Windows Vista tcpip.sys Connection Limit Patch for Event ID 4226

Apparently in Windows Vista, Microsoft still enforce and hard-limit (hard coded in tcpip.sys) the maximum simultaneous half-open (incomplete) outbound TCP connection attempts per second that the system can make, as in Windows XP SP2, in order to protect the system from being used by malicious programs, such as viruses and worms, to spread to uninfected computers, or to launch distributed denial of service attack (DDoS). When the limit is hit, in Event Viewer, there will be such an entry:

EventID 4226: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts

Unless Windows XP SP2 which has 10 maximum incomplete concurrent connection attempts limit per second, Windows Vista default limit is based on which edition of Vista users are using. For example, Home Basic has maximum limit of 2, and Vista Ultimate is 25 per second. Normal Windows Vista users should not face any problem or slow network connection with the half-open connections limit. However, heavy P2P (peer-to-peer) applications users such as uTorrent, BitTorrent, BitComet, Azureus, ABC, eMule (eDonkey network), etc, or P2PTV such as TVants, PPLive, PPStream, Sopcast, etc may face some error or slow download and upload speed due to this limit.

Due to enhanced security, to fix or crack the TCP concurrent connection limit in Vista is not as easy as in Windows XP. To remove maximum concurrent half-open connection limits in Windows Vista, apply the patched tcpip.sys with the following steps:

  1. Download patched tcpip.sys: Vista TCP/IP and UAC Auto Patcher (patched tcpip.sys is contained inside the archive) 64-bit tcpip.sys or 32-bit tcpip.sys. Alternative download link for 32-bit and 64-bit.
  2. Open command prompt, and run the following 2 commands:

    1. takeown /f c:\windows\system32\drivers\tcpip.sys
    2. cacls c:\windows\system32\drivers\tcpip.sys /G “username”:F

    Replace username with the actual user name that used to log on to Windows Vista currently.

    The second command can also used improved lcacls:

    icacls c:\Windows\System32\drivers\tcpip.sys /grant “username”:f

  3. Disable the TCP/IP Auto-Tuning feature by running the following command in command prompt:

    netsh int tcp set global autotuninglevel=disable

  4. For 64-bit Windows Vista (x64), the integrity checks need to be disabled as it need all drivers to be signed. So run the following command in DOS prompt:

    bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS

    Note: Above command no longer supported, and users require to press F8 on system startup to bypass driver signing integrity check.

  5. Replace the tcpip.sys in C:\windows\system32\drivers folder with the patched tcpip.sys downloaded from step 1 (remember the use the correct x64 or x86 version). Normally, this procedure can be done by simply login to Windows Vista with administrator account. However, if the process failed, reboot the computer and then press F8 to boot up in Safe Mode, and then copy and paste overwrite the tcpip.sys.
  6. Next, the maximum number of TCP half complete connection limits need to be set in registry. Open registry editor (regedit), and navigate to the following registry key:

    HKEY_LOCALL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

  7. Right click on the right pane, select “New”, then select “DWORD value”. Enter the new value name as “TcpNumConnections” (without quotes).
  8. Double click on TcpNumConnections registry value, and modify the value data to the desired maximum TCP/IP connection limit that you want to allow, in decimal value. For example, enter 500 as the value data for TcpNumConnections. You can use any limit that you prefer. Alternatively, download this registry registration file (another download link) that when executed, will set the TCP simultaneous connection limit to 16777214 (you can always modify the value in the file or in the registry after applied).
  9. Restart computer.

New: Windows Vista Event ID 4226 Auto Patcher

Latest Version: 2.0

Windows Vista Event ID 4226 Auto Patcher has been renamed as Vista tcpip.sys and UAC Auto Patcher, which now has 6 versions of auto patcher download links for different versions of tcpip.sys with the release of various hotfixes and SP1. Visit here for details.

Driver Version: CrackTcpip.sys for Vista SP1 v.668 - a non-patching method to bypass TCP connection limit.

Gui Version: VistaTcpPath TCP Auto Patcher which works for Vista RTM (non-SP1) version of tcpip.sys.

Old Version:

Version 1.0
Version 1.2
Version 1.3
Version 1.4
Version 1.5

With thanks to YaronMaor for batch script.

The TCP connection limit which trigger Event ID 4226 has now increased to 500 (or any other value you set), and will likely fix the error for re-occurring again.

MDL blog postings now continue at Tip and Trick, and readers are welcome to join My Digital Life Forums.


284 Responses to “Windows Vista tcpip.sys Connection Limit Patch for Event ID 4226”

  1. Windows XP SP2 TCP Connection Limit (Event ID 4226) » My Digital Life
    April 9th, 2007 03:32
    1

    [...] Update: TCP/IP simultaneous connection limit patch for Windows Vista [...]

  2. Justin
    April 9th, 2007 13:59
    2

    I keep getting a message in Vista saying that I need to get permission to replace that file. I have tried everything I could think of. I am listed as an administrator and I have tried Safe Mode. How can I unlock the ability to change permissions in Vista so I can do this? I think it is the reason I have been having trouble with my Azuarus. Thanks.

  3. admin
    April 9th, 2007 14:54
    3

    Justin, have you try open command prompt in elevated mode?

  4. YaronMaor
    April 9th, 2007 15:00
    4

    Hi,

    Many thanks to this great guide.
    you can create a small batch file to have an auto-patch installation. just create a text file using notepad, called InstallPatch.bat
    and paste the following text:

    REM ————————————–

    REM this patch will remove Vista’s tcpip concurrent connection limit.
    REM this limit produces the 4226 event in the System event viewer.

    takeown /f c:\Windows\System32\drivers\tcpip.sys
    echo *** Enter Y (yes) to the following question… ***
    echo.
    cacls c:\Windows\System32\drivers\tcpip.sys /g “%username%”:f
    netsh int tcp set global autotuninglevel=disable
    copy tcpip.sys C:\windows\system32\drivers /y
    reg import Vista_TCPIP_limit_16777214.reg
    echo.
    echo *** Please RESTART your computer!! ***
    pause

    REM ————————————–

    Note! the downloaded files (sys+reg) should be in the same folder as the batch file- uncompressed!.

    Cheers,

    YaronM

  5. Limite massimo delle connessioni TCP/IP, diverso per ogni edizione. Rimuoviamolo ! » PuntoDiVista - Il più grande blog monotematico su Windows Vista
    April 9th, 2007 16:53
    5

    [...] Mydigitallife.info, per chi vuole cimentarsi in questa mod pesante: Windows Vista tcpip.sys Connection Limit Patch for Event ID 4226 [...]

  6. Ernst
    April 9th, 2007 21:19
    6

    Any chance someone could mirror the files? It’s not easy wading through the ads & popups of depositfiles.com

    Great article, I’ve been waiting for this since Vista x64 came out

  7. Optimize Vista for BitTorrent, eMule, P2PTV | TorrentFreak
    April 10th, 2007 01:05
    7

    [...] 25 half-open connections per second, the Home Basic version offers just 2, but thanks to this great tutorial a solution is now [...]

  8. YaronMaor
    April 10th, 2007 02:54
    8

    Hi,

    You can also download a copy of the patched driver including the Install batch file from my site: http://www.yaronmaor.net/repair.htm

    Cheers,
    YaronM

  9. TheSleeper
    April 10th, 2007 03:52
    9

    YaronMaor, thanks for your install.bat file !!

    this is very useful !!

    I will forward this to my freinds and colleagues who are using vista

  10. YaronMaor
    April 10th, 2007 04:18
    10

    I’ve updated the InstallPatch batch file to easily support the two 32/64 versions.

    I recommend you to download this package from:
    http://www.yaronmaor.net/repair.htm
    it appears as #2 “EventID4226Fix for Vista”

    Cheers,
    YaronM

  11. Chris
    April 10th, 2007 11:21
    11

    How do I revert back to default because my internet keeps crashing and I want to revert back to default but I don’t know how.Please help

  12. admin
    April 10th, 2007 11:41
    12

    If you keep the original tcpip.sys simply replace it back.

