tcpip.sys related bsod

[needfix]

Hi!

I keep getting bsods and suspect it has something to do with Planetside 2, as it started to occur after I installed that game. I noticed tcpip.sys was mentioned on the bsod, as well as "driver_irql_not_less_or_equal".

After restart i get information like this:

BCCode: d1
BCP1: 0000000000000009
BCP2: 0000000000000002
BCP3: 0000000000000000
BCP4: FFFFF880016B2F5F
OS Version: 6_1_7601
Service Pack: 1_0
Product: 768_1

Dumpfiles are attatched. I tried installing the windows debugger but installation failed.

 

[koolkat77]

Welcome to SF.

Please upload your msinfo32.nfo file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Save -> Save as msinfo32.nfo and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .nfo file, click send to compressed (zipped) folder -> Upload the .zip file here.

Please upload your msinfo32.txt file. To get this: Start Menu -> Type msinfo32 into the Search programs and files box -> When it opens, go to File, Export -> Save as msinfo32.txt and save in a place you will remember -> Let it finish the process of gathering and saving the system info -> Right click the .txt file, click send to compressed (zipped) folder -> Upload the .zip file here.

 

[needfix]

Hi again!

Attatched are the files as requested.

 

[koolkat77]

Thanks.

If you are overclocking your system, please return all overclocked components to their stock speeds. If the BSOD's are found not to be caused by the overclock, you can re-overclock the components once we have finished the diagnostics.

Start Menu\Programs\ASUS\AI Suite II	Public:Start Menu\Programs\ASUS\AI Suite II	Public

This is overclocking software and can lead to system instability and BSOD's. Please reset all components to their stock speeds and then remove the software.

Uninstall AVG: AVG | Download tools and utilities

Install MSE: Microsoft Security Essentials - Microsoft Windows

Also keep MBAM: Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer

MSE is recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software:-

1. Microsoft Security Essentials - Free Antivirus for Windows
2. Malwarebytes - Free
3. http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html
​

:warn: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.

System Optimisers

Please remove the following software

Start Menu\Programs\Advanced SystemCare 5	Public:Start Menu\Programs\Advanced SystemCare 5	Public

This software is a known cause of BSOD's. The windows 7 operating system does not require these registry cleaning software. They often tune-down rather than tune-up and can wreck the OS beyond repair. Microsoft have improved Windows 7 significantly and it is much better at organising and optimising itself than its predecessors. Check this, this and this thread for evidence.

If you feel the need to use a registry cleaning or optimisation software, most of us recommend the use of CCleaner but make sure you back up the registry before making letting ccleaner delete anything.

Update these drivers:

1. e1q62x64.sys
2. npf_devolo.sys​

Go to this link Intel® Driver Update Utility and check the system for latest updates. Download and install them.

Check for a firmware update for the SSD.

Run the System File Checker. It allows the user to scan for and restore corruptions in Windows system files.

• 
  1. Click on the rb:
  2. Type CMD on Search
  3. Left click and Run as Administrator
  4. Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

Run Disk Check on your hard disk for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

Free up the start-up, nothing except the antivirus is usually needed.

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

BUGCHECK ANALYSIS

[FONT="Consolas"]*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {9, 2, 0, fffff880016b2f5f}

*** WARNING: Unable to verify timestamp for e1q62x64.sys
*** ERROR: Module load completed but symbols could not be loaded for e1q62x64.sys
Probably caused by : e1q62x64.sys ( e1q62x64+239e9 )

Followup: MachineOwner
---------

5: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000009, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff880016b2f5f, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800034b2100
GetUlongFromAddress: unable to read from fffff800034b21c0
 0000000000000009 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
tcpip!IpFlcReceivePreValidatedPackets+cf
fffff880`016b2f5f 0fb61c11        movzx   ebx,byte ptr [rcx+rdx]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  PlanetSide2.ex

TAG_NOT_DEFINED_c000000f:  FFFFF880030B7FB0

TRAP_FRAME:  fffff880030b6a50 -- (.trap 0xfffff880030b6a50)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa800ce0c820 rbx=0000000000000000 rcx=0000000000000009
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880016b2f5f rsp=fffff880030b6be0 rbp=fffff880017db9a0
 r8=0000000000000010  r9=0000000000000002 r10=fffff880017d0002
r11=00000000ffffffff r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
tcpip!IpFlcReceivePreValidatedPackets+0xcf:
fffff880`016b2f5f 0fb61c11        movzx   ebx,byte ptr [rcx+rdx] ds:00000000`00000009=??
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80003282569 to fffff80003282fc0

