BSOD in netio.sys, connected to nllStm.sys in latest Norton 360

After installing the latest Norton 360, I got one or two daily BSOD in netio.sys, connected to nllStm.sys. Anyone with the same problem?

Hello. Your post is very generic. Please tell us the following so we can get a better idea of what is happening:
-What OS are you using, what is its version and build ?
-Do you get any extra dump code text within the BSOD dialog, error codes?
-Do you have a screenshot of the BSOD dump screen for review?
-What is the version and build of Norton ?

Thanks in advance.

SA

Ok. I am using Windows 11 23H2 (22631.4317).

My crash dump:

On Thu 31/10/2024 00:25:43 your computer crashed or a problem was reported

Crash dump file: C:\WINDOWS\Minidump\103124-56890-01.dmp (Minidump)
Bugcheck code: 0x3B(0xC0000005, 0xFFFFF8025660C4E4, 0xFFFF960BA721EA70, 0x0)
Bugcheck name: [SYSTEM_SERVICE_EXCEPTION]
**Driver or module in which error occurred:
File path: C:\WINDOWS\system32\drivers\nllStm.sys
Bug check description: This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.
Analysis: This is a typical software problem. Most likely this is caused by a bug in a driver.
Google query: [nllstm SYSTEM_SERVICE_EXCEPTION]

Norton version 24.10.9535 (build 24.10.9535.880)

My system:

Windows version: Windows 11, 10.0, version 2009, build: 22631 (x64)
Windows dir: C:\WINDOWS
Hardware: ASUS, ASUSTeK COMPUTER INC., ROG STRIX B550-F GAMING
CPU: AuthenticAMD AMD Ryzen 5 5600X 6-Core Processor 8664, level: 25
Processor count: 12 logical processors, active mask: 4095
RAM: 32676,8MB

Thank you. One question is have you removed Norton on at least one machine to verify the issue disappears?

SA

No. It is still on my machine. After the upgrade I was having issues with the firewall in ASK mode because I like to control the apps that connect to the internet but Norton will be stuck without asking permission when not in Smart Mode. With that there was the reboots and I got the minidump today. All the BSOD mention netio.sys.

I wish we could still attach files to replies here in the new forums. I would like to read the entire dump
'file" with this tool to see what it tells me:

Download the tool and run it against your dump file. Lets see what it can tell us.

The error 0X3B usually indicates a software or driver issue. Its also caused by memory being released into a state that wasn’t expected when the BSOD occured. For gamers. Overclocking can be an issue as well as drivers.

Bugcheck code 0xC0000005 indicates but isn’t always hardware related, usually memory so these first two code indicate a common issue of 'memory".

Bugcheck code

As another suggestion. Please test one device by removal of the new version of Norton using the preferred removal tool. Reboot and recheck without Norton so we can validate Norton is the issue.

Version 24.xx removal tool:
https://www.norton.com/nortonremover

SA

Ok. Will remove it now and try the PC for a day or two, then I will be back.

I have a similar issue since the update a few days ago. My computer does a cloud backup in the evening and has bluescreened every evening since the update.


  •                                                                         *
    
  •                    Bugcheck Analysis                                    *
    
  •                                                                         *
    

DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
DISPATCH_LEVEL or above.
Arg2: 0000000000001e00, The watchdog period (in ticks).
Arg3: fffff8034eafb320, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding the cumulative timeout
Arg4: 0000000000000000

Debugging Details:




*** Either you specified an unqualified symbol, or your debugger ***
*** doesn’t have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing “.symopt- 100”. Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***


*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***


*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***


*** Type referenced: TickPeriods ***



KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 3203

Key  : Analysis.Elapsed.mSec
Value: 3208

Key  : Analysis.IO.Other.Mb
Value: 0

Key  : Analysis.IO.Read.Mb
Value: 1

Key  : Analysis.IO.Write.Mb
Value: 0

Key  : Analysis.Init.CPU.mSec
Value: 1000

Key  : Analysis.Init.Elapsed.mSec
Value: 4768

Key  : Analysis.Memory.CommitPeak.Mb
Value: 121

Key  : Analysis.Version.DbgEng
Value: 10.0.27725.1000

Key  : Analysis.Version.Description
Value: 10.2408.27.01 amd64fre

Key  : Analysis.Version.Ext
Value: 1.2408.27.1

Key  : Bugcheck.Code.KiBugCheckData
Value: 0x133

Key  : Bugcheck.Code.LegacyAPI
Value: 0x133

Key  : Bugcheck.Code.TargetModel
Value: 0x133

Key  : Failure.Bucket
Value: 0x133_ISR_nllStm!unknown_function

Key  : Failure.Hash
Value: {65cfbfb3-f8a6-9abb-64ea-609a2e533810}

Key  : Hypervisor.Enlightenments.Value
Value: 68669340

Key  : Hypervisor.Enlightenments.ValueHex
Value: 417cf9c

Key  : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key  : Hypervisor.Flags.ApicEnlightened
Value: 1

Key  : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0

Key  : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key  : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key  : Hypervisor.Flags.CpuManager
Value: 1

Key  : Hypervisor.Flags.DeprecateAutoEoi
Value: 0

Key  : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key  : Hypervisor.Flags.Epf
Value: 0

Key  : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key  : Hypervisor.Flags.HardwareMbecAvailable
Value: 0