  13. Chris
    April 10th, 2007 12:00
    13

    Haha, which means I have to get the tcpip.sys file from another laptop because I didn;t keep the original one.But thanks for the help, and do I have to delete the registry enty and enable back auto tuning?

  14. admin
    April 10th, 2007 12:04
    14

    Hi sorry about that. Coz you shouldn’t face this problem I believe.

  15. admin
    April 10th, 2007 13:09
    15

    Hi Chris, you can try reinstalling your internet explorer. Feedback from Justin Weberg.

  16. Chris
    April 10th, 2007 22:27
    16

    I have installed back the original tcpip.sys file and I shall inform back on whether it works or not. just in case, I have enabled again auto tuning and deleted the registry entry. Thanks for the feedback though. Much appreciated.

  17. Jug
    April 11th, 2007 21:19
    17

    “may face some error or slow download and upload speed due to this limit”

    This is largely a well spread myth. While the error may occur once every hour or so due to an unusual flood of new connections, it’ll just queue the connections, so nothing is dropped, and no bandwidth is lost. There is no hard limit to connections an unpatched system enforce; you’ll get exactly as many as you should have before. It’s just that new connections might be made slightly slower when they happen in rare bursts.

    So, what I’m saying is that the net effect of an unpatched system may be that you’re e.g. up and running in full speed in something like 30 seconds instead of 15 on a patched one. But the end result is identical.

    This can easily be checked on an “unpatched” system too. I have no trouble getting up to, and maintaining, up/downloads at over 500 Kbps over here, and how this limit kicks in is also unrelated to your connection speed, and only the rate of new connections being made.

    Many modern P2P clients also feature a built-in setting nowadays for maximum connections.

  18. freedomfighter
    April 11th, 2007 22:26
    18

    Does this work with XP x64 SP2? I haven’t found a working patch for this problem yet, but I don’t want to get major problems experimenting and have to reformat (like I’ve heard others having to do)

  19. GiGi
    April 11th, 2007 23:06
    19

    @Jug “This is largely a well spread myth.”

    Obviously you are talking about something you read somewhere on the internet because this limit DOES slow down p2p applications and although some applications have settings for it the program will always perform better without the limit and with normal settings. I agree that eventually all connections will come true but with shareaza for instance while downloading 3 torrents and a few edonkey files the whole download process is coming to a hold without such a patch.

  20. wootness
    April 12th, 2007 17:58
    20

    Check out my website.
    It’s really strange, classifying your patch as an evil virus. Woot?

    http://fileinfo.prevx.com/fileinfo.asp?PXC=02f088128917

  21. levy
    April 15th, 2007 23:21
    21

    10xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

  22. Optimaliser Vista for BitTorrent, eMule, P2PTV
    April 17th, 2007 03:04
    22

    [...] grensen er kun to tilkoblinger. , the Home Basic version offers just 2, but thanks to this great tutorial a solution is now [...]

  23. Emanuele
    April 18th, 2007 04:13
    23

    Great trick!!!! I’ve used it also on XP. But I always haved a doubt. How many half-connections are recommended to open? I’ve just open 100 half-connections. Thanks.

  24. Wex
    April 19th, 2007 07:45
    24

    It works for a short while, then I can’t open any websites of download anything, or just at a very low speed, just like described in the “Disable TCP Auto-Tuning” Article. What’s wrong? I have tunned it off.

  25. Web
    April 19th, 2007 16:13
    25

    Hi,

    Thanks for the patch, but it needs one little change:

    my vista is installed on my F: Partition, at first it didn’t work for me until i noticed this mistake.

    you should replace “c:\windows” with “%Systemroot%” in the batch files ;P.

  26. YaronMaor
    April 19th, 2007 19:19
    26

    Hi,

    I’ve updated the vista patch to include:
    a) Uninstaller (undo changes to originals)
    b) update destination path to %systemroot%

    Download it from http://www.yaronmaor.net under the Repair section.

    Cheers,
    YaronM

  27. admin
    April 19th, 2007 22:09
    27

    Thanks web, will update it soon.

  28. Bryan
    April 20th, 2007 11:36
    28

    Mine tells me the system file is not found when I was trying to do a Bit-32 patch.

  29. admin
    April 20th, 2007 12:20
    29

    Hi Bryan, do you have more error details? Like screenshot?

  30. YaronMaor
    April 20th, 2007 12:24
    30

    Hi,

    Sorry, I’ve had a path mistake..
    get the updated version from:
    http://www.yaronmaor.net under the Repair section.

    Cheers,
    YaronM

  31. Jules Winnfield
    April 20th, 2007 12:36
    31

    Autotuning command should be “netsh int tcp set global autotuninglevel=normal” in UndoPatch.bat, not “netsh int tcp set global autotuninglevel=enable”.

  32. admin
    April 20th, 2007 12:47
    32

    Thanks to YaronMaor, Bryan and Jules, has corrected the errors.

  33. Bryan
    April 20th, 2007 19:04
    33

    Alright thank you. Will try again :)

  34. Wex
    April 21st, 2007 07:48
    34

    I am facing an wired problem:
    After I applied the patch, it will first work fine after reboot, then in a while any out connection can’t establish, for example, browser won’t open new sites, p2p connected peers and clients drops to 1 or 0. But some sort of connection remains usable, for example ICQ, MSN, what’s wrong with this? Can anybody help? Thank you.
    PS: I want to know what changes have been made to the TCPIP.SYS what’s the new HARD-CODED connection limits?

  35. Roby
    April 21st, 2007 18:02
    35

    Hi.. I’m trying to install this patch but it can’t copy the tcpip.sys to system32 even if I execute it as the administrator.. I tried also the f8 way but it has the same problem even in safe mode.. What can I do?

  36. Ero
    April 22nd, 2007 03:19
    36

    Hi I ran the patch as administrator and got this half success, half error:

    Confirm to apply? (Press Ctrl-C and answer Y to terminate)
    Press any key to continue . . .

    SUCCESS: The file (or folder): “C:\Windows\System32\drivers\tcpip.sys” now owned
    by user “X2\Ero”.
    Are you sure (Y/N)?Ok.

    1 file(s) copied.

    Original tcpip.sys driver has been renamed to “tcpip.original” in its original folder.

    The system cannot find the file specified.
    ERROR: Error opening the file. There may be a disk or file system error.

    *** Patch installation is complete. Please RESTART computer!!

    Press any key to continue . . .

    Is the patch applied or did it error like it said in the first part?

  37. Roby
    April 22nd, 2007 06:39
    37

    I had the same error Ero has..

  38. Jules Winnfield
    April 22nd, 2007 07:17
    38

    It says above that one of the steps involved in applying the TCP patch is to disable the autotuning service.

    Is it necessary to do this and will the patch still work with it enabled?

  39. Wex
    April 22nd, 2007 19:40
    39

    It might because of the WinPcap, that caused my situation.

  40. Wex
    April 23rd, 2007 10:37
    40

    And the patched file won’t work with ICS, very unstable.

  41. Windows Vista tcpip.sys Connection Limit Patch at Caschys Blog
    April 24th, 2007 00:53
    41

    [...] englischsprachige Infos nebst Download bei MyDigitalLife. Verwandte Blogeintraege: Thundersave / Firesave unter Windows Vista (0 [...]

  42. The CTRAN weblog » Blog Archive » Windows Vista tcpip.sys Connection Limit Patch for Event ID 4226
    April 24th, 2007 04:31
    42

    [...] Windows Vista tcpip.sys Connection Limit Patch for Event ID 4226 » My Digital Life: Apparently in Windows Vista, Microsoft still enforce and hard-limit (hard coded in tcpip.sys) the maximum simultaneous half-open (incomplete) outbound TCP connection attempts per second that the system can make, as in Windows XP SP2, in order to protect the system from being used by malicious programs, such as viruses and worms, to spread to uninfected computers, or to launch distributed denial of service attack (DDoS). When the limit is hit, in Event Viewer, there will be such an entry: EventID 4226: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts [...]

  43. Lenmaer
    April 25th, 2007 03:17
    43

    The manual one works great, but I cannot say that for the auto patcher.

