tcpip.sys: Windows' TCP/IP Driver on a Blue Screen

Why a blue screen names tcpip.sys

• A device driver or system service installed shortly before the first crash: Microsoft's usual cause for IRQL_NOT_LESS_OR_EQUAL.
• The network adapter's driver, which sits directly below tcpip.sys.
• A virus scanner: Microsoft lists antivirus software among the causes of the memory stop codes and says to disable it as a test.
• Microsoft's analysis of the root causes of crashes: 70% third-party driver code, 10% hardware, 5% Microsoft code and 15% unknown.

What to do when a blue screen names tcpip.sys

The steps come from Microsoft's guidance, with the reversible ones first. Each one says how to put back what it changed. If Windows cannot start normally, Microsoft's basic steps say to start in safe mode and continue from there.

1. 01

   Write down the stop code and the file the screen names

   Microsoft Support says the stop code appears at the bottom of the screen and, when Windows knows it, so does the name of the module that was running. If the screen went by too fast, the command under Check it yourself lists the stop codes Windows recorded, and Event Viewer > Windows Logs > System shows the errors logged around the restart.

   To undo: Nothing to undo: this only reads information.

2. 02

   Before you change anything: note the driver and make a restore point

   Open the device's Properties > Driver tab and write down the driver provider, date and version. Then select Start, type Create a restore point, open it, and on the System Protection tab choose Create. Microsoft notes that System Protection is not turned on by default; if Create is greyed out, choose Configure and turn it on for the system drive first.

   To undo: A restore point changes nothing by itself. To go back later, run System Restore and pick it: Microsoft says it reverts system files, the registry and installed programs, and leaves your personal files alone.

3. 03

   Update the network adapter's driver

   In Device Manager, open Network adapters, right-click your Wi-Fi or Ethernet adapter and choose Update driver, or install the current driver from the adapter or PC maker's support page for your exact model.

   To undo: Open the device's Properties > Driver tab in Device Manager and choose Roll Back Driver, or apply the restore point.

4. 04

   If it started after a driver update, roll the driver back

   In Device Manager, right-click the device, choose Properties, open the Driver tab and select Roll Back Driver, then give a reason and confirm. Microsoft notes that you need administrator rights, and that going back to the previous driver often fixes a problem that appeared after an update. The button is greyed out when Windows kept no earlier driver for the device.

   To undo: Rolling back is the undo for the update. To return to the newer driver, install it again with Update driver or from the manufacturer's package.

5. 05

   Take out what you added just before it started

   Microsoft's first basic step for a stop code that keeps coming back is to remove new hardware: shut the PC down, disconnect the device and start again. Its bug check pages say the same about drivers and system services added recently: remove or update them, and work out what changed just before the first crash.

   To undo: Reconnect the hardware, or install the program or driver again.

6. 06

   Turn off the virus scanner as a test

   Microsoft's step for this cause: disable the program and see whether the error stops. If it does, contact its maker about an update.

   To undo: Turn the protection back on straight after the test; do not leave the PC without it.

7. 07

   Install the latest Windows updates

   Select Start > Settings > Windows Update and choose Check for updates. It is one of Microsoft's basic steps for a stop code that keeps returning, and it is how new versions of Windows' own drivers arrive.

   To undo: If the crashes get worse after an update, apply the restore point from the earlier step.

8. 08

   Check Windows' own files

   tcpip.sys is part of Windows, so there is no separate download for it. Open Command Prompt as administrator and run DISM.exe /Online /Cleanup-image /Restorehealth, then sfc /scannow. Microsoft says to run DISM first, and that sfc scans all protected system files and replaces corrupted ones with a cached copy.

   To undo: No undo is needed: the tools only put back Microsoft's version of a damaged Windows file.

Check it yourself

1. 01

   See whether a driver on your PC is running from this file (PowerShell)

   Shows the driver service that loads the file, whether it is running and its exact path. No output means no driver service on your PC points at this file. Nothing is changed.

   Get-CimInstance Win32_SystemDriver | Where-Object PathName -like '*\tcpip.sys' |
     Format-List Name, State, StartMode, PathName

   PowerShellCopy
2. 02

   Read the company and version from the file itself

   Every copy on the PC is listed, including copies waiting in the driver store.

   Get-ChildItem C:\Windows\System32\drivers, C:\Windows\System32\DriverStore\FileRepository -Recurse -Filter tcpip.sys -ErrorAction SilentlyContinue |
     ForEach-Object { $_.VersionInfo } | Format-List FileName, CompanyName, FileDescription, FileVersion

   PowerShellCopy
3. 03

   Check the signature

   Status should be Valid. The table above shows who signed the file on the test PC.

   Get-ChildItem C:\Windows\System32\drivers, C:\Windows\System32\DriverStore\FileRepository -Recurse -Filter tcpip.sys -ErrorAction SilentlyContinue |
     Get-AuthenticodeSignature | Format-List Path, Status, SignerCertificate

   PowerShellCopy