Author Topic: HowTo repair/replace tcpip.sys ? (Read 55364 times)

Curt · « **on:** May 01, 2010, 04:46 PM »

I am sick and tired of all the blue screens I have been getting for that last quarter of a year due to my version of tcpip.sys. So naturally I want to repair or replace the thing. The first problem is that I don't have an installation-CD, so I will be needing a copy of "your" file, please! 32-bits Vista.

Another problem is of course that I don't know how to do it.

As far as I can understand, I will further more also need to replace/overwrite some kind of a copy in some "DLL-cache"? The post saying so was about XP; the given address for the DLL-cache does not exist on my Vista.

I need help on this, please.

I am using Outpost Security Suite.

Hidden system file on Vista @ C:\Windows\System32\drivers\tcpip.sys

mwb1100 · « **Reply #1 on:** May 01, 2010, 10:43 PM »

I don't think it's a good idea generally to try to replace a core driver like tcpip.sys on your own - it should be updated as part of an update package or Service Pack.

If you look at this list of versions of tcpip.sys:

- http://www.mskbfiles.com/tcpip.sys.php

you'll see that there are many versions that have been released after the one you have (6.0.6001.18377). Note that the ones with a version starting 6.1 are for Windows 7. I think that the ones starting with 6.0.6002 are for SP2 or updates to SP2. So if you're still on SP1 and don't want to move to SP2, you might want to look at the hotfix for KB979223 which has a very recent SP1 version of tcpip.sys (6.0.6001.22659):

- http://support.micro...79223&kbln=en-us

Note that it's a hotfix, which is not as well supported/tested by Microsoft as service packs or updates that get pushed down with Windows Update. So before trying the hotfix, you might want to make sure you have all available updates from Windows Update, or you might want to consider installing SP2.

Dirhael · « **Reply #2 on:** May 01, 2010, 11:24 PM »

You could also try running the following command in a console as admin: sfc /scanfile=c:\windows\System32\drivers\tcpip.sys

It'll check the integrity of the file and repair if needed.

Curt · « **Reply #3 on:** May 02, 2010, 02:40 AM »

"sfc": "no errors"

Thanks anyway.

Yesterday I updated Vista, so I'll wait and see if is feeling any better now.

Innuendo · « **Reply #4 on:** May 02, 2010, 10:30 AM »

I am sick and tired of all the blue screens I have been getting for that last quarter of a year due to my version of tcpip.sys. So naturally I want to repair or replace the thing. The first problem is that I don't have an installation-CD, so I will be needing a copy of "your" file, please! 32-bits Vista.
-Curt (May 01, 2010, 04:46 PM)

Wow. I haven't heard of anyone having to replace tcpip.sys since Windows 95. Usually if you are someone who gets errors like that it can be traced back to bad network card drivers that happen to bomb out and take out tcpip.sys with them & that's what the blue screen shows.

What kind of network card are you running over there, Curt? Some network chipsets have gawd-awful drivers.

In any case, to change a system file like that you would have to do it from Safe Mode & replace both the version in the Windows directory & in the cache before rebooting back into normal mode. But again....no one has had to do this since Windows 95 and the early days of Windows 98 First Edition.

Curt · « **Reply #5 on:** May 02, 2010, 04:02 PM »

@Innuendo
Search "tcpip.sys", and think differently; it was still a well known problem on XP.

Carol Haynes · « **Reply #6 on:** May 02, 2010, 05:36 PM »

SFC should do the job - if it doesn't the problem probably lies elsewhere. Try SFC /SCANNOW with no further paramters to check the integrity of all of the Windows files.

If you want to find another copy of any DLL it is worth looking in the dllcache folder as well as the latest SP installation files.

A third approach you can try is to roll back to the previous SP and then reinstall the latest SP - that should update the file to the latest version. You will need to apply any updates again that were released after the SP.

Innuendo · « **Reply #7 on:** May 03, 2010, 07:18 AM »

Search "tcpip.sys", and think differently; it was still a well known problem on XP.
-Curt (May 02, 2010, 04:02 PM)

I'll take your word for it, but this is the first I'm hearing about it & I've serviced a crap-load of XP systems over the years & never once has one had this problem you are describing.

