BSOD in netio.sys, connected to nllStm.sys in latest Norton 360

SoulAsylum · November 1, 2024, 8:44pm

FYI!! Users have to have attained “basic” trust level on the forums to be able to post screenshots. Unfortunately that is the way the forums are setup presently.

Blockquote Basic

This badge is granted when you reach trust level 1. Thanks for sticking around and reading a few topics to learn what our community is about. New user restrictions have been lifted; you’ve been granted all essential community abilities, such as personal messaging, flagging, wiki editing, and the ability to post multiple images and links.

SA

Andrew1 · November 5, 2024, 9:57pm

Hi,
I wondered if there is any progress on this?

In case it helps, here’s today’s BSOD dump. It’s still saying nllStm.sys hogged the CPU until the DPC watchdog pulled the plug. Is there anywhere in the dll code doing a synchronous call instead of using asynchronous APIs?

Here’s a copy of the stack dump.

[0x0] nt!KeBugCheckEx 0xfffff80006f95e18 0xfffff800094412c6
[0x1] nt!KeAccumulateTicks+0x1d6056 0xfffff80006f95e20 0xfffff800092689f3
[0x2] nt!KeClockInterruptNotify+0x453 0xfffff80006f95e80 0xfffff800092684da
[0x3] nt!HalpTimerClockIpiRoutine+0x1a 0xfffff80006f95f30 0xfffff800092d3735
[0x4] nt!KiCallInterruptServiceRoutine+0xa5 0xfffff80006f95f60 0xfffff8000940034a
[0x5] nt!KiInterruptSubDispatchNoLockNoEtw+0xfa 0xfffff80006f95fb0 0xfffff80009400b77
[0x6] nt!KiInterruptDispatchNoLockNoEtw+0x37 0xfffff80006f8cf70 0xfffff800657f9d00
[0x7] nllStm+0x9d00 0xfffff80006f8d100 0xfffff800657fcdd8
[0x8] nllStm+0xcdd8 0xfffff80006f8d180 0xfffff800657fa0bb
[0x9] nllStm+0xa0bb 0xfffff80006f8d1c0 0xfffff800657f569e
[0xa] nllStm+0x569e 0xfffff80006f8d280 0xfffff80065800d7b
[0xb] nllStm+0x10d7b 0xfffff80006f8d410 0xfffff8000db27aca
[0xc] fwpkclnt!FwppInjectComplete+0x3a 0xfffff80006f8d5d0 0xfffff8000d785e48
[0xd] NETIO!NetioDereferenceNetBufferList+0x88 0xfffff80006f8d600 0xfffff8000d7d8616
[0xe] NETIO!StreamRequestInjectCallback+0x66 0xfffff80006f8d650 0xfffff8000d87622b
[0xf] tcpip!TcpTcbReceive+0x22b 0xfffff80006f8d690 0xfffff8000d87552f
[0x10] tcpip!TcpMatchReceive+0x51f 0xfffff80006f8d8e0 0xfffff8000d8746fd
[0x11] tcpip!TcpReceive+0x44d 0xfffff80006f8db90 0xfffff8000d8a1d02
[0x12] tcpip!TcpNlClientReceiveDatagrams+0x22 0xfffff80006f8dc80 0xfffff8000d86a9dc
[0x13] tcpip!IppProcessDeliverList+0xcc 0xfffff80006f8dcc0 0xfffff8000d8670ba
[0x14] tcpip!IppReceiveHeaderBatch+0x3aa 0xfffff80006f8dda0 0xfffff8000d86b8f0
[0x15] tcpip!IppFlcReceivePacketsCore+0x4d0 0xfffff80006f8dea0 0xfffff8000d990e5e
[0x16] tcpip!IppIndicatePrevalidatedPacketsToIpsServiceChain+0x162 0xfffff80006f8dfb0 0xfffff8000d8de01e
[0x17] tcpip!IpFlcReceivePreValidatedPackets+0x89ace 0xfffff80006f8e040 0xfffff8000d8aa42f
[0x18] tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x12f 0xfffff80006f8e2e0 0xfffff800092914a8
[0x19] nt!KeExpandKernelStackAndCalloutInternal+0x78 0xfffff80006f8e430 0xfffff8000929141d
[0x1a] nt!KeExpandKernelStackAndCalloutEx+0x1d 0xfffff80006f8e4a0 0xfffff8000d880d7d
[0x1b] tcpip!NetioExpandKernelStackAndCallout+0x8d 0xfffff80006f8e4e0 0xfffff8000d88045d
[0x1c] tcpip!FlReceiveNetBufferListChain+0x46d 0xfffff80006f8e540 0xfffff8000d601eb1
[0x1d] ndis!ndisMIndicateNetBufferListsToOpen+0x141 0xfffff80006f8e7f0 0xfffff8000d601ccb
[0x1e] ndis!ndisMTopReceiveNetBufferLists+0x22b 0xfffff80006f8e8d0 0xfffff8000d607de1
[0x1f] ndis!ndisCallReceiveHandler+0x61 0xfffff80006f8e950 0xfffff8000d63ea9f
[0x20] ndis!ndisInvokeNextReceiveHandler+0x1df 0xfffff80006f8e9a0 0xfffff8000d604984
[0x21] ndis!NdisMIndicateReceiveNetBufferLists+0x104 0xfffff80006f8ea70 0xfffff80019dbfc52
[0x22] vmswitch!VmsMpNicPvtReceiveRssProcessNblGroup+0x82 0xfffff80006f8eb00 0xfffff80019d9f0fa
[0x23] vmswitch!VmsVrssDpc+0x7a 0xfffff80006f8eb60 0xfffff8000921f4de
[0x24] nt!KiExecuteAllDpcs+0x30e 0xfffff80006f8ebb0 0xfffff8000921e7c4
[0x25] nt!KiRetireDpcList+0x1f4 0xfffff80006f8ed20 0xfffff80009406bc5
[0x26] nt!KxRetireDpcList+0x5 0xfffff80006f8efb0 0xfffff800094069b0
[0x27] nt!KiDispatchInterruptContinue 0xffffcb8a50a9f9c0 0xfffff800094060f5
[0x28] nt!KiDpcInterruptBypass+0x25 0xffffcb8a50a9f9f0 0xfffff80009400411
[0x29] nt!KiInterruptDispatch+0xb1 0xffffcb8a50a9fa00 0x4517e4
[0x2a] 0x4517e4 0x94b4f0 0x0