  44. rafael
    April 26th, 2007 00:08
    44

    i couldnt copy the file in the windows folder… It says i dont have permission, even in safe mode.
    How do i copy the file??

  45. AnonymousOne
    April 27th, 2007 03:06
    45

    Error message on Longhorn (vista server 64) build 6001

    Auto Patcher batch script by http://www.yaronmaor.net

    for 64-bit version of Windows Vista

    Confirm to apply? (Press Ctrl-C and answer Y to terminate)
    Press any key to continue . . .
    ERROR: The system cannot find the path specified.
    Are you sure (Y/N)?Ok.

    ‘bcdedit.exe’ is not recognized as an internal or external command,
    operable program or batch file.
    The system cannot find the path specified.

    Original tcpip.sys driver has been renamed to “tcpip.original” in its original f
    older.

    The system cannot find the path specified.
    0 file(s) copied.
    The operation completed successfully.

    *** Patch installation is complete. Please RESTART your computer!! ***

    Press any key to continue . . .

  46. YaronMaor
    April 27th, 2007 05:52
    46

    Hello All,

    Sorry for the delay.
    I’ve released an updated v1.4 of the Patcher.
    it resolves the permission issue some of you mentioned in trying to copy the tcpip.sys file.
    I haven’t yet tested it on a 64bit version but it should act the same. I’m also not sure it is supported on a Longhorn Server Beta due to changes in folder locations and command-line syntax. if anyone of you have any feedback, feel free to contact me: info at yaronmaor.net
    Download v1.4 from: http://www.yaronmaor.net

    Cheers,
    YaronM

  47. zaknaf
    April 28th, 2007 03:11
    47

    Hi,

    The new version (1.4) works perfectly on my 64bit Vista (I was getting the permission denied error before)

    Thanks a lot YaronMaor

  48. Mad world » Blog Archive » Fix Vista’s TCP limit
    April 29th, 2007 18:46
    48

    [...] Mirror og mere info: My Digital Life [...]

  49. Workaround to Run eMule in Windows Vista » My Digital Life
    April 30th, 2007 15:13
    49

    [...] half open connections” from 50 to any value between 1 to 9. Alternatively, download the tcpip.sys patch for Vista to unlock the [...]

  50. frin’s brlog » Blog Archive » Vista TCPIP connection limit
    April 30th, 2007 23:07
    50

    [...] id 4226) so I decided to get rid of this limit here as well. I found a site that has a solution (click here). Useful is the auto patcher where you only need to run InstallPatch32 (or 64 if you have 64-bit [...]

  51. Lösung zum EventID 4226 Problem unter Vista - Seite 2 - 00de Forum
    May 1st, 2007 19:21
    51

    [...] nochmal, wer sich die ganze Sache einfacher machen will -> LINK [...]

  52. Sivashanker
    May 1st, 2007 23:02
    52

    Hi everone. I seem to have a problem with the autopatcher. P2PNETSH.DLL cannot be found. How do I fix this error. Thanks.

  53. Lösung zum EventID 4226 Problem unter Vista - Seite 2 - 00de Forum
    May 2nd, 2007 16:18
    53

    [...] 13:21 Hallo nochmal, wer sich die ganze Sache einfacher machen will -> LINK [...]

  54. For Vista users, how to kill Vista's 10 concurrent half open connection limitations - TechEnclave
    May 3rd, 2007 17:50
    54

    [...] for Vista users. removes the in-built concurrent half-open TCP limitations, especially for BTing: Windows Vista tcpip.sys Connection Limit Patch for Event ID 4226

  55. Rick
    May 8th, 2007 03:34
    55

    I tried v1.5 on Vista, and the batch got as far as the reg import command where it failed to go any further, insisting that either there was a problem with the disk or the filename was bad (it was correct).

    Is there a permissions issue with “reg import” for an admin-level user with UAC? Perhaps the batch needs to be elevated with “Run as administrator”

    Note: I merged the .REG file manually without incident.

  56. Rick
    May 15th, 2007 12:16
    56

    I set mine to a more reasonable 5000, but uTorrent still triggers several 4226’s — even though uTorrent is only set for 80 half-open connections. Something’s not quite right about this, since 5000 is WAY over what I’d use with this single program or even a fleet of them. I never saw this happen with the equivalent patch in XP.

  57. YaronMaor
    May 15th, 2007 14:40
    57

    Hi All,

    I’ve uploaded a new v1.6 which now includes a fix to disable the UAC prompt for those of you still using the UAC protecion.
    it also includes a tool to completly disable the UAC protection.
    download from: http://www.yaronmaor.net

    Cheers,
    YaronM

  58. El Denno
    May 19th, 2007 09:18
    58

    Doesn’t seem to be working for me I get the following error;

    Windows Vista Concurrent TCP/IP Connection Attempt Limit Auto Patcher
    Event ID 4226 Fix
    Version 1.6

    (c) My Digital Life (www.mydigitallife.info)
    Auto Patcher batch script by http://www.yaronmaor.net

    for 32-bit version of Windows Vista

    Confirm to apply? (Press Ctrl-C and answer Y to terminate)
    Press any key to continue . . .

    ERROR: Not all data was successfully written to the registry.
    Some keys are open by the system or other processes.

    SUCCESS: The file (or folder): “C:\Windows\System32\drivers\tcpip.sys” now owned
    by user “JACKS\Jack”.
    processed file: C:\Windows\System32\drivers\tcpip.sys
    Successfully processed 1 files; Failed processing 0 files

    Set global command failed on IPv4 The requested operation requires elevation.

    Access is denied.
    0 file(s) copied.

    Original tcpip.sys driver has been renamed to “tcpip.original” in its original f
    older.

    1 file(s) copied.
    ERROR: Not all data was successfully written to the registry.
    Some keys are open by the system or other processes.

    *** Patch installation is complete. Please RESTART computer!!

    Press any key to continue . . .

    Please help me. My email is el_denno@hotmail.com

    Thanks

  59. admin
    May 19th, 2007 10:52
    59

    Did you run as administrator?

  60. nocrash
    May 19th, 2007 15:07
    60

    @El Denno
    use the script within an “elevated command prompt”, simply press the Win key; type cmd; press Ctrl+Shift+Enter; and then hit Alt+C to confirm
    (http://blogs.msdn.com/tims/archive/2006/11/02/windows-vista-secret-10-open-an-elevated-command-prompt-in-six-keystrokes.aspx)

    cheers

  61. El Denno
    May 19th, 2007 16:59
    61

    Thanks for the help. I ran it with an elevated cmd and this is what I got;

    Windows Vista Concurrent TCP/IP Connection Attempt Limit Auto Patcher
    Event ID 4226 Fix
    Version 1.6

    (c) My Digital Life (www.mydigitallife.info)
    Auto Patcher batch script by http://www.yaronmaor.net

    for 32-bit version of Windows Vista

    Confirm to apply? (Press Ctrl-C and answer Y to terminate)
    Press any key to continue . . .

    ERROR: Error opening the file. There may be a disk or file system error.

    SUCCESS: The file (or folder): “C:\Windows\System32\drivers\tcpip.sys” now owned
    by user “JACKS\Jack”.
    processed file: C:\Windows\System32\drivers\tcpip.sys
    Successfully processed 1 files; Failed processing 0 files
    Ok.

    1 file(s) copied.

    Original tcpip.sys driver has been renamed to “tcpip.original” in its original f
    older.

    The system cannot find the file specified.
    ERROR: Error opening the file. There may be a disk or file system error.

    *** Patch installation is complete. Please RESTART computer!!

    Press any key to continue . . .

    I don’t understand why I’m getting this error.

  62. admin
    May 19th, 2007 21:22
    62

    Have you try version 1.5 instead? If still fail, simply use manual method specify above.

  63. May
    May 21st, 2007 12:33
    63

    Hi all,

    May i know what is the default value of ‘concurrent connection attempts limit per second’ for Window Vista Business version.

    As i knew, there are 2 for Window Vista Home edition and 25 for Ultimate version.