I'd love to be able to catalog all these systems with this problem & see what the common elements between them were.

I honestly thought the tcpip.sys problem had gone the way of the dodo bird.

Curt · « **Reply #8 on:** May 03, 2010, 08:22 AM »

First, merely some boring quotes (sorry!):

Windows XP SP2 tcpip.sys connection limit patch

Windws XP SP2 introduces a few new twists to TCP/IP in order to babysit users and "reduce the threat" of worms spreading fast without control. In one such attempt, the devs seem to have limited the number of possible TCP connection attempts per second to 10 (from unlimited in SP1). This argumentative feature can possibly affect server and P2P programs that need to open many outbound connections at the same time.
-SpeedGuide, 2004

When faced with the tcpip.sys blue screen error, all of a sudden, your screen freezes and the blue screen display a message which says your screen has frozen. You will be faced with quite a few questions on if any new programs or hard ware have been installed recently. You will also find DLL errors. What Causes tcpip.sys blue screen? Tcpip.Sys Blue Screen can be caused by a lot of reasons, but an invalid and corrupted registry entry is one of the most common causes for this problem. ...
(this post was really merely an advert for some registry cleaner, but shows the problem still was known less than five weeks ago...)
-March 29, 2010

Modify your tcpip.sys file manually, using a hex editor. The following instructions refer to the final release of XP SP2, with a tcpip.sys file of exactly 359,040 bytes, CRC-32 is 8042A9FB, and MD5 is 9F4B36614A0FC234525BA224957DE55C. Even thouh there might be multiple tcpip.sys files in your system, make sure to work with the one in c:\windows\system32\drives\ directory.

To remove the tcpip.sys socket creation limit:
- Backup your original tcpip.sys file before editing please, this is somewhat important !
- In your hex editor, go to offset 4F322 hex (or 324386 decimal).
- Change 0a 00 00 00 to 00 00 0a 00

All done ! The above change does not require editing of the CRC in offset 130 hex
http://www.speedguid...articles.php?id=1497
-March 2006

APPLIES TO:
   * Microsoft Windows 2000 Server
   * Microsoft Windows 2000 Advanced Server
   * Microsoft Windows 2000 Professional Edition

When a TCP/IP network connection is programmatically disassociated or removed when a receive operation is in progress, your computer may stop responding (hang) and display the following error message on a blue screen:

STOP: 0x000000D1 (0xFF8BA000,0x00000002,0x00000001,0xF3AAA40E)
DRIVER_IRQL_NOT_LESS_OR_EQUAL

RESOLUTION:
To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
260910 (http://support.micro...com/kb/260910/EN-US/ )

STATUS:
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

This problem was first corrected in Windows 2000 Service Pack 1.
http://support.microsoft.com/kb/260956
-March 2007

Microsoft updated TPCIP.SYS in today's (14 June 2006) release of Windows XP critical updates resulting in the half open connections limit being reset to 10. Anyone who has increased their half open connections limit with the LvlLord patch needs to re-patch after installing today's Windows XP updates.
http://forum.utorren...ewtopic.php?id=10872
-June 2006

MAYBE I got something from a program that hasn't been properly updated for Vista?
-or something.

---
My Blue Screen error message:

DRIVER_IRQL_NOT_LESS_OR_EQUAL
STOP: 0x000000D1 (0x0000020, 0x00000002, 0,00000000, 0x8BA8565F)
tcpip.sys - Address 8BA8565F base at 8BA03000, Datestamp 4b1e9050

Eóin · « **Reply #9 on:** May 03, 2010, 08:49 AM »

You can use Replacer for easing the job of the actual replacement.