Here’s the WinDgb dump.

                   Bugcheck Analysis                                    *

DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: fffff80009cfb320, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding this single DPC timeout

Debugging Details:

*** Either you specified an unqualified symbol, or your debugger ***
*** doesn’t have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing “.symopt- 100”. Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***

*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***

*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***

*** Type referenced: TickPeriods ***

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 2406

Key  : Analysis.Elapsed.mSec
Value: 2426

Key  : Analysis.IO.Other.Mb
Value: 0

Key  : Analysis.IO.Read.Mb
Value: 1

Key  : Analysis.IO.Write.Mb
Value: 6

Key  : Analysis.Init.CPU.mSec
Value: 875

Key  : Analysis.Init.Elapsed.mSec
Value: 28355

Key  : Analysis.Memory.CommitPeak.Mb
Value: 129

Key  : Analysis.Version.DbgEng
Value: 10.0.27725.1000

Key  : Analysis.Version.Description
Value: 10.2408.27.01 amd64fre

Key  : Analysis.Version.Ext
Value: 1.2408.27.1

Key  : Bugcheck.Code.KiBugCheckData
Value: 0x133

Key  : Bugcheck.Code.LegacyAPI
Value: 0x133

Key  : Bugcheck.Code.TargetModel
Value: 0x133

Key  : Failure.Bucket
Value: 0x133_DPC_nllStm!unknown_function

Key  : Failure.Hash
Value: {f1ff159c-ec23-1f77-4bfa-5f3d84e6d5ed}

Key  : Hypervisor.Enlightenments.Value
Value: 68669340

Key  : Hypervisor.Enlightenments.ValueHex
Value: 417cf9c

Key  : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key  : Hypervisor.Flags.ApicEnlightened
Value: 1

Key  : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 0

Key  : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key  : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key  : Hypervisor.Flags.CpuManager
Value: 1

Key  : Hypervisor.Flags.DeprecateAutoEoi
Value: 0

Key  : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key  : Hypervisor.Flags.Epf
Value: 0