    Thanks :)

  64. Markus (OM)
    May 29th, 2007 12:33
    64

    Hi!

    Is this patch really working? I’ve been messing and testing it for a week now; and I’m still experiencing connection limit, but just without error in Event Viewer!

    :(
    (Vista Ultimate 32bit user)

  65. Rick
    May 29th, 2007 14:01
    65

    How do you know you’re experiencing the connection limit if you’re not getting errors in Event Viewer?

    uTorrent still gives me 4226’s in EV even though I can’t be anywhere near hitting the limit (and besides, uTorrent is configured to use less than 100). Never happened in XP with its corresponding patch. So this patch still needs work.

  66. Markus (OM)
    May 29th, 2007 15:34
    66

    Hi Rick!

    Without patch:
    After an 4226 error uTorrent would continue to download it’s current torrents!
    Patched:
    If I open more than few pages (in Maxthon of Firefox) and surf a “little” while uTorrent (or etc.) is downloading; I get same network errors (with no error in Event Viewer), but uTorrent still continues to download it’s current torrents!

  67. X_Splinter
    June 8th, 2007 00:27
    67

    Its doesnt work… danm

    Somebody help me… i have Vista Home Basic and can have more than 20 conections in torrents… like 15sedders and 5 downloaders

    I pacth with version 1.5 didint work… i tryed version 1.6 didint work… can someone help me?????

  68. john
    June 15th, 2007 20:42
    68

    yeah thanks a lot! Now my windows xp’s internet connection stopped. windows cannot start the windows firewall/internet connection sharing. Yeah! aint that great? i can’t go online now thx alot!
    …………/´¯/)
    …………/….// …….^^^^^^^^^^^^^^^^^^^
    ………../….// ……/……__………..__…….\
    …../´¯/…./´¯\…..(-….(.0.)…….(.0.)…..-)
    .././…/…./…./.|_…¡………../_…………….
    (.(….(….(…./.)..)..\……….____………./
    .\…………….\/../ ….\……………………..
    ..\……………../……..\__________/
    ….\…………..( ……………\……….\.
    ……\………….\ …………….\……….\

  69. X_Splinter
    June 15th, 2007 22:59
    69

    This is for windows vista and NOT for xp.

    Use System Mechanic or Windows Restore Points to put it back to normal

  70. eurosete
    July 5th, 2007 17:42
    70

    Dear john if you are an idiot, it is normal that do not work! The tile is:Windows Vista tcpip.sys Connection Limit Patch for Event ID 4226.
    Windows Vista, you understand?

  71. dark knight
    July 12th, 2007 14:02
    71

    MS ha updated the tcpip.sys file with one of windows update latest patches.
    We need another modified tcpip.sys for build 6.0.6000.20582 .
    Where we can find it?

  72. dark knight
    July 13th, 2007 07:31
    72

    MS has updated the tcpip.sys file with one of windows update latest patches.
    We need another modified tcpip.sys for build 6.0.6000.20582 .
    Where we can find it?

  73. Gordon
    July 16th, 2007 14:36
    73

    it’s actually version 6.0.6000.20583 of tcpip.sys
    well it is on my pc anyway

    explains why the patch does not work

    stupid microsoft why limit it anyway didn’t do it on pre sp2 xp and not much harm was done

  74. Rick
    July 17th, 2007 13:25
    74

    It’s interesting that you guys show differing version numbers (did one of you install a pre-release hotfix?). I wonder which update did it? I’m still on 6.0.6000.16386, and the only update I haven’t installed is the infamous troublemaker Q935807 (see link), which few people seem to be able to actually get installed.

    http://www.microsoft.com/technet/security/Bulletin/MS07-038.mspx

    While the files that it installs (as shown in “File Information”) include all sorts of TCP/IP-related files, it doesn’t show TCPIP.SYS itself as being one of them.

    So if not this update, which one? Or maybe it’s an omission?

    I sure miss lvllord’s version of this patch for XP, which 1) Worked completely (with this Vista patch I still get error messages, though a small number) and 2) It was well updated.

  75. TCP/IP Has Reached the Security Limit Imposed on the Number of Concurrent TCP Connect Attempts Error on Windows Vista » My Digital Life
    July 17th, 2007 15:20
    75

    [...] or the AutoPatch (Windows Vista Event ID 4226 Auto Patcher) to turn off Vista TCP connection limit here. Instruction guide available too. With limit removed, the event ID 4226 won’t appear again [...]

  76. adams
    July 26th, 2007 12:42
    76

    MS has updated the tcpip.sys file with one of windows update latest patches.
    We need another modified tcpip.sys for build 6.0.6000.20582 .
    Where we can find it?

  77. adams
    July 26th, 2007 12:43
    77

    MS has updated the tcpip.sys file with one of windows update latest patches.
    We need another modified tcpip.sys for build 6.0.6000.20583 .
    Where we can find it?

  78. bruce
    July 29th, 2007 13:55
    78

    Where can we find an updated patch for the new build of tcpip.sys? The old patch doesn’t work anymore.

  79. brian
    August 1st, 2007 04:41
    79

    I did everything through step 5 and then my internet didn’t work anymore

  80. help !
    August 13th, 2007 11:05
    80

    tcpip.sys 6.0.6000.20583

    any crack for it ?
    please help

  81. Lole
    August 14th, 2007 06:02
    81

    Quéquette :D

  82. EricLee
    August 15th, 2007 21:59
    82

    If apply KB932596 patch on Vista64 system then tcpip stack will not be run.

    would you reslove it ?

    thanks

  83. Dickson Balls
    August 17th, 2007 05:53
    83

    this is a half baked backyard hack that does more harm than good.it has been only half thought through by someone who knows stuff all with what they are actually doing. They may have lucked out once or twice with this patch on a Vista PC but there are safer alternatives around than this lame attempt at a fix. do yourself a favour and google for the real fix.

  84. KB929547 - Aussetzer in Anwendungen nach Installation eines WFP-Treibers - drvista.de
    September 6th, 2007 19:25
    84

    [...] <patch ist f

  85. KB929547 - Aussetzer in Anwendungen nach Installation eines WFP-Treibers - drvista.de
    September 7th, 2007 03:01
    85

    [...] <patch ist f

  86. Windows Vista tcp.sys Patch
    September 9th, 2007 02:39
    86

    [...] Links: Infos und Patch Download [...]

  87. hh
    September 27th, 2007 02:41
    87

    I uninstalled KB932596 on my Vista-x64 system, but I still can’t get it to work, always fails on dial-in just as with that patch.

    Any ideas??

  88. Urgixgax
    September 27th, 2007 16:57
    88

    Howdy!

    The new tcpip.sys is version 6.0.6000.20597!
    We need another modified tcpip.sys for build 6.0.6000.20597 .
    Where we can find it?

    Greets

  89. YaronMaor
    September 30th, 2007 17:41
    89

    a new version 1.7 was released to support Windows Vista SP1 Beta.
    Find it here: http://www.yaronmaor.net/downloads/VistaTcpipUacPatch1.7beta.rar

    Cheers,

    YaronM

  90. aww shit....
    October 1st, 2007 14:58
    90

    yeah so… now MSDTC starts up with 0 in allow remote administration…. i removed the TCPIP patch…. what did i forget???

    i think it has something to do with this:
    bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS

  91. Rick
    October 12th, 2007 02:23
    91

    To clarify, there is no “new” version of TCPIP.SYS if you’re running non-beta Vista 32-bit. It’s only an issue on 64-bit as well as the SP1 beta. For everyone else, unless you’ve installed some unofficial hotfix, you should still be using v6.0.6000.16386.

    Here’s an alternative tool for anyone actually in need:
    http://www.mydigitallife.info/2007/09/01/vistatcppatch-windows-vista-tcp-half-open-limit-auto-patcher-gui-version/

  92. Manoj
    October 31st, 2007 11:37
    92

    mine says its v6.0.6000.20645 not v6.0.6000.16386
    but i only installed official patches.

