utorrent causing BSOD: Possible tcpip.sys irql problem?

[shadekh]

Hi,

I have been having these random "IRQL not less than or equal to" bluescreens on a fully patched vista ultimate 32 bit, 2 gb ram, core 2 duo e6600, nvidia geforce 8800 gts, marvell yukon onboard gigabit lan cards (on an asus p5b), whenever i run utorrent for any significant amount of time.

The dump is given below:

Start Dump:-

Microsoft ® Windows Debugger Version 6.9.0003.113 X86

Copyright © Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]

Kernel Complete Dump File: Full address space is available

Symbol search path is: C:\symbols

Executable search path is:

Windows Server 2008 Kernel Version 6001 (Service Pack 1) MP (2 procs) Free x86 compatible

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 6001.18145.x86fre.vistasp1_gdr.080917-1612

Kernel base = 0x82444000 PsLoadedModuleList = 0x8255bc70

Debug session time: Sun Dec 7 01:58:41.035 2008 (GMT+5)

System Uptime: 0 days 15:13:50.789

Loading Kernel Symbols

..........................................................................................................................

......................................................

Loading User Symbols

Loading unloaded module list

...............

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {1, 2, 0, a68754ed}

Probably caused by : tcpip.sys ( tcpip!TcpCleanupTcb+3b )

Followup: MachineOwner

---------

0: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

An attempt was made to access a pageable (or completely invalid) address at an

interrupt request level (IRQL) that is too high. This is usually

caused by drivers using improper addresses.

If kernel debugger is available get stack backtrace.

Arguments:

Arg1: 00000001, memory referenced

Arg2: 00000002, IRQL

Arg3: 00000000, value 0 = read operation, 1 = write operation

Arg4: a68754ed, address which referenced memory

Debugging Details:

------------------

READ_ADDRESS: 00000001

CURRENT_IRQL: 2

FAULTING_IP:

+ffffffffa68754ed

a68754ed ae scas byte ptr es:[edi]

DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

BUGCHECK_STR: 0xD1

PROCESS_NAME: System

TRAP_FRAME: 82539588 -- (.trap 0xffffffff82539588)

ErrCode = 00000000

eax=b1cd744b ebx=00000000 ecx=876de001 edx=c5910001 esi=883c1008 edi=00000001

eip=a68754ed esp=825395fc ebp=82539614 iopl=0 nv up ei ng nz ac pe cy

cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010297

a68754ed ae scas byte ptr es:[edi] es:0023:00000001=??

Resetting default scope

LAST_CONTROL_TRANSFER: from a68754ed to 8249ed24

STACK_TEXT:

82539588 a68754ed badb0d00 c5910001 8801ff60 nt!KiTrap0E+0x2ac

WARNING: Frame IP not in any known module. Following frames may be wrong.

825395f8 82530023 886bb158 00006774 00000000 0xa68754ed

82539614 886bb257 883c1134 00000000 82539634 nt!Ki386EnableGlobalPage+0x23

82539624 886ac62f 883c1008 883c1008 8253968c tcpip!TcpCleanupTcb+0x3b

82539634 886af5cf 883c1008 85788938 8873e850 tcpip!TcpDereferenceTcb+0x1c

8253968c 886aef1b 857888b8 013c1008 825396f0 tcpip!TcpTcbReceive+0x2af

825396e4 886aed14 857888b8 00000000 00000000 tcpip!TcpMatchReceive+0x1ec

8253972c 886af310 857888b8 85785000 85785004 tcpip!TcpPreValidatedReceive+0x2b0

82539748 886af913 857888b8 85785000 82539784 tcpip!TcpReceive+0x32

82539758 886d9fef 8253976c c000023e 00000000 tcpip!TcpNlClientReceiveDatagrams+0x12

82539784 886d9db2 88730e50 825397d8 c000023e tcpip!IppDeliverListToProtocol+0x49

825397a4 886d9cd9 88730c68 00000006 825397d8 tcpip!IppProcessDeliverList+0x2a

825397fc 886d94cc 88730c68 00000006 00000000 tcpip!IppReceiveHeaderBatch+0x1eb

8253988c 886d7fc6 87d248a8 00000000 82527401 tcpip!IpFlcReceivePackets+0xbe1

82539908 886d850e 8809d128 84dd7198 00000000 tcpip!FlpReceiveNonPreValidatedNetBufferListChain+0x6e3

82539930 833ac0b0 8809d128 84dd7198 00000000 tcpip!FlReceiveNetBufferListChain+0x104

82539964 8339e919 0076c008 84dd7198 00000000 ndis!ndisMIndicateNetBufferListsToOpen+0xab

8253998c 8339e890 00000000 82495645 864560e8 ndis!ndisIndicateSortedNetBufferLists+0x4a

82539b08 832e6123 864560e8 00000000 00000000 ndis!ndisMDispatchReceiveNetBufferLists+0x129

82539b44 832e6234 539b7400 82539bb8 82539c50 ndis!ndisDoPeriodicReceivesIndication+0x170

82539b68 824fac40 85678f98 00000000 3a12f9b0 ndis!ndisPeriodicReceivesTimer+0x48

82539c88 824fa800 82539cd0 864c5602 82539cd8 nt!KiTimerListExpire+0x367

82539ce8 824fa3c3 00000000 00000000 0035a193 nt!KiTimerExpiration+0x22a

82539d50 824f8edd 00000000 0000000e 00000000 nt!KiRetireDpcList+0xba

82539d54 00000000 0000000e 00000000 00000000 nt!KiIdleLoop+0x49

STACK_COMMAND: kb

FOLLOWUP_IP:

tcpip!TcpCleanupTcb+3b

886bb257 5e pop esi

SYMBOL_STACK_INDEX: 3

SYMBOL_NAME: tcpip!TcpCleanupTcb+3b

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: tcpip

IMAGE_NAME: tcpip.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 4812c4f1

FAILURE_BUCKET_ID: 0xD1_tcpip!TcpCleanupTcb+3b

BUCKET_ID: 0xD1_tcpip!TcpCleanupTcb+3b

Followup: MachineOwner

---------

-----------------------------------------------------------------

I have had it for quite a few months, have updated drivers and uninstalled/changed firewalls, av etc. It has to date never happened in front of me for some reason, only when the computer was idle (and no, i have no scheduled checks/scans apart from vista's typical ones) . I am aware that utorrent is a user mode program..and cannot cause bsod's, but the problem only occurs when i use it. Any tips/advice?

[DreadWingKnight]

Have you checked windows update for updates to your network card driver?

What internet security do you have installed?

[shadekh]

My card is an onboard marvell yukon card that has the latest updated drivers (which are basically the same as ..well, what it come with) and never gave me problems up until a few months ago. And i do not have any internet security suite, i rely on safe browsing practices and a router hardware firewall...i just replaced my Av from avg 7.5 to avira ....so...

[TheTorch]

I have BSODs in tcpip.sys with only uTorrent as well. Doesn't occur with other torrent clients.