TCPIP.SYS BSOD

[Seekermeister]

I've gotten a couple of these today, which are totally new to me. I suspect that the cause is that I have done some uninstall and reinstall of the firewall, AV and even a item called memguard, that Opera requested that I install for diagnostics purposes of a bug report that I sent them. Things started really going haywire with the browser, and after the last BSOD, just a couple of minutes ago, Opera lost all of the customizations that I had made to it. Which may be good, if the problem goes away.

However the BSOD was an 0x0D1 involving the TCPIP.SYS, which has me concerned that some damage was done to winsocks. I have a repair program for that, but the best that I recall, it said that it was for a last ditch effort at repairs, because it might do more harm than good.

I doubt that anyone can tell me anything definitive, but I won't know without asking.

 

[Markbnj]

Not sure if this helps, since it was for Windows 2000...

http://support.microsoft.com/kb/260956

Ah, here is the XP version...

http://support.microsoft.com/kb/906882

Lots of people have had this problem. Google "tcpip.sys 0x000000D1" to see what I mean.

 

[Seekermeister]

Thanks, that certainly appears to go to the heart of the problem. But I reinstalled Opera, hoping that would solve the problem, but it is too early to know one way or another. I'll bookmark this, just in case.

 

[Seekermeister]

Hmm, when I try to email MS for the hotfix, it takes me to a page speaking of product lifecycle, and that it has either ended, or will soon. However, when I go for XP, instead of MCE, it presents a page with contact options. Since MCE is essentially XP, how can it be expired for support? Even applying their timetables and using 2002 instead of 2005, it should still have mainstream support options until 2007, which I assume is not January 1. The article says that a person should wait until the next service pack, unless the problem is severe...and it is, but I can't wait until 2008 for it.

 

[Seekermeister]

I might be jumping the gun, but I think that I got lucky. reinstalling Opera had no effect on the problem, but it appears that CHKDSK /R did. I ran it last night, and it hasn't crashed it...knock on wood.

 

[Seekermeister]

Well, CHKDSK didn't fix it either. After reading some on this, I found that it apparently has something to do with an inappropriate loopback, such as my localhost proxy uses, so I've disabled it, and am keeping my fingers crossed.

 

[Seekermeister]

I just found where memguard.exe had added itself to the proxy's startup options window, where I had placed Opera. I also did a search for the file and found it in Windows/Prefetch, so I deleted it. I've reenabled the proxy, but I set Opera to not use it on 127.0.0.1. I have a hunch that this will do it.

 

[Seekermeister]

It was a bad hunch, the problem returned a few minutes ago. I ran SpyBot and Spy Sweeper, but neither found anything. So I ran Regedit, searching for memguard.exe, and it came up with several entries, which I deleted. Curiously, it came up with one which gave a user agent for TitanTV, which is a program guide that I use. The entry listed the proxy and Opera, but no mention of memguard, but since Regedit listed it, I deleted it. If somehow it was the culprit, it would answer the question of the randomness of the problem. I also noticed that when the problem occurs, that the monitor icons for the internet connection continue flickering back and forth, even though nothing is running that uses the internet. The only way that I can clear the problem, with a BSOD, is to reboot.

 

[xyyz]

i had something similar. it turned out to be faulty memory.

run memtest. see what you find.

 

[Smilin]

The kb articles mentioned both refer to an old version of TCPIP.sys. I'm betting if you have the latest udpates applied your TCPIP.sys version is already much higher.



Honestly that sounds like you've got some third party crap in there giving you trouble. You gotta try pretty hard to bugcheck tcpip.sys. Before you try the following I would suggest getting anything third party out of your stack. This includes firewalls or sniffers. Web Browsers wouldn't cause any problems normally.

Here are two huge sledgehammers you can take to the problem. The first is standard stuff. It rips out and replaces registry settings. I've not seen it fix things very often but it fits pretty well to this situation:

299357 How to reset Internet Protocol (TCP/IP) in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;299357

The second is some kung-fu you'll only find here This is how you uninstall/reinstall TCP/IP...

open nettcpip.inf in %winroot%\inf

Comment out the "Characteristics" line with a semicolon and then add the following in it's place:

Characteristics = 0x80

Once done bring up properties on your network connection. Install a protocol, use 'have disk' and point it to %winroot%\inf. Choose TCP/IP from the list. You'll now be returned to the properties screen but this time the Uninstall button for TCP/IP is not grayed out. Use it.