  93. Rick
    October 31st, 2007 13:33
    93

    By “official” I meant what’s offered by Windows Update. There is at least one patch, this one:
    http://support.microsoft.com/kb/940646

    Which will update tcpip.sys to the version you mentioned, but it’s a very specific fix intended for only the few who need it. MS has not broadly offered a newer tcpip.sys to Vista 32-bit (non-SP1).

  94. Thresholder
    November 1st, 2007 07:02
    94

    Hi,

    I have been trying to patch tcp on windows vista home premium 32 using both the autopatcher and the elevated cmd prompt.

    When I use the elevated cmd prompt I get the message:” VistaTcpPatch is not recognised as an internal nor external comand a program or batch file”.
    If I use the autopatcher when I reboot I get a blue screen with a memory crash dump and need to remove the patch in order to get the system back up.

    Has this worked for somebody?
    Am I doing anything wrong?

    Thanks.

  95. Rick
    November 1st, 2007 09:49
    95

    >When I use the elevated cmd prompt
    >I get the message:” VistaTcpPatch
    >is not recognised as an internal
    >nor external comand a program or batch file”.

    Be sure to extract the complete contents of the archive into whatever temp directory you’re using, and be sure to move into that directory once you’ve dropped to the command line. You couldn’t have been in the directory when trying to execute the commands.

  96. GiGi.
    November 1st, 2007 15:18
    96

    The patch posted earlier that is supposed to work with vista sp1 beta does not function properly. I still get warning that the imposed connection limit has been reached. Can someone look at a solution to this?

    Cheers

  97. Rick
    November 1st, 2007 15:29
    97

    I suspect there’s not much inclination to bother with SP1 beta at this point, since it’s a moving target. Several more builds will come out.

    What we really need is an intelligent patcher, not just a canned one, which can look through the DLL and dynamically make the changes as appropriate. One existed for XP for years.

  98. YaronMaor
    November 1st, 2007 15:46
    98

    Hi All,

    The patch for the Vista SP1 Beta is unstable and might not function correctly on all the Beta builds. as soon as the final SP1 will be out I will try to publish ASAP an updated version of the patch.
    Meanwhile, versions v1.5/1.6 works fine. for those of you that installed the hotfix KB940646 and got a different version of the tcpip.sys driver- the patch will not work. Please note that this patch is not essential for most of you and is not delivered through Windows Update.

    YaronM.

  99. Thresholder
    November 2nd, 2007 04:48
    99

    Rick
    November 1st, 2007 09:49
    95

    >When I use the elevated cmd prompt
    >I get the message:” VistaTcpPatch
    >is not recognised as an internal
    >nor external comand a program or batch file”.

    Be sure to extract the complete contents of the archive into whatever temp directory you’re using, and be sure to move into that directory once you’ve dropped to the command line. You couldn’t have been in the directory when trying to execute the commands.

    Hi Rick and thanks for the help.
    I do not understand what archive I need to extract since the only thing I get from the download is VistaTcpPatch.exe.
    What else should I get?

    Anyway I copied the VistaTcpPatch.exe file in the System32 directory and executed the cmd prompt.
    I got the following message:Tcpip.sys file version unsupported.
    Did I do everything right this time?
    If so is there anything else I can try?

    Thank you.

  100. Rick
    November 2nd, 2007 05:35
    100

    Thresholder, the .exe file is the autopatcher (VistaTcpPatch), which you said blue screened your system. You also said it wouldn’t run (unrecognized command), which is contradictory. Regardless, since you’re commenting on this page you should be referring only to what’s available here, and that’s an archive of several files.

    But it appears from your second post that you’re running the version of TCPIP.SYS from either SP1 or KB940646, so you’re going to have forget about patching at all.

  101. Thresholder
    November 6th, 2007 01:45
    101

    Hello Rick,

    I am sorry if I posted on the wrong page.
    I am commenting now on what is available on this page.

    I checked my tcpip.sys and it is build 6.0.6000.20582 although I do not have KB940646 installed within my Windows Updates.

    Don’t know how but in my download folder I got a copy of tcpip.sys build v6.0.6000.16386 that I maybe downloaded from someplace or maybe is a backup of my old tcpip.sys but I am unsure.

    Do you think it would be advisable to replace tcpip.sys 6.0.6000.20582 with v6.0.6000.16386 in order for the patch to work?

    I also saw in the comments a link to version 1.7 of the patch.
    Does that works out for versions 6.0.6000.20582 of tcpip.sys in case you discourage the substitution with the older version of the file?
    Did you test it?

    One last question:in your previous post you tell me to “be sure to move into that directory once you’ve dropped to the command line”.
    I do not understand what this mean so would you mind explaining it please?
    I have extracted the archive file on the desktop (VISTA).

    Thank you

  102. Nuno Lopes
    November 6th, 2007 08:00
    102

    Hi

    when i install the tcpip patch my computer stops detecting any network available, norton 360 says that are an internal problem. When i put the original tcpip.sys i star to have internet again.

  103. Nuno Lopes
    November 6th, 2007 08:27
    103

    Hi

    when i install the tcpip patch my computer stops detecting any network available, norton 360 says that are an internal problem. When i put the original tcpip.sys i star to have internet again. I´m using Windows vista 64bits ultimate

  104. budman
    November 7th, 2007 22:46
    104

    where is the reference that the limit is different in home basic vs ultimate?? Since it seems that the tcpip.sys file is the same in all flavors of vista?

    How/Why would the limit be different? What was the point of stating such a thing if not true? A limit is a limit is a limit - if its 2 or 10 or 25 what does it matter if what your looking to do is remove the limit?

    To be honest the whole thing is pointless — there really is not valid reason to work within the limits.. But I am looking for reference to the 2 in home an 25 in ultimate statement. Can someone please provide reference to this statement??

  105. uac
    November 8th, 2007 00:04
    105

    All editions have 10 half-open connections TCP/IP limit. The exceding connections attempts are not lost, but they’re put in a queue.

  106. Rick
    November 8th, 2007 00:28
    106

    Funny you mention that, since there’s a debate ongoing about it here, but it does appear that it is 10 for any edition:
    h**p://www.neowin.net/forum/index.php?showtopic=599056

  107. ghost
    November 13th, 2007 04:47
    107

    the auto patcher dose not work with the 64bit version of vista

  108. ldog
    November 21st, 2007 09:18
    108

    ok so my internet stopped working b/c of this patch how do i unpatch tcpip.sys??? does n e one know were it is on my computer and how to get the old one back?

  109. ldog
    November 21st, 2007 10:18
    109

    ok i got it to work, i also wanted to know i get an error on startup almost everytime MSDTC concosle do u guys know how to fix that dumb message?

  110. admin
    November 21st, 2007 10:35
    110

    Idog, do you have screenshot? What is the error message?

  111. ldog
    November 24th, 2007 01:32
    111

    A critical error occurred in an MS DTC component therefore the process is terminating. The category field identifies the component that encountered the error. Please contact Microsoft Product Support. Error Specifics: hr = 0×80070002, d:\vistartm\com\complus\dtc\dtc\msdtc\src\cservice.cpp:461, CmdLine: C:\Windows\System32\msdtc.exe, Pid: 3748

    i dont need msdtc i dont think i think its for a server how do i disable it????

  112. ROK
    November 25th, 2007 03:56
    112

    If i replace my tcpip.sys with sys file from this site or from those patches my computer crash after start up and I got blue screen of death. I use vista business edition and I think reason why those sys files don’t work is this windows vista KB93897 update.

    Chck this site: link removed there is also Vista TCP/IP and UAC AutoPatch 6.0

    This limit thing is so frustrating.

  113. admin
    November 25th, 2007 11:22
    113

    Hi ROK, the site stole the patched tcpip.sys from here. So link to it not allowed. Anyway, it’s basically the same thing, and won’t work on newer version of tcpip.sys installed by SP1.