Key  : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key  : Hypervisor.Flags.HardwareMbecAvailable
Value: 0

Key  : Hypervisor.Flags.MaxBankNumber
Value: 0

Key  : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key  : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key  : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key  : Hypervisor.Flags.Phase0InitDone
Value: 1

Key  : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key  : Hypervisor.Flags.RootScheduler
Value: 0

Key  : Hypervisor.Flags.SynicAvailable
Value: 1

Key  : Hypervisor.Flags.UseQpcBias
Value: 0

Key  : Hypervisor.Flags.Value
Value: 4722927

Key  : Hypervisor.Flags.ValueHex
Value: 4810ef

Key  : Hypervisor.Flags.VpAssistPage
Value: 1

Key  : Hypervisor.Flags.VsmAvailable
Value: 1

Key  : Hypervisor.RootFlags.AccessStats
Value: 1

Key  : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key  : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key  : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key  : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key  : Hypervisor.RootFlags.IsHyperV
Value: 1

Key  : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key  : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key  : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key  : Hypervisor.RootFlags.Nested
Value: 0

Key  : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key  : Hypervisor.RootFlags.Value
Value: 1015

Key  : Hypervisor.RootFlags.ValueHex
Value: 3f7

Key  : SecureKernel.HalpHvciEnabled
Value: 0

Key  : Stack.Pointer
Value: ISR

Key  : WER.OS.Branch
Value: vb_release

Key  : WER.OS.Version
Value: 10.0.19041.1

BUGCHECK_CODE: 133

BUGCHECK_P1: 0

BUGCHECK_P2: 501

BUGCHECK_P3: 500

BUGCHECK_P4: fffff80009cfb320

FILE_IN_CAB: MEMORY.DMP

FAULTING_THREAD: ffff910fbd73f580

DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED

TRAP_FRAME: fffff80006f8cf70 – (.trap 0xfffff80006f8cf70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff910fe439ced0 rbx=0000000000000000 rcx=ffff910fe439c470
rdx=fffff80006f8d1f0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800657f9d00 rsp=fffff80006f8d100 rbp=ffff910fc639e328
r8=00000000432e5e00 r9=00000000432e5eea r10=0000000000000002
r11=fffff80006f8d5c8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
nllStm+0x9d00:
fffff800`657f9d00 4885f6 test rsi,rsi
Resetting default scope

