BSOD, IRQL_NOT_LESS_OR_EQUAL, error in tcpip.sys

Hello there:

Since the Windows 10 Creators fall update, I’ve been having daily BSODs, sometimes twice daily. I have updated my network drivers on seeing the fault lay with tcpip.sys (at least that is what I gathered when the screen goes blue).

   I have included the SysnativeFileCollectionApp.zip, the dump file from Windows\Minidump. Running Speccy gives this URL: http://speccy.piriform.com/results/nXXDEIWOoo0UCVix1QLbHyP

   I will run the tests in step 4 of the BSOD instruction page now.
   Thank you in advance for any light you can shed on this.

PS.: The error code is actually DRIVER_IRQL_NOT_LESS_OR_EQUAL. My apologies.

I have run Windmp on the dump file. This was the result:
 

Good news, it’s fixed after several days.

http://jackyan.com/blog/2017/12/solving-my-bsods-with-windows-10-creators-fall-update-its-not-the-usual-culprits/
 

The network adapter had to be updated personally, via the Realtek website, and not via Windows Update.

Edited by Jack Yan, 11 December 2017 - 06:42 AM.

Thought I had it licked, but it recurred. Here is the Windmp analysis in further detail.

Just another update. I have updated Java (despite being set to automatically update, it didn’t) and a remote-access program I use. Coincidentally, looking through the Event Viewer, the hackers were quiet yesterday, and the fact I had no BSODs for a 24-hour period cannot be a coincidence. I’ve blocked the IPs that were coming up using Windows Firewall (set up an incoming rule). I’ve also reported those IPs to abuseipdb.com, and a couple of them were notorious for DDOS and brute-force attacks. They were likely trying to find a way in here.

Hi,

Looks like you've made some significant changes to your system, thus can you run the Sysnative File Collection App again?

Thank you.

Hi Bleepin’ Owl, thank you, and of course. I’ll attach the Sysnative ZIP as soon as I remember how I did it the first time.

Further changes since my last post: the remote viewing program has been replaced altogether. I had a look in the Event Viewer and it does look like port exhaustion attacks from several parties on the original program I used. So far my computer has stayed up for the last eight hours without any BSODs.

One worry is that Windows 10 Creators fall appears to be more susceptible to falling over as a result of these attacks. Maybe there is something in its default settings—will investigate further.

Here is the Sysnative ZIP.

Hello,

Thank you. Unfortunately, you have some illegal Adobe software on your machine — you are deliberately blocking Adobe activation with your HOSTS file

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
...
127.0.0.1 adobe-dns-3.adobe.de
127.0.0.1 adobe-dns-4.adobe.com
127.0.0.1 adobe-dns-4.adobe.com
...
127.0.0.1 wwis-dubc1-vip52.adobe.com
127.0.0.1 wwis-dubc1-vip53.adobe.com
127.0.0.1 wwis-dubc1-vip54.adobe.com
127.0.0.1 wwis-dubc1-vip55.adobe.com
127.0.0.1 wwis-dubc1-vip56.adobe.com
127.0.0.1 wwis-dubc1-vip57.adobe.com
127.0.0.1 wwis-dubc1-vip58.adobe.com
127.0.0.1 wwis-dubc1-vip59.adobe.com
127.0.0.1 wwis-dubc1-vip60.adobe.com
...
127.0.0.1 www.adobeereg.com
127.0.0.1 www.hh-software.com
127.0.0.1 www.wip.adobe.com
127.0.0.1 www.wip1.adobe.com
...
127.0.0.1 lmlicenses.wip4.adobe.com
127.0.0.1 lm.licenses.adobe.com

Helping you would be a violation of the forum rules, so this will be my last reply to this topic unless you remove ALL illegal software and prove this by providing fresh log files.

There is only one BSOD dump in the older SFCA output; none in the newer one. I suspect CCleaner is the culprit as it automatically deletes dumps and other helpful info … can you stop using it? Anyway, that dump wasn't particularly helpful either … was running into symbol errors (which I am surprised you weren't!).

For now, I can only suggest you run Driver Verifier according to these instructions. Run if for 24 hours as instructed (that is, 24 hours when your computer is ON).

Regards,
bwv848

Edited by bwv848, 12 December 2017 - 11:30 AM.

Hi BWV848, thank you—I am a licensee but had difficulty getting one of the programs in the suite to work again after a crash, and someone suggested blocking those. Not a problem, I’ll remove those entries—this happened years ago and hopefully it won’t recur.

Okay, great! Go ahead and enable DV and after 24 hours (24 hours when you are actually using your computer) send a fresh SFCA ZIP file to me and I'll try to get as much info out of them (even without symbols) as possible.

Here is the dump file and I ran the Sysnative program again.

Edited by Jack Yan, 13 December 2017 - 03:43 AM.

Sorry about all the messages.

One of the entries in the Event Viewer is:

Installing printer driver Microsoft XPS Document Writer failed, error code 0x0, HRESULT 0x80070705. See the event user data for context information.

Another is:

The print spooler failed to regenerate the printer driver information for driver Microsoft XPS Document Writer for environment Windows x64. Win32 system error code 1797 (0x705). This can occur after an operating system upgrade or because of data loss on the hard drive.

I can get the BSOD consistently now if I try to add a printer from Devices and Printers.

I have tried removing the Microsoft XPS Document Writer but it reappears after a reboot, and those events are still present. Windows claims the device is working properly though (under properties).

I have a feeling this may point to the cause, especially with the regular BSODs I can create just by attempting to add a printer. I’ll report more as I tinker with this.