  114. PrEzi
    November 27th, 2007 03:53
    114

    Has anyone managed to grab a patched tcpip.sys made for Vista SP1 RC0 ? tcpip.sys build is :
    6.0.6001.17042.
    I have tryed the Windows Vista Event ID 4226 Auto Patcher build 1.7beta for SP1 but it’s actually an older build of tcpip.sys and my Vista hangs :(

  115. EvilMaster
    November 27th, 2007 10:25
    115

    Anyone got a new TCPIP patch for Windows Vista Sp1 Beta??…I installed the beta from Windows Update, and it fixed many things on my system, and I want to use it. But had to uninstall it due to the damn TCPIP limit which the government forced Microsoft to implement. Anyone have a new patch so I can reinstall the service pack?

  116. ROK
    November 29th, 2007 05:44
    116

    Hi admin.

    Site stoled it from here??? Sorry I didn’t know that.

    Will there be updated version to this patch or tcpip.sys soon?

  117. admin
    November 29th, 2007 08:58
    117

    Unlikely.

  118. EvilMaster
    November 29th, 2007 09:42
    118

    **Admin: “Unlikely”**

    So does this mean that no further TCPIP hacks will be available? Has MS finally locked it down? Are we all sol? I guess SP3 of XP does the same thing?

    Finally gonna have to switch back over to Linux I guess. To bad the Government has MS by the balls. Oh well. :(

  119. Limit Maximum TCP Connections to Web Servers » My Digital Life
    December 6th, 2007 18:37
    119

    [...] Windows XP SP2 and Windows Vista, a lot of users have been searching for tcpip.sys patched hack or auto patcher that unlocks the TCP/IP half-open simultaneous connection limit to no upper bound. [...]

  120. Optimize and Increase BitTorrent (BT) Download Speed in Vista » My Digital Life
    December 15th, 2007 22:37
    120

    [...] the BT client or other P2P client, and tweaking of options in the client itself, some users use patched tcpip.sys that remove the half-open connection limit imposed by [...]

  121. vano_spb
    December 17th, 2007 00:45
    121

    For people who have installed KB940646 and have version of tcpip.sys 20645 i have made patch, tested on my PC

    http://rapidshare.de/files/38063778/tcp_ip_patch_20645_ver.rar.html

    if u have previose version 20XXX install kb940646 and use this path.

  122. Data
    December 18th, 2007 06:25
    122

    I have the same problem as Nuno Lopes in Vista x64, when i install the patch my computer stops detecting any network available. I tried patch 1.5, as my original tcpip32.sys was version 16386. Does anyone have an alternative version for x64? [patch 1.5 works fine on another computer running Vista x32...]

    Thanks in advance.

  123. Data
    December 19th, 2007 08:02
    123

    Here ist the solution for Vista x64:
    I had to uninstall the following Windows updates, as they automatically re-enabled driver signing in Vista x64:
    -KB943078
    -KB932596
    -KB938979
    -KB941649
    I uninstalled them in Windows safe mode, just to make sure.

    After that I could apply patch 1.5 or 1.6.
    I had to manually start the command
    “bcdedit.exe /set loadoptions DDISABLE_INTEGRITY_CHECKS”
    after running the InstallPatch64.bat, as it showed that bcdedit wasn’t found for unknown reasons. After this procedure I restarted and everything worked!

    PS: Be careful, any future Windows Update or Service Pack may (sadly) re-enable this driver signing process. So if your network card stops working and shows up with a red x in the tray one day it will probably be due to an update that was just installed.

    Hope this helps anyone, cost me half a day to find that out.

  124. RobG
    December 22nd, 2007 12:22
    124

    vano_spb,

    Could you make the patch TCP file to 64 bit systems ???

  125. CrackTcpip.sys Driver for Vista SP1 v.668 to Patch tcpip.sys 6.0.6001.17052 » My Digital Life
    January 7th, 2008 18:30
    125

    [...] system with Vista SP1 RC installed should have. The update on tcpip.sys of Vista also renders the patched version of tcpip.sys, which unlocks and removes the limit on simultaneous half-open incomplete (syn packets) connection [...]

  126. Rick
    January 9th, 2008 04:02
    126

    Just a heads up, MS today released the first mainstream update to TCPIP.SYS since 32-bit RTM. It’s part of Security Bulletin MS08-001 and is v6.0.6000.20689.

    By “first” I’m not counting betas and not counting a couple optional updates made available only via obscure KB articles. This one is being pushed out to everyone via Windows Update, though technically speaking it is optional if you don’t use automatic updates.

    So now the search is on for the patched version (just like was created for the RTM version), though why an intelligent updater like the original one for XP isn’t available is still a mystery.

  127. Rick
    January 9th, 2008 14:33
    127

    Clarification: After actually installing MS08-001, I got v6.0.6000.16567 of TCPIP.SYS, not what I mentioned earlier. Both versions are mentioned in the technote for 32-bit, so apparently some 32-bit flavors get one and some the other. First I’ve heard of such a thing, but I can’t think of any other explanation.

  128. admin
    January 9th, 2008 15:47
    128

    After installing KB941644, I too get tcpip.sys version 6.0.6000.16567. 6.0.6000.20689 probably is for other files?

  129. Rick
    January 9th, 2008 23:55
    129

    There appear to be two sets of files with this update listed here in the Security Update Deployment, Windows Vista (all editions), File Information section. Since we both got 6.0.6000.16567 (I tested on the Enterprise edition) it’s pretty safe to assume most will get that, but the other version is mentioned for tcpip.sys as well, so eventually someone’s going to turn up with it.

    http://www.microsoft.com/technet/security/bulletin/ms08-001.mspx

  130. Rick
    January 10th, 2008 00:24
    130

    OK, so here’s my line of thinking on patching 6.0.6000.16567. Tell me if I’m crazy, please.

    Comparing the RTM version with your patch in UltraEdit, the only differences I see are these:

    RTM: 140H-141H: 67 0F
    Patch: 140H-141H: 91 26

    RTM: 3F47dH-3F482H: 0F 87 8b 00 00 00
    Patch: 3F47dH-3F482H: 90 90 90 90 90 90

    When looking in 6.0.6000.16567 for something comparable, I found:

    -The first pattern is still 140H-141H, but the new values there are: AB 86. The byte following, at 142H, is now 0C instead of 0D.
    -3f479H-3f47fH is the new location for the second pattern, and all the numbers around it also match the original so it’s definitely the right location.

    So the second change seems easy. The first one is more ambiguous, since I’m not sure if the third byte should also be changed.

  131. Rick
    January 12th, 2008 15:21
    131

    Modified 6.0.6000.16567 (32-bit), in case anyone wants to try it out. How I did it is explained below. Let me know how it works.

    http://rapidshare.de/files/38276806/tcpip_eventid4226fix_6.0.6000.16567__32-bit_.zip.html

    Well, by doing extensive searching, I found out the purpose of the mystery pair of bytes starting at 140H: the checksum. No wonder it was different with each revision of the file.

    So, I took 6.0.6000.16567 (32-bit) and did the following. With this recipe, any version that comes along can be easily modded:

    1) With UltraEdit (or your favorite binary file editor), search for this pattern:
    0F 87 8b 00 00 00
    2) In the found location, replace those six bytes with:
    90 90 90 90 90 90
    3) Save the file and close the editor.
    4) Download PEChksum here (you can ignore the other four programs in the archive).
    http://www.bitsum.com/files/pesuite.zip
    5) Copy PEChksum.exe to the same directory as your modified tcpip.sys, open an elevated command prompt in that directory, and run:
    PEChksum tcpip.sys
    6) You’re done.

    Your output will look like this (values will vary by version; this is the output for 6.0.6000.16567):

    + Processing file: tcpip.sys
    + Original checksum: 0×000C86AB
    + New checksum : 0×000C9DD5
    + Checksum required correction.
    Modules analyzed: 1
    Modules whose checksum was corrected: 1

    PEChksum automatically makes the modification necessary to the file: the checksum, which in this case was located at 140H-141H. This is necessary because you modified the file earlier.