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

PROCESS_NAME: idwutil_600.exe

STACK_TEXT:
fffff80006f95e18 fffff800094412c6 fffff80006f95e20 fffff800092689f3 fffff80006f95e80 fffff800092684da fffff80006f95f30 fffff800092d3735 fffff80006f95f60 fffff8000940034a fffff80006f95fb0 fffff80009400b77 fffff80006f8cf70 fffff800657f9d00 fffff80006f8d100 fffff800657fcdd8 fffff80006f8d180 fffff800657fa0bb fffff80006f8d1c0 fffff800657f569e fffff80006f8d280 fffff80065800d7b fffff80006f8d410 fffff8000db27aca fffff80006f8d5d0 fffff8000d785e48 fffff80006f8d600 fffff8000d7d8616 fffff80006f8d650 fffff8000d87622b fffff80006f8d690 fffff8000d87552f fffff80006f8d8e0 fffff8000d8746fd fffff80006f8db90 fffff8000d8a1d02 fffff80006f8dc80 fffff8000d86a9dc fffff80006f8dcc0 fffff8000d8670ba fffff80006f8dda0 fffff8000d86b8f0 fffff80006f8dea0 fffff8000d990e5e fffff80006f8dfb0 fffff8000d8de01e fffff80006f8e040 fffff8000d8aa42f fffff80006f8e2e0 fffff800092914a8 fffff80006f8e430 fffff8000929141d fffff80006f8e4a0 fffff8000d880d7d fffff80006f8e4e0 fffff8000d88045d fffff80006f8e540 fffff8000d601eb1 fffff80006f8e7f0 fffff8000d601ccb fffff80006f8e8d0 fffff8000d607de1 fffff80006f8e950 fffff8000d63ea9f fffff80006f8e9a0 fffff8000d604984 fffff80006f8ea70 fffff80019dbfc52 fffff80006f8eb00 fffff80019d9f0fa fffff80006f8eb60 fffff8000921f4de fffff80006f8ebb0 fffff8000921e7c4 fffff80006f8ed20 fffff80009406bc5 fffff80006f8efb0 fffff800094069b0 ffffcb8a50a9f9c0 fffff800094060f5 ffffcb8a50a9f9f0 fffff80009400411 ffffcb8a50a9fa00 00000000004517e4 000000000094b4f0 0000000000000000 : 0000000000000133 0000000000000000 0000000000000501 0000000000000500 : nt!KeBugCheckEx
: 00051ca0f9d5f002 fffff80005219180 0000000000000000 fffff80005219180 : nt!KeAccumulateTicks+0x1d6056
: fffff80009cf3b00 fffff80006f8cff0 fffff8000d0c1500 0000000000005001 : nt!KeClockInterruptNotify+0x453
: fffff80009cf3b00 0000000000000000 0000000000000000 ffffa7a4fed2c36b : nt!HalpTimerClockIpiRoutine+0x1a
: fffff80006f8cff0 fffff80009cf3b00 ffff910fb8bd2bc8 0000000000000000 : nt!KiCallInterruptServiceRoutine+0xa5
: ffff910fa85c3180 015001c09aea8620 0000000000000000 fffff80000000000 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
: 00000000000000f0 0000000000000471 0000000000000000 fffff8000c9d2328 : nt!KiInterruptDispatchNoLockNoEtw+0x37
: ffff910fb8bd2a20 fffff80006f8d1f0 ffff910faeec6a00 00000000432e5eea : nllStm+0x9d00
: ffff910fb8bd2a20 fffff80006f8d1f0 0000000000000000 00000000432e5eea : nllStm+0xcdd8
: ffff910fb8bd2a20 ffff910f00008001 00000000432e5eea ffff910faefa2001 : nllStm+0xa0bb
: ffff910faefa2010 ffff910fcbfc6790 0000000000000000 fffff8000d878e01 : nllStm+0x569e
: ffff910fcbfc6790 ffff910fd7043da0 0000000000000000 0000000000000000 : nllStm+0x10d7b
: ffff910fd7043da0 ffff910fae31aa51 0000000000000000 fffff80000000000 : fwpkclnt!FwppInjectComplete+0x3a
: fffff80006f8d790 0000000000000000 ffff910fd37ee430 0000000000000000 : NETIO!NetioDereferenceNetBufferList+0x88
: 00000000ffffffff 00000000ffffffff fffff80006f8d790 ffff910fd37ee430 : NETIO!StreamRequestInjectCallback+0x66
: 0000000000000028 0000000000000000 000000000006ce76 ffff910f9fe909a0 : tcpip!TcpTcbReceive+0x22b
: ffff910fb0b4c6c2 ffff910f9bf38040 ffff910fb0b4bd32 00000000c0a801b0 : tcpip!TcpMatchReceive+0x51f
: ffff910fa34859ef 0000000000000017 0000000000000000 ffff910f9fe90c01 : tcpip!TcpReceive+0x44d
: ffff910fc4addc80 0000000000000000 0000000000000000 ffff910f9bea7140 : tcpip!TcpNlClientReceiveDatagrams+0x22
: 0000000000000000 ffff910f9fe90c30 0000000000000000 fffff8000da19a70 : tcpip!IppProcessDeliverList+0xcc
: fffff8000da19a70 ffff910f9fe868a0 fffff8000da19a70 0000000000000000 : tcpip!IppReceiveHeaderBatch+0x3aa
: 0000000000000000 ffff910fa046e740 ffff910fa046e701 0000000000000001 : tcpip!IppFlcReceivePacketsCore+0x4d0
: 0000000000000001 ffff910fa8972030 0000000000000000 ffff910fa046e740 : tcpip!IppIndicatePrevalidatedPacketsToIpsServiceChain+0x162
: ffff910fa06f37a0 ffff910fa07468a0 0000000000000000 0000000000000000 : tcpip!IpFlcReceivePreValidatedPackets+0x89ace
: ffff910f9feea660 0000000000000002 ffff910fbd73f580 fffff80006f8e5d8 : tcpip!FlReceiveNetBufferListChainCalloutRoutine+0x12f
: fffff8000d8aa300 fffff80006f8e5d8 ffff910f9beef8e0 0000000000000000 : nt!KeExpandKernelStackAndCalloutInternal+0x78
: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KeExpandKernelStackAndCalloutEx+0x1d
: 0000000000000001 fffff80006f8e640 ffff910fa07468a0 ffff910fb0b4bd16 : tcpip!NetioExpandKernelStackAndCallout+0x8d
: ffff910fa07408a0 ffff910fa8972030 0000000000000001 0000000000000037 : tcpip!FlReceiveNetBufferListChain+0x46d
: ffff910fa03edba0 0000000000000001 ffff910f00000000 0000000000000037 : ndis!ndisMIndicateNetBufferListsToOpen+0x141
: ffff910fa05a01a0 ffff910fa8972001 ffff910fa05a01a0 ffff910f00000000 : ndis!ndisMTopReceiveNetBufferLists+0x22b
: ffff910fa8972030 fffff80006f8ea21 0000000000000000 fffff80006f8eb58 : ndis!ndisCallReceiveHandler+0x61
: 000000000159b957 0000000000000001 ffff910fa05a01a0 0000000000000001 : ndis!ndisInvokeNextReceiveHandler+0x1df
: 0000000000000001 0000000000000001 0000000000000001 ffff910fa8972030 : ndis!NdisMIndicateReceiveNetBufferLists+0x104
: ffff910fa0384940 0000000000000000 ffff910fa0334000 0000000000400a02 : vmswitch!VmsMpNicPvtReceiveRssProcessNblGroup+0x82
: ffff910fa03847c0 0000000000000000 fffff8000521c240 fffff80000000002 : vmswitch!VmsVrssDpc+0x7a
: fffff7ea8001c8d8 0000000000000008 0000000000000008 0000000000ce1118 : nt!KiExecuteAllDpcs+0x30e
: 0000000000000000 fffff80005219180 ffffa8811e5b4280 0000000000000002 : nt!KiRetireDpcList+0x1f4
: ffffa8811e5b4280 fffff800092fc2ca 0000000000000000 0000000000000000 : nt!KxRetireDpcList+0x5
: 0000000000000002 fffff80009400411 0000000080046c90 ffff910fbe991f60 : nt!KiDispatchInterruptContinue
: 0000000080046c90 ffff910fbe991f60 0000000000000000 ffffcb8a50a9fa80 : nt!KiDpcInterruptBypass+0x25
: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : nt!KiInterruptDispatch+0xb1
: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 : 0x4517e4