Curt · « **Reply #10 on:** May 03, 2010, 09:49 AM »

Thanks, Eóin

I already have a copy of Damian666's Replacer Evolutions 1.4 from 25-2-2008.
But 1) I don't know for sure what to replace tcpip.sys with. My version seems to be the newest, but will an even newer version also fit my Vista version and setup? And 2) I cannot figure out where to find the DLL-cached version, which must be removed/deleted at the same time - as far I can understand. And I don't know how or precisely when to do it. And 3) I am scared stiff to do it all the wrong way...

For XP SP2 one could merely download and run a patch, but I cannot find such an easy solution for Vista.

Curt · « **Reply #11 on:** May 14, 2010, 05:29 AM »

The problems with tcpip was becoming a several-times-a-day experience when I accidentally was saved by a weird "coincidence": In order to gain a little more free memory for my CPU, I clicked "adjust Windows to best performance" (disabling the nice glass effects, and other well-looking features; all with no connection to the Internet) and went back to the sad Win 95 Look - and for ten days now I have not had a single accident with tcpip.sys!

My imagination cannot quite cope with this, because I see no reason why tcpip.sys ever should be affected by the look of Explorer??!!??

Stoic Joker · « **Reply #12 on:** May 14, 2010, 06:46 AM »

Just out of curiosity, have you tried a different NIC and/or NIC driver?

While DRIVER_IRQL_NOT_LESS_OR_EQUAL is a driver issue I can't help but thing that tcpip.sys is getting caught in the crossfire of something happening elsewhere.

daddydave · « **Reply #13 on:** May 14, 2010, 07:02 AM »

I am using Outpost Security Suite.
-Curt (May 01, 2010, 04:46 PM)

Is this the common factor in all your problems?

Seriously, I'm wondering if there was something else you were going to say because this statement seems to stand alone and I'm too dense to understand how it relates to this issue. Did Outpost give you any additional information regarding tcpip.sys?

Curt · « **Reply #14 on:** May 14, 2010, 08:16 AM »

I am using Outpost Security Suite.
-Curt (May 01, 2010, 04:46 PM)
Is this the common factor in all your problems?
-daddydave (May 14, 2010, 07:02 AM)

-no, I believe the common factor is situated 40 inches in front of the monitor...

Yes, Oupost may indeed be the problem, but I cannot find my key to OnlineArmor++. In fact I am beginning to think I only purchased it in my dreams!

AndyM · « **Reply #15 on:** May 14, 2010, 12:41 PM »

I believe the common factor is situated 40 inches in front of the monitor...
-Curt (May 14, 2010, 08:16 AM)

Curt · « **Reply #16 on:** May 14, 2010, 12:59 PM »

---

.. when I accidentally was saved ... - and for ten days now I have not had a single accident with tcpip.sys!
-Curt (May 14, 2010, 05:29 AM)

Nemesis and Psyche joined hands and came with a vengeanc...eh, with a Blue Screen.

But on the bright side, I have found my key for Online Armor++. Only, back "then" we were given trials, and that seems not to be the procedure any more. I wrote their support a couple of hours ago, to mail me a download link, but I guess they are busy.

Innuendo · « **Reply #17 on:** May 14, 2010, 05:30 PM »

Yes, Oupost may indeed be the problem...
-Curt (May 14, 2010, 08:16 AM)

Outpost is definitely not your problem, my friend. I run it over here all day every day with no tcpip.sys weirdness.

Wait till you see v7...I'm a beta tester & v7 really takes things to the next level in protection/prevention.

Curt · « **Reply #18 on:** May 14, 2010, 07:26 PM »

Yes, Outpost may indeed be the problem...
-Curt (May 14, 2010, 08:16 AM)
Outpost is definitely not your problem,
-Innuendo (May 14, 2010, 05:30 PM)

My Vista is unstable and is probably causing Outpost to misconduct. All the Blue Screens were in the beginning followed by a Send_Error_Report_To_Agnitum, by Outpost. I unchecked the option because it was getting tiring not to get any reaction from Agnitum (not that I expected any, but one can tired of procedures that will never trigger a response).

I have been using Outpost since version 2.5, and I have a lifetime license; so I (too) am looking forward to version 7.

------------
Online Armor has not yet answered my email, and now I guess it is week-end...

