueRobot]

Have you tried the first few steps here - http://www.sevenforums.com/tutorials/3413-repair-install.html

Download 7-Zip, and then extract the .ISO file into a folder, and then run the setup.exe.

 

[rudy108]

Not yet. What is concerning me is this warning:

"You can only do a repair install with the same edition Windows 7 installation disc for the same edition of Windows 7 that you have installed."

So I downloaded the Home Premium ISO, and now I need to first get that to Home Basic SP1 using the eicfg tool. Or no?