SYMBOL_NAME: nllStm+9d00

MODULE_NAME: nllStm

IMAGE_NAME: nllStm.sys

STACK_COMMAND: .process /r /p 0xffff910fc52d7340; .thread 0xffff910fbd73f580 ; kb

BUCKET_ID_FUNC_OFFSET: 9d00

FAILURE_BUCKET_ID: 0x133_DPC_nllStm!unknown_function

OS_VERSION: 10.0.19041.1

BUILDLAB_STR: vb_release

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {f1ff159c-ec23-1f77-4bfa-5f3d84e6d5ed}

Followup: MachineOwner

Llun · November 5, 2024, 10:10pm

Hello again. After a fresh install of Windows 11 24H2, I got another BSOD from AdGuard, a program that was installed. Since I uninstalled ii, my PC is running smooth (calling Windows 24H2 smooth is a bit strange…LOL). Norton 360 feels like an incomplete program, as almost any software nowadays,

SoulAsylum · November 5, 2024, 11:09pm

How is AdGuard related to Norton? The file previously referenced as being removed from Windows is actually installed in Norton on my side, Windows 10 Pro. It is absent in C:\Windows\System32. The file is listed as a Gen Stream Filter. The original file name was awsStm.sys related to Amazon web services. I believe that is the issue, AWS is causing some sort of IO timing issue on some hardware and not others.

SA

Andrew1 · November 8, 2024, 9:56pm

Hi,

I’ve double checked on my system. If I uninstall Norton c:\Windows\System32\Drivers\nllStm.sys disappears and reappears when I reinstall.

My backup system, IDrive, does use Amazon Web Services as the cloud storage.
Using IDrive with Norton installed causes a daily BSOD.
Using IDrive without Norton installed does not cause the BSOD.