STACK_TEXT:  
fffff880`030b6908 fffff800`03282569 : 00000000`0000000a 00000000`00000009 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`030b6910 fffff800`032811e0 : 00000000`00000001 fffffa80`0ce21f00 00000000`00000005 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`030b6a50 fffff880`016b2f5f : fffffa80`0e16c080 00000000`00005001 fffff880`030b6b80 00000000`00000000 : nt!KiPageFault+0x260
fffff880`030b6be0 fffff880`016c3992 : fffffa80`0d7ff900 fffffa80`0d7ff900 00000000`45660002 00000000`00000000 : tcpip!IpFlcReceivePreValidatedPackets+0xcf
fffff880`030b6d40 fffff800`0328ec48 : 00000000`00000000 00000000`00004800 fffffa80`0dd539f0 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xa2
fffff880`030b6d90 fffff880`016c4092 : fffff880`016c38f0 fffff880`0159b395 00000000`00000002 fffffa80`1121b300 : nt!KeExpandKernelStackAndCalloutEx+0xd8
fffff880`030b6e70 fffff880`015920eb : fffffa80`0d869010 00000000`00000000 fffffa80`0d4811a0 fffff880`014dda76 : tcpip!FlReceiveNetBufferListChain+0xb2
fffff880`030b6ee0 fffff880`0155bad6 : fffffa80`00000005 00000000`00000000 00000000`00000000 00000000`00000001 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
fffff880`030b6f50 fffff880`014d5ac1 : fffffa80`0d4811a0 00000000`00000002 00000000`00000002 fffffa80`114537d0 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
fffff880`030b73d0 fffff880`11da79e9 : fffffa80`0d771000 fffffa80`0d7b5c30 fffffa80`0d7b4180 00000000`00000002 : ndis!NdisMIndicateReceiveNetBufferLists+0xc1
fffff880`030b7420 fffffa80`0d771000 : fffffa80`0d7b5c30 fffffa80`0d7b4180 00000000`00000002 00000000`00000801 : e1q62x64+0x239e9
fffff880`030b7428 fffffa80`0d7b5c30 : fffffa80`0d7b4180 00000000`00000002 00000000`00000801 00000000`00000002 : 0xfffffa80`0d771000
fffff880`030b7430 fffffa80`0d7b4180 : 00000000`00000002 00000000`00000801 00000000`00000002 fffffa80`0d773b00 : 0xfffffa80`0d7b5c30
fffff880`030b7438 00000000`00000002 : 00000000`00000801 00000000`00000002 fffffa80`0d773b00 fffff880`11da7b84 : 0xfffffa80`0d7b4180
fffff880`030b7440 00000000`00000801 : 00000000`00000002 fffffa80`0d773b00 fffff880`11da7b84 00000000`00000001 : 0x2
fffff880`030b7448 00000000`00000002 : fffffa80`0d773b00 fffff880`11da7b84 00000000`00000001 fffffa80`0d7b5c30 : 0x801
fffff880`030b7450 fffffa80`0d773b00 : fffff880`11da7b84 00000000`00000001 fffffa80`0d7b5c30 fffffa80`0d7c5030 : 0x2
fffff880`030b7458 fffff880`11da7b84 : 00000000`00000001 fffffa80`0d7b5c30 fffffa80`0d7c5030 00000000`00000002 : 0xfffffa80`0d773b00
fffff880`030b7460 00000000`00000001 : fffffa80`0d7b5c30 fffffa80`0d7c5030 00000000`00000002 0000000a`0e0b6e01 : e1q62x64+0x23b84
fffff880`030b7468 fffffa80`0d7b5c30 : fffffa80`0d7c5030 00000000`00000002 0000000a`0e0b6e01 00000000`00000000 : 0x1
fffff880`030b7470 fffffa80`0d7c5030 : 00000000`00000002 0000000a`0e0b6e01 00000000`00000000 fffff880`11d9a6d0 : 0xfffffa80`0d7b5c30
fffff880`030b7478 00000000`00000002 : 0000000a`0e0b6e01 00000000`00000000 fffff880`11d9a6d0 fffff880`030b76d8 : 0xfffffa80`0d7c5030
fffff880`030b7480 0000000a`0e0b6e01 : 00000000`00000000 fffff880`11d9a6d0 fffff880`030b76d8 00000000`00000000 : 0x2
fffff880`030b7488 00000000`00000000 : fffff880`11d9a6d0 fffff880`030b76d8 00000000`00000000 fffffa80`0d464270 : 0x0000000a`0e0b6e01


STACK_COMMAND:  kb

FOLLOWUP_IP: 
e1q62x64+239e9
fffff880`11da79e9 ??              ???

SYMBOL_STACK_INDEX:  a

SYMBOL_NAME:  e1q62x64+239e9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: e1q62x64

IMAGE_NAME:  e1q62x64.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4c364c04

FAILURE_BUCKET_ID:  X64_0xD1_e1q62x64+239e9

BUCKET_ID:  X64_0xD1_e1q62x64+239e9

Followup: MachineOwner
---------

5: kd> lmvm e1q62x64
start             end                 module name
fffff880`11d84000 fffff880`11dd0000   e1q62x64 T (no symbols)           
    Loaded symbol image file: e1q62x64.sys
    Image path: \SystemRoot\system32\DRIVERS\e1q62x64.sys
    Image name: e1q62x64.sys
    Timestamp:        [COLOR="Red"]Fri Jul 09 04:07:00 2010[/COLOR] (4C364C04)
    CheckSum:         000506D5
    ImageSize:        0004C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
kd> lmvm npf_devolo
start             end                 module name
fffff880`06c7b000 fffff880`06c87000   npf_devolo T (no symbols)           
    Loaded symbol image file: npf_devolo.sys
    Image path: \SystemRoot\sysWOW64\drivers\npf_devolo.sys
    Image name: npf_devolo.sys
    Timestamp:        [COLOR="Red"]Fri Feb 02 15:24:05 2007[/COLOR] (45C30335)
    CheckSum:         00015803
    ImageSize:        0000C000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
[/FONT]

Post back results.

 

[needfix]

Thanks for the reply!

I will post results when I have them ready. I am loaded with other work just now, but I removed "Advanced SystemCare 5" allready.

About the overclocking part, I'm not quite sure how to reset to stock speeds. My guess is they allready are at stock speeds, as I never have adjusted them manually, and as far as I know the auto-overclock features has never been in use. Can I just remove the software or do I need to make sure everything are at "stock speed" before I do so?

 

[koolkat77]

Can I just remove the software?

Yup

 

[koolkat77]

Any updates?