tcpip.sys Driver_IRQL_NOT_LESS_OR_EQUAL blue screen error


  • I have an HP Pavilion dv7 Notebook PC; 64-bit, Windows 7; Intel Core i7 CPU Q720@1.60GHz

    I am regularly getting blue screen DRIVER_IRQL_NOT_LESS_OR_EQUAL with tcpip.sys mention.  Please see Minidump.zips here:

    I tried to open/view these dmp files, but I am unable.  Any idea what might be causing this issue?

    Recent software updates: Pentaho PDI (Kettle ETL), PC Tools Spyware/Antivirus/Firewall, WinSCP, ToirtoiseSVN, regular Windows updates, HP Wireless Printer (drivers)

    Wednesday, January 25, 2012 5:02 PM

All replies

  • With it being the same file each time, check to make sure it is the proper Microsoft version.  The file and product version from a fully updated Windows 7 Enterprise SP1 64bit is 6.1.7601.17697.



    Wednesday, January 25, 2012 5:28 PM
  • Thank you, Darien, for the quick response.

    You mention to check that "it is the proper Microsoft version."  What do you refer to as "it"?  I am not sure what to check or how to check it.


    Wednesday, January 25, 2012 6:57 PM
  • Navigate to c:\windows\system32\drivers.  Right-click the TCPIP.SYS file and look at the details tab.  The image below shows one from the Windows 8 DevPreview.  The version you want to see is 6.1.7601.17697.


    Wednesday, January 25, 2012 8:57 PM
  • Looks like I have the correct/latest file version: 6.1.7601.17697

    Any other ideas/recommendations?


    Wednesday, January 25, 2012 9:11 PM
  • Interesting.  Being it is always the same file, I would assume a corrupt driver--which it still may be.  Nonetheless, one thing we will want to rule out is bad memory.  A lot of BSODs can be traced to bad memory sticks.

    Windows 7 has a built-in rudimentary memory checker.

    Boot with a Windows 7 DVD.  At the first screen, hit <SHIFT>+<F10>.  You will see that you are at x:\Sources>.  CD into Recovery (cd recovery).  Type RecEnv.exe, click Next.  Select the top radio button that reads, "Use recovery tools . . . ."  Select Windows Memory Diagnostic and chose the restart now option.  

    However, for a more thorough check, head over to and download the latest version.  Burn the ISO to a disk or make a bootable USB drive.  Boot and follow the on-screen instructions.


    A not-so-nice screen of failed memory.

    • Marked as answer by Miya YaoModerator Friday, February 03, 2012 2:46 AM
    • Unmarked as answer by slivey Tuesday, February 14, 2012 12:13 AM
    Thursday, January 26, 2012 12:04 AM
  • My computer passed 100% on the Memory Test - no memory failing.

    What should I try next? Is there an easy way to read/interpret the minidump files?


    • Edited by slivey Tuesday, February 14, 2012 12:14 AM
    Monday, February 06, 2012 2:54 PM
  • This problem continues to persist. Every 1-2 days, I crash with the same error. I have verified it is not a memory issue. But I do not know what to check next. Can anyone point me in the right direction? What should I try next?
    Thursday, February 16, 2012 5:52 PM
  • *******************************************************************************
    *                                                                             *
    *                        Bugcheck Analysis                                    *
    *                                                                             *

    An attempt was made to access a pageable (or completely invalid) address at an
    interrupt request level (IRQL) that is too high.  This is usually
    caused by drivers using improper addresses.
    If kernel debugger is available get stack backtrace.
    Arg1: 000000000000001c, memory referenced
    Arg2: 0000000000000002, IRQL
    Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
    Arg4: fffff88001cae87e, address which referenced memory

    Debugging Details:

    Unable to load image pctNdis64.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for pctNdis64.sys
    *** ERROR: Module load completed but symbols could not be loaded for pctNdis64.sys
    Unable to load image NETwNs64.sys, Win32 error 0n2
    *** WARNING: Unable to verify timestamp for NETwNs64.sys
    *** ERROR: Module load completed but symbols could not be loaded for NETwNs64.sys

    WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80003112100


    fffff880`01cae87e f083401c01      lock add dword ptr [rax+1Ch],1




    PROCESS_NAME:  System

    TRAP_FRAME:  fffff8800358aaa0 -- (.trap 0xfffff8800358aaa0)
    NOTE: The trap frame does not contain all registers.
    Some register values may be zeroed or incorrect.
    rax=0000000000000000 rbx=0000000000000000 rcx=fffffa80111e0aa0
    rdx=fffffa80111e0b58 rsi=0000000000000000 rdi=0000000000000000
    rip=fffff88001cae87e rsp=fffff8800358ac30 rbp=fffff8800358ad40
     r8=fffffa80111e0a90  r9=fffffa80111e0aa0 r10=fffffa80111e09d0
    r11=fffff8800358ae20 r12=0000000000000000 r13=0000000000000000
    r14=0000000000000000 r15=0000000000000000
    iopl=0         nv up ei pl nz na pe nc
    fffff880`01cae87e f083401c01      lock add dword ptr [rax+1Ch],1 ds:0002:00000000`0000001c=????????
    Resetting default scope

    LAST_CONTROL_TRANSFER:  from fffff80002edf1e9 to fffff80002edfc40

    fffff880`0358a958 fffff800`02edf1e9 : 00000000`0000000a 00000000`0000001c 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
    fffff880`0358a960 fffff800`02edde60 : fffff880`0358ab40 fffffa80`0a7df5d0 fffffa80`0d03aa10 00000000`00000001 : nt!KiBugCheckDispatch+0x69
    fffff880`0358aaa0 fffff880`01cae87e : 00000000`00000001 fffffa80`157dd4e0 fffffa80`00000000 fffffa80`111e0b58 : nt!KiPageFault+0x260
    fffff880`0358ac30 fffff880`01cb2b29 : ffff0000`02834cde ffff0000`02834cee fffffa80`16470000 00000000`00000001 : tcpip!TcpBeginTcbSend+0x33e
    fffff880`0358aeb0 fffff880`01cced66 : 00000000`00000000 fffffa80`157dd401 fffff880`01dbe128 00000000`00000000 : tcpip!TcpTcbSend+0x1d9
    fffff880`0358b130 fffff880`01cae325 : fffff880`06c3f000 00000000`00000000 00000000`00000000 fffff880`0358b400 : tcpip!TcpFlushDelay+0x316
    fffff880`0358b210 fffff880`01ca51c7 : fffffa80`07c70980 fffffa80`07dc29c1 fffffa80`00008b00 00000000`00008b00 : tcpip!TcpPreValidatedReceive+0x3e5
    fffff880`0358b2e0 fffff880`01ca4d3a : 00000000`00000000 fffff880`01dc49a0 fffff880`0358b4a0 fffffa80`1377d990 : tcpip!IppDeliverListToProtocol+0x97
    fffff880`0358b3a0 fffff880`01ca4339 : fffff880`01dc49a0 fffffa80`148e1900 fffff880`0358b4a0 fffff880`0358b490 : tcpip!IppProcessDeliverList+0x5a
    fffff880`0358b440 fffff880`01ca20af : 00000000`ff01a8c0 fffffa80`07d9e000 fffff880`01dc49a0 00000000`11088701 : tcpip!IppReceiveHeaderBatch+0x23a
    fffff880`0358b520 fffff880`01ca16a2 : fffffa80`15d542c0 00000000`00000000 fffffa80`11088701 fffffa80`00000001 : tcpip!IpFlcReceivePackets+0x64f
    fffff880`0358b720 fffff880`01ca0b3a : fffffa80`11088700 fffff880`0358b850 fffffa80`11088700 fffff880`10010000 : tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x2b2
    fffff880`0358b800 fffff800`02eec618 : fffffa80`148e1880 00000000`00004800 fffff880`0356f0c0 00000000`00000000 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0xda
    fffff880`0358b850 fffff880`01ca1202 : fffff880`01ca0a60 fffff880`01dc0000 fffff880`0358b902 00000000`00000000 : nt!KeExpandKernelStackAndCalloutEx+0xd8
    fffff880`0358b930 fffff880`01b460eb : fffffa80`0c1268d0 00000000`00000000 fffffa80`0aafe1a0 fffffa80`0aafe1a0 : tcpip!FlReceiveNetBufferListChain+0xb2
    fffff880`0358b9a0 fffff880`01b0fad6 : fffff880`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ndis!ndisMIndicateNetBufferListsToOpen+0xdb
    fffff880`0358ba10 fffff880`01a919c4 : fffffa80`0aafe1a0 00000000`00000002 00000000`00000001 00000000`00000000 : ndis!ndisMDispatchReceiveNetBufferLists+0x1d6
    fffff880`0358be90 fffff880`01b46bb5 : 00000000`00000001 fffffa80`00000000 fffffa80`0aafe1a0 00000000`00000000 : ndis!ndisMTopReceiveNetBufferLists+0x24
    fffff880`0358bed0 fffff880`00c99c5e : fffffa80`138d4b00 fffffa80`0ac000c0 fffff880`00000001 00000000`00000001 : ndis!ndisMIndicatePacketsToNetBufferLists+0x105