The problem started around the 28th October when the last Norton update happened.
IDrive has not updated since the 19th July, 2024.

So I agree nllStm.sys is causing the issue.

Llun · November 8, 2024, 10:00pm

Norton was working fine until the last update and now, together with Windows 11 24H2, my computer is a mess with programs not behaving like they should…

SoulAsylum · November 8, 2024, 10:04pm

@Llun Windows 11 24H2 is full of issues, I would be looking mainly at that update. I’ve got it blocked on all my Window 11 machines for that reason. I’m just fed up with being a BETA tester for Microsoft and not even a member of the Insiders fiasco anymore.

SA

Andrew1 · December 23, 2024, 10:33am

Is there any update on this issue. I’ve bought a new computer which is much faster with a Xeon W2500 processor which should address the previous comment about it being a timing issue on some hardware. I’ve installed Window 11 whereas I was using Windows 10 previously.
I’ve installed my backup software which uses AWS. I’ve installed the latest Norton. And I still get the BSOD in nllStm.sys. Is there a way of going back to the previous version of Norton but still get the latest virus protection?

usuario_a11 · February 8, 2025, 7:08pm

@Andrew1, Hello, I have this issue here too. When I backup using Idrive or Macrium Reflect, music playing stops and mouse lags a lot.

I tried updating Idrive to version 7 (I was also in version 6 of july 2024) and reinstalling AMD driver from official program (because it was replaced automatically by Windows update).
So we have somethings in common: AMD, Idrive, Norton and an unusable computer during backups.

Have you found a solution ?

Right now I have to uninstall Norton every time I want to do a backup.

Andrew1 · February 9, 2025, 2:38pm

@usuario_a11 Hi, unfortunately I’ve not found a solution. I think the reason music stops and the mouse lags is that there’s a thread in nllStm.sys (for AWS which is what IDrive uses) which is doing something like a busy wait. You can see it on Task Manager where one of the CPU cores goes to 100%. It must be in a high priority interrupt to stop the mouse responding. Which is why I often get the BSOD as Windows sees the driver has hogged the CPU for too long and decides the system is unstable.

This can’t be hard to fix for someone with the source code.

I also found uninstalling it was necessary to do safely do a full backup. Just disabling Norton for an hour, for example, doesn’t fix it.

This version also made software development impossible as well. When I hit F5 in Visual Studio to build and run, a 1-2 second build becomes a 30 second nightmare. This ridiculousness also started with the same version that created the backup problems.

I think the only solution is to research the current state of the anti virus software market.

Puzzler · February 9, 2025, 8:34pm

@Andrew1 @usuario_a11

Some of N360 users have reverted back to V22 while we wait for Norton to work out the bugs in both V24 and V25. It’s a last resort but V22 has been performing solidly, just as before the introduction of V24. If interested @SoulAsylum has posted instructions here Revert to Version 22.24.8.36 safe source file to download - #13 by SoulAsylum

SoulAsylum · February 10, 2025, 1:24am

@Andrew1 Do you have any screenshots to share of the BSOD which may have a the stop code?

In your earlier posting idwutil_600.exe is listed as the first faulting process with BUGCHECK_CODE: 133 and FAILURE_BUCKET_ID: 0x133 also listed. Drivers are the usual cause for fault bucket 133 when invoked in this manner.

https://answers.microsoft.com/en-us/windows/forum/all/what-is-idwutil600exe/628e3f10-5267-4bfd-aa17-4c30ff853df1

SA

Andrew1 · February 11, 2025, 12:47pm

0: kd> !analyze -v

                   Bugcheck Analysis                                    *

DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000500, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: fffff803927c33a0, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding this single DPC timeout

Debugging Details:

*** Either you specified an unqualified symbol, or your debugger ***
*** doesn’t have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing “.symopt- 100”. Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***