    In summary, these are the changes for this particular file:

    tcpip.sys 6.0.6000.16567
    00000140 : AB D5
    00000141 : 86 9D
    0003F479 : 0F 90
    0003F47A : 87 90
    0003F47B : 8B 90
    0003F47C : 00 90
    0003F47D : 00 90
    0003F47E : 00 90

  132. YaronMaor
    January 12th, 2008 23:57
    132

    Hi All,

    in the link below you can find the new v1.9 of the tcpip patch supporting KB941644 (for 32bit only). Find it under the “Repair” section:
    http://www.yaronmaor.net

    Thanks for Rick for his helpful information in cracking the tcpip driver.

    Cheers,
    YaronM

  133. RobG
    January 13th, 2008 03:46
    133

    YaronM,

    Is it difficult to make the patch to 64 bit version ???

  134. Rick
    January 13th, 2008 03:56
    134

    Rob, I’d guess that you could follow the same recipe, but without seeing the original version I wouldn’t know.

  135. YaronMaor
    January 13th, 2008 04:10
    135

    Hi RobG,

    Please send a copy of the unpatched version of 64-bit v6.0.6000.16386 tcpip.sys to the following address:
    info at yaronmaor dot net

    thanks,
    YaronM

  136. RobG
    January 13th, 2008 05:37
    136

    YaronM,

    Mine is the version 20689….

  137. Rick
    January 13th, 2008 06:09
    137

    Rob, KB941644 installs 16567 in some cases and 20689 in other cases (read a few posts back), but regardless we need the original UNpatched 16386 to be able to see what needs to be done.

    BTW, since I take it you were using the patched version (of 16386) on 64-bit until recently, how did it work for you?

  138. Rick
    January 13th, 2008 06:48
    138

    Rob, please email your 64-bit 20689 to yaronmaor dot net. Thanks.

  139. Rick
    January 13th, 2008 07:32
    139

    Er, that’s: info at yaronmaor dot net

  140. Rick
    January 13th, 2008 13:38
    140

    For anyone wondering how to mod 64-bit, it’s the same procedure as in post #131, with the following exception:

    1) With UltraEdit (or your favorite binary file editor), search for this pattern:
    0f 87 24 01 00 00

  141. YaronMaor
    January 13th, 2008 15:06
    141

    Hi All,

    There’s a new revision (v1.9b) for the patch that includes support for 64bit and also to the two file versions that comes with the 32bit (16567 & 20689).
    Please follow the README.TXT file that comes with the patch.
    find it at: http://www.yaronmaor.net
    under the “repair” section.

    Cheers,
    YaronM

  142. THE_CD
    January 13th, 2008 18:52
    142

    Hi there

    I got 16567 version of file (tcpip.sys) after instaling KB941644 in Vista Utlimate x64.
    Anyone there with same case.
    YaronMaor are you planing patch this version of file for 64bit system ?
    Salutation

    CD

  143. YaronMaor
    January 13th, 2008 20:30
    143

    Hi CD,

    I was waiting for someone to come-up with this situation… :)
    Please send me a copy of the tcpip.sys file with the version 16567 archived in RAR or ZIP.
    send it to: info at yaronmaor dot net.
    I will patch it and add it to the patch-package.

    Thanks,
    YaronM

  144. Rick
    January 13th, 2008 23:47
    144

    My theory about the KB941644 lottery is this. I’m anxious to hear from anyone who can prove or disprove it:

    -If you already have 6.0.6000.16xxx before installing it, you’ll get 6.0.6000.16567.
    -If you already have 6.0.6000.2xxxx before installing it, you’ll get 6.0.6000.20689.

    If true, I’d recommend people already be on a 6.0.6000.2xxxx hotfix before installing it, since I expect that the larger, seemingly “newer” 20689 version is the more comprehensive fix, a “QFE” (integrates all other fixes which apply to that module) rather than a “GDR” (contains only the specific fix and not all others). Why Microsoft would do it this way I can’t understand, since they’re both roughly the same size.

    This would be a convenient way to get onto 6.0.6000.2xxxx if you haven’t installed KB941644 yet:
    http://support.microsoft.com/kb/940646

  145. Silverbreaker
    January 14th, 2008 02:33
    145

    @YaronMaor and @Rick

    your Patch (1.9) doesn’t work on my 20689 x64 vista!! the tcpip.sys crachs after the reboot!

    please fix the problem!

  146. Rick
    January 14th, 2008 03:04
    146

    Silverbreaker: Was the RTM 64-bit patch working for you before? I ask because if it wasn’t, the new one won’t either, since it was done in the same way.

    Let’s consider the new 64-bit patch a “work in progress” at this point until we can get more feedback.

    I’d also like to hear any feedback on the 64-bit 16567, which is forthcoming if it’s not already there.

  147. RyanHo
    January 14th, 2008 03:08
    147

    Rick, you are right. It actually works. But I have another problem.

    bcdedit.exe -set loadoptions DDISABLE_INTEGRITY_CHECKS

    The option “DDISABLE_INTEGRITY_CHECKS” doesn’t work, I don’t know why. I have to press F8 in boot menu and select “don’t check driver integrity”.

  148. YaronMaor
    January 14th, 2008 03:09
    148

    Hi All,

    I’ve just updated the recent patch to include the 64bit of v16567 driver.
    http://www.yaronmaor.net > “Repair” section.
    As Rick wrote before, please send us details on 64bit systems installed with patch. which version did you install? did it work for you? did the earlier versions work before?

    Thanks,
    YaronM

  149. Rick
    January 14th, 2008 03:16
    149

    RyanHo, You’re talking about 20689, right?

    I don’t know why that line in the batch wouldn’t work for you. Did you run it from an elevated prompt?

    Everyone: When posting, please cite version and platform.

  150. Rick
    January 14th, 2008 03:27
    150

    Follow-up: the DDISABLE_INTEGRITY_CHECKS issue turns out to be well known and is unrelated to the patch.

    Basically, when any of these updates are installed, you cannot run the DDISABLE_INTEGRITY_CHECKS command:

    KB943899
    KB943078
    KB932596
    KB938979
    KB941649

    And there may be others. The F8 workaround, as previously mentioned, is the only solution right now for this idiocy (I certainly don’t recommend uninstalling the KBs just for this). Watch this thread for further developments on this “evil updates” issue:
    http://forums.microsoft.com/technet/showpost.aspx?postid=2012166&siteid=17&sb=0&d=1&at=7&ft=11&tf=0&pageid=2

  151. Silverbreaker
    January 14th, 2008 03:29
    151

    @YaronMaor I have send you my tcpip.sys (x64, 20689) to your mail-adress (info at yaronmaor dot net).

    @all this patch (v. 1.9) was my first patch, i don’t patch the .sys eather! first i installed the kb940646 and than the kbKB941644, at last the patch (1.9)…

    it doesn’t work…

  152. Rick
    January 14th, 2008 03:34
    152

    Ripped from the aforementioned forum since it’s important to know:

    If you tap F8 during startup (to get the bootup menu where you select normal mode, safe mode etc.), at the bottom is an option “DISABLE DEVICE DRIVER SIGNATURE ENFORCEMENT”.

    Select this and Vista will bootup without device driver signature enforcement. This works. No really, it works. This is different to “bcdedit /set loadoptions DDISABLE_INTEGRITY_CHECKS” or any other such options.

    The “bcdedit” seems to be for device signing during runtime. The recent slew of updates however seem to be applying a BOOTUP signature enforcement, which obviously being bootup happens before runtime.

    Unfortunately there is no way to get this to automatically run every time - you have to go to your bootup menu every time you start your PC up. Somewhat of an annoyance, but I have got used to it as a way to remove the half-open connection limiter.

    I hope this helps other people. It helped me as I thought I had destroyed my internet when I patched my tcpip.sys without backing it up and suddenly found anything related to networking was “broke” - any network related service not starting up etc., only to find this was because tcpip.sys was not loading due to it not passing this new bootup device driver signature check/enforcement.

  153. Silverbreaker
    January 14th, 2008 03:46
    153

    so, this mean that the patch will not run wihtout the “device driver signature enforcement”-bootoption?!

    oh damm, it’s very stupid to boot windows every time like that…

  154. RyanHo
    January 14th, 2008 03:47
    154

    This is my situation. I already installed KB941644. I remove it, then download KB940646 and install it.