40hz · « **Reply #19 on:** May 14, 2010, 07:29 PM »

+1 w/ StoicJoker

I'm 99% positive it's a device driver causing the problem. If your NIC and modem drivers are up to date then also check your devices and see if there's an address or interrupt conflict.

From my experience, that error usually gets caused (in order of likelyhood) by:

Faulty or damaged drivers (90% of the time - and not just the ones you'd suspect. Loopy video drivers can also cause system wide oddball problems that go beyond video issues. The fact you got and improvement by cutting back on screen candy makes me wonder if this might be happening with your machine.)

Faulty hardware (usually intermittent)

Security software compatibility issues (varies by type and brand)
Faulty RAM module (very rare)

Luck!

Curt · « **Reply #20 on:** May 14, 2010, 07:54 PM »

-oh yes, I forgot to answer StoicJoker's post. Sorry! The reason of course being that I have no idea what either of you guys are talking about! "NIC"... = "network interface card"?? Hardware, software? Inboard, outboard?

To update drivers is nothing that I enjoy. My Driver Magician 3.45 may be good, I don't know, but it is not all-knowing enough for me to merely mark every driver and Go. Would drivers class "Network Adapters" be a natural place to begin?

Stoic Joker · « **Reply #21 on:** May 14, 2010, 09:41 PM »

@40hz - I think we just found the answer...

@Curt - I'm generally not a fan of the automated driver "Wizards" but if you're comfortable with it that's okay.

Yes, Network Adapters is a good place to start, Just make sure you're updating the right adapter - some machines have more than one (laptops), and sometimes FireWire can/will show up as a "Network" Adapter (Damn-If-I-Know-Why) ... so ignore anything with 1394 in it.

Also, not sure if it wasn't mentioned, or I missed it, but is this a desktop, laptop, Off-The-Shelf branded, or white box machine? Is the NIC built into the MotherBoard (e.g. OnBoard) or a PCI add-in card?

Innuendo · « **Reply #22 on:** May 15, 2010, 03:46 PM »

I'm 99% positive it's a device driver causing the problem. If your NIC and modem drivers are up to date then also check your devices and see if there's an address or interrupt conflict.
-40hz (May 14, 2010, 07:29 PM)

Which goes back to my original diagnosis that tcpip.sys almost never the culprit even if the blue screen specifically mentions it. The problem can almost always be traced back to something trying to access tcpip.sys in an inappropriate manner.

@Curt - Go to Device Manager and see what it says under Network Adapters. The brand/chipset name of the driver and the version # it's using is always the easist place to look.

(Early Realtek network drivers were gawd-awful & caused crashes like the one you're having all the time.)

Curt · « **Reply #23 on:** May 19, 2010, 11:31 AM »

thanks a lot for all the inputs.

The problems went away when I removed Outpost and installed Online Armor++ I hope!

However, when I think back on the various blue screens, or more correctly when I think at what happened the seconds before the blue screens, I think I remember that at least 3 out of 4 times, I was just about to enter some homepage. Well, today I was changing the settings inside AnVir Task Manager Pro, and the following words that I never read or understood before suddenly made new sense to me:

This will explain why Outpost was able to cause problems; it was checking all traffic and each and every homepage I was visiting. AnVir knew all along that such a feature can cause errors! Now you and I can finally know it, too.

--------
Edited:
TEST: Can ABBYY Screenshot Reader tell the text from my picture?:

Enable Internet traffic monitoring. (May cause errors in network driver tcpip.sys).
-ABBYY paste

Yes!

daddydave · « **Reply #24 on:** May 19, 2010, 11:52 AM »

Well, today I was changing the settings inside AnVir Task Manager Pro, and the following words that I never read or understood before suddenly made new sense to me:
(see attachment in previous post)
This will explain why Outpost was able to cause problems; it was checking all traffic and each and every homepage I was visiting. AnVir knew all along that such a feature can cause errors!
-Curt (May 19, 2010, 11:31 AM)

Wow. Thanks for the update.