locked
BSOD at dress ntoskrnl.exe+7efc0 caused by driver tcpip.sys [Sony Vaio S, Windows 7 Home Basic] RRS feed

  • Question

  • Dump File 

    062618-20779-01.dmp
    Crash Time  6/26/2018 8:15
    Bug Check String  KMODE_EXCEPTION_NOT_HANDLED
    Bug Check Code  0x0000001e
    Parameter 1  ffffffff`c0000005
    Parameter 2  fffffa80`09dbb003
    Parameter 3  00000000`00000001
    Parameter 4  00000000`033151b0
    Caused By Driver  tcpip.sys
    Caused By Address  tcpip.sys+5c42e
    File Description  TCP/IP Driver
    Product Name  Microsoft® Windows® Operating System
    Company  Microsoft Corporation
    File Version  6.1.7600.16385 (win7_rtm.090713-1255)
    Processor  x64
    Crash Address  ntoskrnl.exe+7efc0
    Stack Address 1 
    Stack Address 2 
    Stack Address 3 
    Computer Name 
    Full Path  C:\Windows\Minidump\062618-20779-01.dmp
    Processors Count  4
    Major Version  15
    Minor Version  7601
    Dump File Size  283,632
    Dump File Time 6/26/2018 8:16


    Hi, I'm using Sony Vaio S with Windows 7 Home Basic and frequently experiencing BSOD, especially everytime I'm using Chrome, which really adversely affects my work. Please help me to figure out a solution for this problem!

    Here's the Minidump and logs file folder:

    ONEDRIVE LINK [KMODE_EXCEPTION_NOT_HANDLED + PAGE_FAULT_IN_NONPAGED_AREA]

    https://1drv.ms/f/s!Asu1AVWeXD-YbHhKYU1Tx3kmx0Y

    DROPBOX LINK:

    KMODE_EXCEPTION_NOT_HANDLED files:

    https://www.dropbox.com/s/gkj0dfq7bjvy9zq/htbp-MEMORY.rar?dl=0

    https://www.dropbox.com/s/4yrzfni5assqauz/htbp-Logs%20and%20minidump.rar?dl=0

    PAGE_FAULT_IN_NONPAGED_AREA files:

    https://www.dropbox.com/s/mqc087jpi15oag6/bsod-pagefault.rar?dl=0






    • Edited by htbp Wednesday, June 27, 2018 9:49 AM
    Tuesday, June 26, 2018 2:07 AM

Answers

  • Hi,

    According to the memory dump you provided, it is probably caused by : ntkrnlmp.exe

    A device driver attempting to corrupt the system has been caught.  This is because the driver was specified in the registry as being suspect (by the administrator) and the kernel has enabled substantial checking of this driver.

    If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will be among the most commonly seen crashes.

    TCPIP.sys is a networking component. Your fix will involve updating your network driver. This can be your wired ethernet driver on your motherboard, it can be a bluetooth driver, or a wireless ethernet driver.

    Often you have to update the BIOS version, update the USB chipset drivers for 3.0 add on chipset. The driver could be download from the official website of the manufacturer.

    Also please disable the security software to check. Then reset TCP/IP by using the command below.

    netsh int ip reset

    Hope it will be helpful to you


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Wednesday, June 27, 2018 9:57 AM
  • Please remove everything piracy related on your system.

    Any software programs or any means to use unlicensed software.

    It is unknown what can come along with this software or tools.

    This type of software could allow potentially unwanted software programs on the system and who knows what they'll do.  

    The memory dump did not appear to be in its usual form and could not be opened.

    Separating files/folders by the bugcheck is not necessary.

    After the above steps, rerun the administrative command prompt and post:

    a zip

    dxdiag

    memory.dmp > zip > post a separate one drive or drop box share link for each memory.dmp






    Wednesday, June 27, 2018 8:42 PM

All replies

  • Hi htbp.

    The value "ffffffff`c0000005" of the BCP1 parameter indicates that a memory access violation occurred; tcpip.sys is the Microsoft Windows TCP/IP driver.
    Does the issue happen only when using Google Chrome or did you notice it under other circumstances too?

    Bye.


    Luigi Bruno
    MCP, MCTS, MOS, MTA

    Tuesday, June 26, 2018 5:25 PM
  • 1) To evaluate the BSOD please post logs for troubleshooting.

    2) Using administrative command prompt copy and paste this whole command.

    3) Make sure the default language is English so that the logs can be scanned and read.

    https://www.tenforums.com/tutorials/3813-language-add-remove-change-windows-10-a.html

    4) The command will automatically collect the computer files and place them on the desktop.

    5) Then use one 7zip and one drive or drop box to place share links into the thread for troubleshooting.

    https://support.office.com/en-us/article/Share-OneDrive-files-and-folders-9fcc2f7d-de0c-4cec-93b0-a82024800c07

    6) This command will automatically collect these files:  msinfo32, mini dumps, drivers, hosts, install, uninstall, services, startup, event viewer files, etc.