    I install KB941644 standalone patch download form MS website, but it doesn’t work. TCPIP.sys doesn’t be replaced. Finally I install KB941644 through Windows Update, that’s all done.

  155. Rick
    January 14th, 2008 03:54
    155

    @Silver: Yup. It should be emphasized again that this is now the case for any patched system files, not just these. It’s a deliberate choice they made by virtue of those (at least) 5 other updates I mentioned. I expect someone will come up with a way to make the F8 selection (or equivalent) “stick” though. People are pretty clever.

  156. RobG
    January 14th, 2008 04:19
    156

    Waiting to a automatic solution to DISABLE DEVICE DRIVER SIGNATURE ENFORCEMENT !!!

  157. Rick
    January 14th, 2008 04:24
    157

    Sleep/hibernation?

  158. Ben Ford
    January 17th, 2008 08:55
    158

    SO how do we fix the new version? ive seen so many different things, i’m lost.

  159. Rick
    January 17th, 2008 09:28
    159

    @Ben: It is a long and winding thread, but AFAIK the patches work. If you’re 64-bit, you’ll have to do the F8 workaround (see #151) because of MS’s signed driver requirement that they’ve been rolling out starting last August with the first of a series of updates.

    This is not to say that it’ll work perfectly in every case, but if the batch file executes properly there’s a very good chance you won’t see a problem.

  160. Tips to increase BitTorrent download speeds | THE source for P2P File Sharing Tips, Tricks and information. | FileShareFreak
    January 20th, 2008 05:56
    160

    [...] some other unofficial links to sites with more information, forums and the patches required, and here’s a link [...]

  161. RyanHo
    January 20th, 2008 16:26
    161

    Another problem, when I use this patch on Vista x64 home premium 6.0.6000 (for tcpip.sys v20689), then launch emule or utorrent for 1 or 2 days, the port they use seems to be blocked. This never happened before patch.

  162. Braddman
    January 25th, 2008 07:26
    162

    I have a 6.0.6001.17052 TCPIP.SYS, does the crack work for this version? I will email the file to you.

  163. Rick
    January 25th, 2008 07:31
    163

    Braddman, please update to the RC Refresh build (likely the last public release until RTM), which uses 17128. There is a fix for that one, though it’s not up yet.

    http://www.microsoft.com/downloads/details.aspx?FamilyID=529d992a-d69e-4c73-9213-7a7f3852c0ca&DisplayLang=en

  164. Rick
    January 25th, 2008 07:40
    164

    I should add, though, that SP1 (even 32-bit) does make you do the F8 dance, as described below in post #152 for pre-SP1 64-bit.

    Here’s more:

    There’s a new twist as of SP1 on 32-bit Vista systems:

    http://www.microsoft.com/whdc/winlogo/drvsign/drvsign.mspx

    “Driver binaries that load at boot time (”boot start drivers”) must contain an embedded signature, *for both x86 and x64 versions of Windows Vista and Windows Server 2008*.”

    Boot-start drivers.
    “In the special case of boot-start drivers–drivers that are loaded by the Windows Vista operating system loader–publishers must use an SPC to embedded-sign the driver binary image file. This requirement ensures optimal system boot performance.”

    In tests using the publicly available 32-bit RC Refresh build, I found the experience identical to what’s discussed above in the case of 64-bit: When booting, you’re told that such-and-such a driver doesn’t have a valid digital signature, and the only way around it is to use F8 for that boot only. In this particular case, I was testing [a modded] tcpip.sys.

    32-bit SP1 drivers are digitally signed, unlike the original release. This is not surprising or even unwelcome, but the enforcement is.

  165. Braddman
    January 25th, 2008 07:57
    165

    Rick, I just downloaded this RC like 2 days ago from Microsoft, and in the corner it says BUILD 6001. There isn’t a newer one is there??

  166. Braddman
    January 25th, 2008 08:02
    166

    Rick, I just checked, my version is 936330 and the link you gave me is the exact same version, but I still have the TCPIP.SYS noted below!

  167. Rick
    January 25th, 2008 09:56
    167

    The KB number (936660) doesn’t change from beta to beta. If you do properties on the Computer icon on the Start menu, you’ll be able to see what version you have. It should say 6001.17128 (v.744) there. If it doesn’t you somehow downloaded the original RC1 and not this year’s refresh.

    I wouldn’t get too excited about it though, because just to make me eat my words, MS released Refresh 2 of RC1 this afternoon to those in the beta. No word yet whether this one will be put out to the general public as well. It’s 6001.18000.

  168. admin
    January 26th, 2008 03:12
    168

    There is no longer a need to patch tcpip.sys in Vista SP1, and I believe it’s not possible to patch SP1 tcpip.sys without breaking it due to signature issue. There is now a external driver version to fix 4226 problem and unlock the TCP connection limit. Refer here:

    http://www.mydigitallife.info/2008/01/07/cracktcpipsys-driver-for-vista-sp1-v668-to-patch-tcpipsys-60600117052/

    It should works on all SP1 RC v.668, v.744 and latest 6001.18000. The author will write an auto patcher/installer once the SP1 is RTM.

  169. Rick
    January 26th, 2008 03:22
    169

    It says in the post that it’s version specific though, in that case targeted at the original RC release. Is that not the case? Where’s the author?

    Using a foreign driver running on top of TCPIP makes me uncomfortable and could have very subtle repercussions I’m not looking forward to discovering. At least this patch method is tried and true.

    As mentioned a couple posts ago, SP1 drivers are now signed even on 32-bit, so there is the F8 signature issue to deal with (at least for now), but as someone who doesn’t boot that often, it’s only a small issue for me.

  170. admin
    January 26th, 2008 03:36
    170

    Sorry about the version because initially we thought the tcpip.sys is changed every version, and hence the ‘limit’ memory location. It turns out the driver can still function with subsequent release. I will update the post soon. The patched SP1 tcpip.sys has some reports that it crashes, have you get it to work?

  171. admin
    January 26th, 2008 03:48
    171

    Rick, btw, to answer your question, the author is from China.

  172. Rick
    January 26th, 2008 04:01
    172

    OK, that’s good to know about the memory address not changing. Incidentally, by “where is the author” I wasn’t referring to the country but meant it in the sense of does he have a site, blog, etc, where he talks about this in more detail and can be contacted?

    In my case, patched 32-bit 17128 is working, so I would expect 18000 to as well (I didn’t try the original RC). We also had some reports of success with the pre-SP1 January update to tcpip.sys.

    Even back to the original version, there were reports of problems, but there are a lot of variables on systems so lots of things to go wrong. The batch file has to execute in its entirety. You have to be aware of F8 (and if you’re not, that looks like a crash). Etc. And some issues pertained to 64-bit, which I can’t test directly (and the other solution doesn’t work with 64-bit).

    Note: The patch “recipe” I posted sometime back can no longer be followed exactly with SP1 builds due to a problem with the now outdated PEChksum. You need to use a tool called PE Explorer instead but only to determine what the new checksum is so that you can change it manually (don’t let PE Explorer do it). PEChksum may or may not be updated to handle the new compiler or whatever it is that MS changed in the way they make their files.

  173. admin
    January 26th, 2008 04:14
    173

    He doesn’t has blog as of I know of. We currently IM. The driver theory is simple - monitor that particular memory address and change it to another value.

    That’s great that the patch still work. That’s mean we will have 2 editions that users can fall back to if one doesn’t work. I will update this post soon too to reflect newer version.

    Btw, please use contact to email me if you wish to share your patched 17128. I don’t see it been included by yaronmaor yet.

  174. Rick
    January 26th, 2008 04:22
    174

    Yaronmaor has it and was going to test it, but I suspect he got busy. With RTM coming as soon as early February, and probably no later than about a month from now, we’ll all have one build to concentrate on soon anyway.

    Do you know of a tool that allows you to browse memory locations (as mentioned in the context of the driver)? I know one of Norton’s could do that LONG ago, but I’m hard-pressed to think of one currently, and I’d like to check it out.

  175. YaronMaor
    January 26th, 2008 04:42
    175

    Hi All,

    sorry for the delay