*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***

*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***

*** Type referenced: TickPeriods ***

KEY_VALUES_STRING: 1

Key  : Analysis.CPU.mSec
Value: 1265

Key  : Analysis.Elapsed.mSec
Value: 1271

Key  : Analysis.IO.Other.Mb
Value: 0

Key  : Analysis.IO.Read.Mb
Value: 1

Key  : Analysis.IO.Write.Mb
Value: 0

Key  : Analysis.Init.CPU.mSec
Value: 656

Key  : Analysis.Init.Elapsed.mSec
Value: 2990

Key  : Analysis.Memory.CommitPeak.Mb
Value: 88

Key  : Analysis.Version.DbgEng
Value: 10.0.27725.1000

Key  : Analysis.Version.Description
Value: 10.2408.27.01 amd64fre

Key  : Analysis.Version.Ext
Value: 1.2408.27.1

Key  : Bugcheck.Code.LegacyAPI
Value: 0x133

Key  : Bugcheck.Code.TargetModel
Value: 0x133

Key  : Dump.Attributes.AsUlong
Value: 21808

Key  : Dump.Attributes.DiagDataWrittenToHeader
Value: 1

Key  : Dump.Attributes.ErrorCode
Value: 0

Key  : Dump.Attributes.KernelGeneratedTriageDump
Value: 1

Key  : Dump.Attributes.LastLine
Value: Dump completed successfully.

Key  : Dump.Attributes.ProgressPercentage
Value: 0

Key  : Failure.Bucket
Value: 0x133_DPC_nllStm!unknown_function

Key  : Failure.Hash
Value: {f1ff159c-ec23-1f77-4bfa-5f3d84e6d5ed}

Key  : Hypervisor.Enlightenments.ValueHex
Value: 7417df84

Key  : Hypervisor.Flags.AnyHypervisorPresent
Value: 1

Key  : Hypervisor.Flags.ApicEnlightened
Value: 0

Key  : Hypervisor.Flags.ApicVirtualizationAvailable
Value: 1

Key  : Hypervisor.Flags.AsyncMemoryHint
Value: 0

Key  : Hypervisor.Flags.CoreSchedulerRequested
Value: 0

Key  : Hypervisor.Flags.CpuManager
Value: 1

Key  : Hypervisor.Flags.DeprecateAutoEoi
Value: 1

Key  : Hypervisor.Flags.DynamicCpuDisabled
Value: 1

Key  : Hypervisor.Flags.Epf
Value: 0

Key  : Hypervisor.Flags.ExtendedProcessorMasks
Value: 1

Key  : Hypervisor.Flags.HardwareMbecAvailable
Value: 1

Key  : Hypervisor.Flags.MaxBankNumber
Value: 0

Key  : Hypervisor.Flags.MemoryZeroingControl
Value: 0

Key  : Hypervisor.Flags.NoExtendedRangeFlush
Value: 0

Key  : Hypervisor.Flags.NoNonArchCoreSharing
Value: 1

Key  : Hypervisor.Flags.Phase0InitDone
Value: 1

Key  : Hypervisor.Flags.PowerSchedulerQos
Value: 0

Key  : Hypervisor.Flags.RootScheduler
Value: 0

Key  : Hypervisor.Flags.SynicAvailable
Value: 1

Key  : Hypervisor.Flags.UseQpcBias
Value: 0

Key  : Hypervisor.Flags.Value
Value: 55185662

Key  : Hypervisor.Flags.ValueHex
Value: 34a10fe

Key  : Hypervisor.Flags.VpAssistPage
Value: 1

Key  : Hypervisor.Flags.VsmAvailable
Value: 1

Key  : Hypervisor.RootFlags.AccessStats
Value: 1

Key  : Hypervisor.RootFlags.CrashdumpEnlightened
Value: 1

Key  : Hypervisor.RootFlags.CreateVirtualProcessor
Value: 1

Key  : Hypervisor.RootFlags.DisableHyperthreading
Value: 0

Key  : Hypervisor.RootFlags.HostTimelineSync
Value: 1

Key  : Hypervisor.RootFlags.HypervisorDebuggingEnabled
Value: 0

Key  : Hypervisor.RootFlags.IsHyperV
Value: 1

Key  : Hypervisor.RootFlags.LivedumpEnlightened
Value: 1

Key  : Hypervisor.RootFlags.MapDeviceInterrupt
Value: 1

Key  : Hypervisor.RootFlags.MceEnlightened
Value: 1

Key  : Hypervisor.RootFlags.Nested
Value: 0

Key  : Hypervisor.RootFlags.StartLogicalProcessor
Value: 1

Key  : Hypervisor.RootFlags.Value
Value: 1015

Key  : Hypervisor.RootFlags.ValueHex
Value: 3f7

Key  : Stack.Pointer
Value: ISR

BUGCHECK_CODE: 133

BUGCHECK_P1: 0

BUGCHECK_P2: 500

BUGCHECK_P3: 500

BUGCHECK_P4: fffff803927c33a0

FILE_IN_CAB: 011825-9468-01.dmp

TAG_NOT_DEFINED_202b: *** Unknown TAG in analysis list 202b

DUMP_FILE_ATTRIBUTES: 0x21808
Kernel Generated Triage Dump

FAULTING_THREAD: fffff803927d0640

DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED

BLACKBOXBSD: 1 (!blackboxbsd)