    fffff880`0358bf70 fffffa80`138d4b00 : fffffa80`0ac000c0 fffff880`00000001 00000000`00000001 fffffa80`1208a8d0 : pctNdis64+0xcc5e
    fffff880`0358bf78 fffffa80`0ac000c0 : fffff880`00000001 00000000`00000001 fffffa80`1208a8d0 fffff880`01b4fafc : 0xfffffa80`138d4b00
    fffff880`0358bf80 fffff880`00000001 : 00000000`00000001 fffffa80`1208a8d0 fffff880`01b4fafc fffff880`00000000 : 0xfffffa80`0ac000c0
    fffff880`0358bf88 00000000`00000001 : fffffa80`1208a8d0 fffff880`01b4fafc fffff880`00000000 fffffa80`138d4ba0 : 0xfffff880`00000001
    fffff880`0358bf90 fffffa80`1208a8d0 : fffff880`01b4fafc fffff880`00000000 fffffa80`138d4ba0 fffffa80`1208a010 : 0x1
    fffff880`0358bf98 fffff880`01b4fafc : fffff880`00000000 fffffa80`138d4ba0 fffffa80`1208a010 fffffa80`1667dcb0 : 0xfffffa80`1208a8d0
    fffff880`0358bfa0 fffff880`01b0fbfb : fffffa80`0a9ed1a0 fffff880`0358c3b0 00000000`00000001 00000000`00000000 : ndis! ?? ::DELBPBOK::`string'+0x404
    fffff880`0358c070 fffff880`01a919c4 : fffffa80`0a9ed1a0 fffffa80`0c46d000 00000000`00000001 fffffa80`0c46d030 : ndis!ndisMDispatchReceiveNetBufferLists+0x2fb
    fffff880`0358c4f0 fffff880`01a91939 : 00000000`00000000 00000000`00000000 fffffa80`0c0da020 00000000`00000001 : ndis!ndisMTopReceiveNetBufferLists+0x24
    fffff880`0358c530 fffff880`01a918d0 : fffff880`04d6b5c0 fffffa80`0be9f010 fffffa80`0c0da020 00000000`00000001 : ndis!ndisFilterIndicateReceiveNetBufferLists+0x29
    fffff880`0358c570 fffff880`04d347ee : fffffa80`0be9f010 00000000`00000000 fffffa80`0c46d030 fffff880`04d6b5c0 : ndis!NdisFIndicateReceiveNetBufferLists+0x50
    fffff880`0358c5b0 fffff880`01a91939 : fffffa80`0b1e6080 00000000`00000000 00000000`00000001 fffffa80`0ab7ead0 : nwifi!Pt6Receive+0x296
    fffff880`0358c610 fffff880`01a918d0 : 00000000`00000001 fffff880`045f00bc fffffa80`0b4d0328 fffff880`05c8840f : ndis!ndisFilterIndicateReceiveNetBufferLists+0x29
    fffff880`0358c650 fffff880`045ec9c0 : fffff880`045f3110 00000000`00000001 00000000`00000001 fffffa80`0b4d0d78 : ndis!NdisFIndicateReceiveNetBufferLists+0x50
    fffff880`0358c690 fffff880`01aaa4f7 : fffffa80`0a9ed1a0 fffffa80`0c6b5630 fffffa80`0c6b5630 00000000`00000001 : vwififlt!FilterReceiveNetBufferLists+0x158
    fffff880`0358c6f0 fffff880`05c7ccdf : fffffa80`0ab69010 00000000`00000001 fffffa80`0c6b5630 00000000`00000001 : ndis! ?? ::FNODOBFM::`string'+0xcf1f
    fffff880`0358c740 fffffa80`0ab69010 : 00000000`00000001 fffffa80`0c6b5630 00000000`00000001 fffff880`00000001 : NETwNs64+0xccdf
    fffff880`0358c748 00000000`00000001 : fffffa80`0c6b5630 00000000`00000001 fffff880`00000001 00000000`0000001a : 0xfffffa80`0ab69010
    fffff880`0358c750 fffffa80`0c6b5630 : 00000000`00000001 fffff880`00000001 00000000`0000001a fffffa80`00000001 : 0x1
    fffff880`0358c758 00000000`00000001 : fffff880`00000001 00000000`0000001a fffffa80`00000001 fffffa80`0aa93870 : 0xfffffa80`0c6b5630
    fffff880`0358c760 fffff880`00000001 : 00000000`0000001a fffffa80`00000001 fffffa80`0aa93870 fffffa80`1254b638 : 0x1
    fffff880`0358c768 00000000`0000001a : fffffa80`00000001 fffffa80`0aa93870 fffffa80`1254b638 fffffa80`1254b520 : 0xfffff880`00000001
    fffff880`0358c770 fffffa80`00000001 : fffffa80`0aa93870 fffffa80`1254b638 fffffa80`1254b520 00000000`00000000 : 0x1a
    fffff880`0358c778 fffffa80`0aa93870 : fffffa80`1254b638 fffffa80`1254b520 00000000`00000000 fffff880`05e65a08 : 0xfffffa80`00000001
    fffff880`0358c780 fffffa80`1254b638 : fffffa80`1254b520 00000000`00000000 fffff880`05e65a08 fffffa80`0c6b5630 : 0xfffffa80`0aa93870
    fffff880`0358c788 fffffa80`1254b520 : 00000000`00000000 fffff880`05e65a08 fffffa80`0c6b5630 00000000`00000001 : 0xfffffa80`1254b638
    fffff880`0358c790 00000000`00000000 : fffff880`05e65a08 fffffa80`0c6b5630 00000000`00000001 00000000`00000000 : 0xfffffa80`1254b520


