BSOD apparently caused by TCPIP.sys driver....

newbie12

Distinguished
Mar 24, 2011
83
0
18,640
Hi, running Windows XP x64 Pro here on my box and this happened a month or so ago - just haven't found the time to post the question as I was busy, now that I'm free just want you guys to verify this and any advice on preventing this happening in future.

Program used to read the mini dumps was whocrashed and here's the full report(ignore the kaspersky one as I've already posted on their forums and seeking help from there):


--------------------------------------------------------------------------------
Welcome to WhoCrashed (HOME EDITION) v 5.51
--------------------------------------------------------------------------------

This program checks for drivers which have been crashing your computer. If your computer has displayed a blue (or black) screen of death, suddenly rebooted or shut down then this program will help you find the root cause and possibly a solution.

Whenever a computer suddenly reboots without displaying any notice or blue (or black) screen of death, the first thing that is often thought about is a hardware failure. In reality, on Windows most crashes are caused by malfunctioning device drivers and kernel modules. In case of a kernel error, many computers do not show a blue screen unless they are configured for this. Instead these systems suddenly reboot without any notice.

This program will analyze your crash dumps with the single click of a button. It will tell you what drivers are likely to be responsible for crashing your computer. It will report a conclusion which offers suggestions on how to proceed in any situation while the analysis report will display internet links which will help you further troubleshoot any detected problems.

To obtain technical support visit www.resplendence.com/support

Click here to check if you have the latest version or if an update is available.

Just click the Analyze button for a comprehensible report ...



--------------------------------------------------------------------------------
Home Edition Notice
--------------------------------------------------------------------------------

This version of WhoCrashed is free for use at home only. If you would like to use this software at work or in a commercial environment you should get the professional edition of WhoCrashed which allows you to perform more thorough and detailed analysis. It also offers a range of additional features such as remote analysis on remote directories and remote computers on the network.

Click here for more information on the professional edition.
Click here to buy the the professional edition of WhoCrashed.


--------------------------------------------------------------------------------
System Information (local)
--------------------------------------------------------------------------------

Computer name: THE-BEAST
Windows version: Windows XP x64 Service Pack 2, 5.2, build: 3790
Windows dir: C:\WINDOWS
Hardware: ASUSTeK COMPUTER INC., RAMPAGE IV EXTREME
CPU: GenuineIntel Intel(R) Core(TM) i7-3970X CPU @ 3.50GHz Intel586, level: 6
12 logical processors, active mask: 4095
RAM: 68654759936 bytes total




--------------------------------------------------------------------------------
Crash Dump Analysis
--------------------------------------------------------------------------------

Crash dump directory: C:\WINDOWS\Minidump

Crash dumps are enabled on your computer.

On Sun 27/03/2016 2:17:03 AM GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\Mini032716-01.dmp
This was probably caused by the following module: kneps.sys (kneps+0xA87D)
Bugcheck code: 0xFC (0xFFFFF800011B84E0, 0x80000000011B8963, 0xFFFFFAD98A8F65A0, 0x0)
Error: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
file path: C:\WINDOWS\system32\drivers\kneps.sys
product: System Interceptors PDK
company: Kaspersky Lab ZAO
description: Network Processor [fre_wnet_x64]
Bug check description: This indicates that an attempt was made to execute non-executable memory.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. There is a possibility this problem was caused by a virus or other malware.
A third party driver was identified as the probable root cause of this system error. It is suggested you look for an update for the following driver: kneps.sys (Network Processor [fre_wnet_x64], Kaspersky Lab ZAO).
Google query: Kaspersky Lab ZAO ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY



On Fri 19/02/2016 10:23:45 AM GMT your computer crashed
crash dump file: C:\WINDOWS\Minidump\Mini021916-01.dmp
This was probably caused by the following module: tcpip.sys (tcpip+0x13A94)
Bugcheck code: 0xFC (0xFFFFF800011B84E0, 0x80000000011B8963, 0xFFFFFAD98A8F65A0, 0x0)
Error: ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY
file path: C:\WINDOWS\system32\drivers\tcpip.sys
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: TCP/IP Protocol Driver
Bug check description: This indicates that an attempt was made to execute non-executable memory.
This might be a case of memory corruption. More often memory corruption happens because of software errors in buggy drivers, not because of faulty RAM modules. There is a possibility this problem was caused by a virus or other malware.
The crash took place in a standard Microsoft module. Your system configuration may be incorrect. Possibly this problem is caused by another driver on your system that cannot be identified at this time.
Google query: Microsoft Corporation ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY





--------------------------------------------------------------------------------
Conclusion
--------------------------------------------------------------------------------

2 crash dumps have been found and analyzed. 2 third party drivers have been identified to be causing system crashes on your computer. It is strongly suggested that you check for updates for these drivers on their company websites. Click on the links below to search with Google for updates for these drivers:

tcpip.sys (TCP/IP Protocol Driver, Microsoft Corporation)
kneps.sys (Network Processor [fre_wnet_x64], Kaspersky Lab ZAO)

If no updates for these drivers are available, try searching with Google on the names of these drivers in combination with the errors that have been reported for these drivers. Include the brand and model name of your computer as well in the query. This often yields interesting results from discussions on the web by users who have been experiencing similar problems.


Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.

Oh yeah and here's the dump file so you can check it out yourself: [strike][I'll get back to you on this one when I log into an admin account as a standard user doesn't appear to have access nor have the ability to just copy and paste the dump files to desktop....][/strike] https://www.dropbox.com/s/72anmjyv8s8h81n/Mini021916-01.dmp?dl=0
 
First and most important. Stop using Windows XP. Go to Windows 7 or above. Much more stable. And most importantly it is moderately secure. And unlike Windows 10, Windows 7 doesn't spy on you (unless you get click happy while surfing)

Windows XP is crash prone. The 64bit version you are using is even more so.

64bit on XP is a total crap shoot. Drivers can and do fail for no obvious reason. The requirements to get a driver signed on XP was far easier, and so the quality level was lower. Plus almost no one used 64bit and so very little effort was put in to that by 3rd party developers.

In this case I suspect that your AV is the cause not the TCP driver. Kaspersky uses a filter driver which interacts with tcpip.sys and given the CRAP OS you are running expecting a modern program on a barely tested platform set up in the worst possible configuration. I'd say you should expect crashes, viruses, loss of personal info and so on. Also you need to disable the kaspersky NDIS 6 filter from your local area connection properties; this will make your PC even less secure but it might make it slightly more stable.

The other possibility is that you have a virus. XP is so ridiculously unsecured that you are prone to any and all virus out there. Perhaps you got one which detected XP and assumed 32bit and damaged your system in some unexpected way as a result.

The 3rd possibility (and least likely) is the driver. Given that the drivers say 'Microsoft' they are most certainly in box drivers (meaning included with the OS). So you can't re-install THOSE drivers unless you feel like doing a repair install of the OS. But if you use an add-on NIC and happen to still have the drivers for it, might be worth trying to re-install them.
 

newbie12

Distinguished
Mar 24, 2011
83
0
18,640


I'll do this when I can.



I have, this is a dual boot system; XP x64 Pro and 7 x64 Pro - sorry I failed to mention this....

What? Windows 10 spies on you??!! Didn't know that.... I only had win10 for a few months and just didn't like the overall feel of it(two control panels? Really half of the settings is via desktop control panel whilst the remaining half is in metro's system settings? A couple of bugs too, one where it takes forever to load to desktop after login and the other is the startmenu bug where it fails to load startmenu and have to do workarounds to get it working...other than those three complaints, I would have been fine with 10). So went back to 7...skipped 8/8.1 because that felt more targeted towards touchscreens and I don't have one(and yes I've played with 8 and 8.1 for just about a year)....plus I will most likely still use keyboard + mouse over touchscreen if I had one anyways.....


Oh well it was perfectly stable with my other XP builds....I didn't think this build would be any different....

mmmmmmh.... Well 64-bit XP was built from win2k3 x64 OS, rather than XP x86 and just adding bits and pieces to it so that it complies to x64 OS, so it should be just as stable as that server OS.... Hm, well I can see why the complaints, I have a Razer Ouroborus and Razer refused to make Synapse or even a standalone driver for XP 64-bit....so I'm left in the dust with that one...

I thought XP was the most stable and liked OS of MS.....is that not the reason why it's lasted the longest in OS history?

Well the modern program has support for XP 64-bit, otherwise I wouldn't have installed it..... I'll try that suggestion if I get another BSOD from that TCPIP.sys driver....

Impossible, I've scanned the system fully with KIS 2016, Malwarebytes Anti-Malware, SUPERAntiSpyware and Spybot Search and Desotry and it came clean a couple of months ago when I did it, I also haven't used the computer since then to until now when I felt like playing some games on my tower....

I thought 32-bit viruses can't affect 64-bit operating systems........so you're essentially safe until you get hit with one that's made for 64-bit OSs.....

Actually a testimonial on that: I had a 32-bit winXP build that was just bare, no virus/malware protection programs running, nothing - so no bloatware and such, just the bare OS + drivers and that's it(I believe I only had like 25 or so processes running, I also disabled some services and stuff to maximize performance as it was running on fairly old hardware)! It was also connected to the internet and was only meant to play the older games that wouldn't run on newer OSs. It also ran for a few years. Surprisingly, it didn't get hit with a virus/malware, or there was no symptoms that I could see of anyways....and if it did get hit with one, it's got nothing of value, just some save files that I may or may not try to recover and re-install OS. Done, fresh system ready to be infected! hahahaha



I don't think I use the generic MS drivers, I only use them if there is no proper dedicated ones from the hardware's manufacturer, or if there's a problem with it....

Nah, no addon NIC, just the onboard one which is enough for me. ☺