BLACKBOXNTFS: 1 (!blackboxntfs)

BLACKBOXPNP: 1 (!blackboxpnp)

BLACKBOXWINLOGON: 1

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

STACK_TEXT:
fffff80323d6fcd8 fffff80391b75129 : 0000000000000133 0000000000000000 0000000000000500 0000000000000500 : nt!KeBugCheckEx
fffff80323d6fce0 fffff80391b67b61 : fffff803927c33a0 0000000000000000 0000000000000002 000000000133d646 : nt!KeAccumulateTicks+0x589
fffff80323d6fd50 fffff80391a6ebfb : 000002ddf0cf4af2 0000000000000000 000002ddf0cefca6 fffff80392610980 : nt!KiUpdateRunTime+0xc9
fffff80323d6fdd0 fffff80391a702ad : fffff80392610980 0000000000000000 fffff80392610a30 fffff8039278dd70 : nt!KeClockInterruptNotify+0x96b
fffff80323d6ff50 fffff80391e7be9e : 0000000000000002 fffff80392610980 fffff80323d5d340 000002ddf1927336 : nt!KiCallInterruptServiceRoutine+0x2ed
fffff80323d6ffb0 fffff80391e7c6ac : ffff86857f069c08 fffff8031faf5180 0000000000000002 0000000000000001 : nt!KiInterruptSubDispatchNoLockNoEtw+0x4e
fffff80323d5d340 fffff80347379cf7 : 0000000000000000 ffff8685dea95070 ffff8685af86a450 0000000000000001 : nt!KiInterruptDispatchNoLockNoEtw+0x3c
fffff80323d5d4d0 0000000000000000 : ffff8685dea95070 ffff8685af86a450 0000000000000001 0000000000000000 : nllStm+0x9cf7

SYMBOL_NAME: nllStm+9cf7

MODULE_NAME: nllStm

IMAGE_NAME: nllStm.sys

STACK_COMMAND: .process /r /p 0xfffff803927cdf80; .thread 0xfffff803927d0640 ; kb

BUCKET_ID_FUNC_OFFSET: 9cf7

FAILURE_BUCKET_ID: 0x133_DPC_nllStm!unknown_function

OSPLATFORM_TYPE: x64

OSNAME: Windows 10

FAILURE_ID_HASH: {f1ff159c-ec23-1f77-4bfa-5f3d84e6d5ed}

Followup: MachineOwner

wesam_o · February 11, 2025, 6:12pm

Hi man did you find any solution yet, I still have the same problem.

Andrew1 · February 12, 2025, 11:10am

I wish!

usuario_a11 · February 12, 2025, 12:37pm

Thank you so much for taking the time to explain the issue. It helped me a lot.

SoulAsylum · February 12, 2025, 9:59pm

@Andrew1 Disable NETBIOS in your internet adapter and restart the machine to retest. I’m curious as to whether this call for Netbios is from your internet adapter.

SA

baldeagle1 · March 28, 2025, 3:25pm

Has anyone found a solution to this problem. I installed the newest version of Norton 360 about 2 months ago and I also have Idrive installed. I began to have the same problems of BSODs and computer freezing, which eluded my troubleshooting to the point I was ready to buy a new computer. But now after uninstalling Norton 360, everything is fine.

SoulAsylum · March 29, 2025, 8:27pm

Another question out to everyone in the thread with issues. Do any of you have Next Level Security Systems software resident on your systems or any other security software running at the router level?

SA

BSOD in netio.sys, connected to nllStm.sys in latest Norton 360

Debugging Details:

Followup: MachineOwner

Debugging Details:

Followup: MachineOwner

Announcements