Key  : Hypervisor.Flags.MaxBankNumber
Value: 0

Key  : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key  : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key  : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key  : Hypervisor.Flags.Phase0InitDone
Value: 1

Key  : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key  : Hypervisor.Flags.RootScheduler
Value: 0

Key  : Hypervisor.Flags.SynicAvailable
Value: 1

Key  : Hypervisor.Flags.UseQpcBias
Value: 0

Key  : Hypervisor.Flags.Value
Value: 4722927

Key  : Hypervisor.Flags.ValueHex
Value: 4810ef

Key  : Hypervisor.Flags.VpAssistPage
Value: 1

Key  : Hypervisor.Flags.VsmAvailable
Value: 1

Key  : Hypervisor.RootFlags.AccessStats
Value: 1

Key  : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key  : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key  : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key  : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key  : Hypervisor.RootFlags.IsHyperV
Value: 1

Key  : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key  : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key  : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key  : Hypervisor.RootFlags.Nested
Value: 0

Key  : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key  : Hypervisor.RootFlags.Value
Value: 1015

Key  : Hypervisor.RootFlags.ValueHex
Value: 3f7

Key  : SecureKernel.HalpHvciEnabled
Value: 0

Key  : Stack.Pointer
Value: ISR

Key  : WER.OS.Branch
Value: vb_release

Key  : WER.OS.Version
Value: 10.0.19041.1

BUGCHECK_CODE: 133

BUGCHECK_P1: 1

BUGCHECK_P2: 1e00

BUGCHECK_P3: fffff8034eafb320

BUGCHECK_P4: 0

FILE_IN_CAB: MEMORY.DMP

FAULTING_THREAD: ffff9a03c1e3d140

DPC_TIMEOUT_TYPE: DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED

TRAP_FRAME: fffff8034cdfcf70 – (.trap 0xfffff8034cdfcf70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9a04bd9c99a0 rbx=0000000000000000 rcx=ffff9a04bd9c7c80
rdx=fffff8034cdfd1f0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80793cf9d0a rsp=fffff8034cdfd100 rbp=ffff9a03ecec2a38
r8=0000000021053500 r9=0000000021053507 r10=0000000000000002
r11=fffff8034cdfd5c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nllStm+0x9d0a:
fffff807`93cf9d0a 488bfe mov rdi,rsi
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

PROCESS_NAME: System

SYMBOL_NAME: nllStm+9d0a

MODULE_NAME: nllStm

IMAGE_NAME: nllStm.sys

STACK_COMMAND: .process /r /p 0xffff9a03c1cc7080; .thread 0xffff9a03c1e3d140 ; kb

BUCKET_ID_FUNC_OFFSET: 9d0a

FAILURE_BUCKET_ID: 0x133_ISR_nllStm!unknown_function

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {65cfbfb3-f8a6-9abb-64ea-609a2e533810}

Followup: MachineOwner

There is something wrong with nllStm.sys…

Do either of you have Core Isolation enabled in your OS?

SA

Hi, Mine has “memory integrity” turned off under Core Isolation.

I’ve watched it now before the bluescreen happens and windows shows DPC latency issues with mouse stutter and poor video playback.

@Andrew1 @Llun Please validate that your video and network adapter drivers are the latest version from the OEM who makes your hardware.

SA

I’ve done a few more tests.

First I’ve made sure my video and network drivers are up to date.

So if it may be the network, I disconnected the ethernet and connected over WiFi. When I tried a backup, it was just as bad. Slightly different but bad with mouse stuttering and video not playing properly.

So the failure is when I’m trying to do a backup. The computer has bluescreened every evening for a few days. I checked the last time Norton was updated which was 27/10/2024 to 24.10.9535.1052. My backup software was last updated on the 19/7/2024. So Norton was updated when the problem started.

So, in Norton, I turned Autoprotect off and Behavioural protection off. The fault was still there. I then uninstalled Norton and rebooted. The backup worked perfectly as it had until a few days ago. I noticed that c:\Windows\system32\nllStm.sys was deleted by the uninstall.

During the backup, when the computer stutters, I noticed in Task Manager, that one of the CPU cores is at 100%. Also the CPU usage graphs are generally very spikey. When Norton is uninstalled, the CPU usage is a much smoother graph with each core only around 45-50%.

I ran LU on one of my machines earlier this morning and again just now. Your build of 24.10.9535.1052 was NOT offered to me. I am on 24.10.9535.881 as of this posting. I have zero clue how we all can try to help one another with build appearing to some that others cannot get. Its amazing. And frustrating.

SA

version 24xx updated to build 881 11 1 2024

So I’ve just reinstalled Norton and it has installed the same version as you have i.e. 24.10.9535.881.

I’ve tried it again and unfortunately it has the same problem.

Also, looking in Task Manager, it’s going flat out on one of the CPU cores. The pattern looks very different without Norton when doing exactly the same task. It doesn’t surprise me Window’s WDT times out for the driver as in the bluescreen dump above.

Unfortunately I can’t embed the screen shot jpg of task manager. It lets me upload and previews it OK but then says I can’t embed media items when I click on Reply.

Hello @Andrew1
Please try uploading image to https://postimages.org/
Please try copy Direct link: and paste (space characters to break link) with your message.

for example:
png_20220

https: //i. postimg. cc/FRDnZ2Zr/png-20065. png


or try Preformatted text </>
https://i.postimg.cc/FRDnZ2Zr/png-20065.png
png_20221