    7) Open administrative command prompt and copy and paste the whole command:

    copy %SystemRoot%\minidump\*.dmp "%USERPROFILE%\Desktop\"&dxdiag /t %Temp%\dxdiag.txt&copy %Temp%\dxdiag.txt "%USERPROFILE%\Desktop\SFdebugFiles\"&type %SystemRoot%\System32\drivers\etc\hosts >> "%USERPROFILE%\Desktop\hosts.txt"&systeminfo > "%USERPROFILE%\Desktop\systeminfo.txt"&driverquery /v > "%USERPROFILE%\Desktop\drivers.txt" &msinfo32 /nfo "%USERPROFILE%\Desktop\msinfo32.nfo"&wevtutil qe System /f:text > "%USERPROFILE%\Desktop\eventlog.txt"&reg export HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall "%USERPROFILE%\Desktop\uninstall.txt"&reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components" "%USERPROFILE%\Desktop\installed.txt"&net start > "%USERPROFILE%\Desktop\services.txt"&REM wmic startup list full /format:htable >"%USERPROFILE%\Desktop\startup.html"&wmic STARTUP GET Caption, Command, User >"%USERPROFILE%\Desktop\startup.txt"

    8) There are two files for you to find manually: 

    a) C:\Windows\MEMORY.DMP

    Use file explorer > this PC > local C: drive > right upper corner search enter each of the above to find results.

    b) Dxdiag:  In the left lower corner search type:  dxdiag > When the DirectX Diagnostic Tool opens click on the next page button so that each tab is opened > click on save all information > save to desktop > post one drive or drop box share link into the thread

    .

    .

    .

    Please remember to vote and to mark the replies as answers if they help.

    .

    .

    .


    • Marked as answer by htbp Thursday, June 28, 2018 1:13 AM
    • Unmarked as answer by htbp Thursday, June 28, 2018 1:15 AM
    Tuesday, June 26, 2018 5:37 PM
  • Hi, many thanks for your attention. It can happen anytime, not only when using chrome (it’s just that after I start chrome then the bsod 100% will occur), sometimes I let my laptop there and do nothing, the bsod still appears! I updated the logs, minidump and memory files above. Please take a look!

    I've encountered 2 types of BSOD so far: Page Fault in Non Paged Area or KMODE_EXCEPTION_NOT_HANDLED. 



    • Edited by htbp Wednesday, June 27, 2018 6:59 AM
    Wednesday, June 27, 2018 6:30 AM
  • Hi, many thanks for your attention and specific instructions! Here’re all the logs, minidump and memory files you required. Please take a look at them. I’m looking forward to hearing from you. Many thanks!

    I've encountered 2 types of BSOD so far: PAGE_FAULT_IN_NONPAGED_AREA or KMODE_EXCEPTION_NOT_HANDLED. 

    ONEDRIVE LINK [KMODE_EXCEPTION_NOT_HANDLED + PAGE_FAULT_IN_NONPAGED_AREA]

    https://1drv.ms/f/s!Asu1AVWeXD-YbHhKYU1Tx3kmx0Y

    DROPBOX LINK:

    KMODE_EXCEPTION_NOT_HANDLED files:

    https://www.dropbox.com/s/gkj0dfq7bjvy9zq/htbp-MEMORY.rar?dl=0

    https://www.dropbox.com/s/4yrzfni5assqauz/htbp-Logs%20and%20minidump.rar?dl=0

    PAGE_FAULT_IN_NONPAGED_AREA files:

    https://www.dropbox.com/s/mqc087jpi15oag6/bsod-pagefault.rar?dl=0

    P/s: and sure, I'll definitely not forget about the marking and voting comments!



    • Edited by htbp Wednesday, June 27, 2018 9:49 AM
    Wednesday, June 27, 2018 6:33 AM
  • Hi,

    According to the memory dump you provided, it is probably caused by : ntkrnlmp.exe

    A device driver attempting to corrupt the system has been caught.  This is because the driver was specified in the registry as being suspect (by the administrator) and the kernel has enabled substantial checking of this driver.

    If the driver attempts to corrupt the system, bugchecks 0xC4, 0xC1 and 0xA will be among the most commonly seen crashes.

    TCPIP.sys is a networking component. Your fix will involve updating your network driver. This can be your wired ethernet driver on your motherboard, it can be a bluetooth driver, or a wireless ethernet driver.

    Often you have to update the BIOS version, update the USB chipset drivers for 3.0 add on chipset. The driver could be download from the official website of the manufacturer.

    Also please disable the security software to check. Then reset TCP/IP by using the command below.

    netsh int ip reset

    Hope it will be helpful to you


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Wednesday, June 27, 2018 9:57 AM
  • Please remove everything piracy related on your system.

    Any software programs or any means to use unlicensed software.

    It is unknown what can come along with this software or tools.

    This type of software could allow potentially unwanted software programs on the system and who knows what they'll do.  

    The memory dump did not appear to be in its usual form and could not be opened.

    Separating files/folders by the bugcheck is not necessary.

    After the above steps, rerun the administrative command prompt and post:

    a zip

    dxdiag

    memory.dmp > zip > post a separate one drive or drop box share link for each memory.dmp






    Wednesday, June 27, 2018 8:42 PM
  • Ok, so I disabled the services of the cracked software Nitro PDF (especially the NitroUpdateService, it's listed as Unknown in Manufacturer column). And I haven't experienced any BSOD yet ... at least so far ... 

    Thanks Carl Fan & questionsformicrosoftproducts :D 

    Tuesday, July 3, 2018 3:36 AM
  • That's great news.

    If there are no BSOD for approximately one week of typical computer use then consider the problem fixed.

    Let us know if you need any help in the future.

    Tuesday, July 3, 2018 3:52 AM
  • Hi, many thanks for your attention. It can happen anytime, not only when using chrome (it’s just that after I start chrome then the bsod 100% will occur), sometimes I let my laptop there and do nothing, the bsod still appears! I updated the logs, minidump and memory files above. Please take a look!

    I've encountered 2 types of BSOD so far: Page Fault in Non Paged Area or KMODE_EXCEPTION_NOT_HANDLED. 



    Could you please share the dump files related to these two new errors?

    Bye.


    Luigi Bruno
    MCP, MCTS, MOS, MTA

    Wednesday, August 29, 2018 10:06 AM