    fffff880`00c99c5e ??              ???


    SYMBOL_NAME:  pctNdis64+cc5e

    FOLLOWUP_NAME:  MachineOwner

    MODULE_NAME: pctNdis64

    IMAGE_NAME:  pctNdis64.sys


    FAILURE_BUCKET_ID:  X64_0xD1_pctNdis64+cc5e

    BUCKET_ID:  X64_0xD1_pctNdis64+cc5e

    Followup: MachineOwner

    2: kd> lmvm pctNdis64
    start             end                 module name
    fffff880`00c8d000 fffff880`00ca3000   pctNdis64 T (no symbols)           
        Loaded symbol image file: pctNdis64.sys
        Image path: pctNdis64.sys
        Image name: pctNdis64.sys
        Timestamp:        Wed Jul 07 22:37:30 2010 (4C34F39A)
        CheckSum:         0001D422
        ImageSize:        00016000
        Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4


    Bug Check Code 0xD1:

    Your BSOD was caused by pctNdis64.sys driver. Please update it and check results. If this does not help then disable all security softwares you have and check results.

    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.   

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Microsoft Certified Trainer

    • Edited by Mr XMVP Monday, February 20, 2012 7:44 AM missing link
    Saturday, February 18, 2012 11:45 AM
  • Mr X said: "Uninstall PC Tools Internet Security" ;)
    Sunday, February 19, 2012 12:26 AM
  • Hey, can U help me i gain BSOD and i have no idea what to do....
    Wednesday, June 18, 2014 5:31 PM