Norton 360 und AdGuard zusammen erzeugen sporadische Abstürze

Norton 360 for Windows
1

Hallo zusammen,

ich nutze Norton 360 und AdGuard (beide Versionen sind die aktuellsten) für Windows unter Windows und habe ein hartnäckiges Problem, das sich bei mir so darstellt:

1. BSODs durch WFP-Treiberkollision Seit beide Programme installiert sind, treten sporadische BSODs auf. Die Windows-Fehlerberichterstattung (WER, Ereignis-ID 1019) verknüpft den Absturz vom 2026-09-01 07:39:21 mit NETIO.SYS – also dem Windows-Netzwerk-I/O-Subsystem, in dem die Windows Filtering Platform (WFP) sitzt. Da Norton 360 und AdGuard beide WFP-Filtertreiber registrieren, vermute ich, dass sich die beiden Filter im Kernel kollidieren; NETIO.SYS ist dabei eher Kollisionsort als Verursacher. Die Minidump-Analyse (BlueScreenView) bestätigt die Beteiligung des WFP-Subsystems.

2. Gegenseitige Ausschlüsse haben nichts gebracht AdGuard-Prozesse (Adguard.exe, AdguardSvc.exe) sind in Norton ausgeschlossen, Norton-Prozesse in AdGuard ausgeschlossen – die BSODs kommen trotzdem sporadisch.

3. Sockfilter umgeht die BSODs, bricht aber Betterbird Schalte ich AdGuard vom WFP- auf den experimentellen Sockfilter-Treiber um, treten keine BSODs mehr auf – was die WFP-Kollision zusätzlich bestätigt. Allerdings kann Betterbird dann keine E-Mails mehr abholen (Timeout bei IMAP/SMTP). App-Ausschlüsse für Betterbird (App-Verwaltung und Low-Level-Einstellung „App von der Filterung ausschließen – vollständiger Pfad") beheben das nicht.

4. TDI ist keine Option TDI funktioniert zwar, ist aber deprecated und wird lt. Knowledge Base entfernt.

Meine Fragen an euch:

  • Kennt jemand eine funktionierende Einstellungs-Kombination, um AdGuard (WFP) und Norton 360 stabil zusammen zu betreiben?

  • Hat jemand Erfahrung mit bspw. deaktivierter Intrusion Prevention oder „Block vulnerable kernel drivers" bei Norton – löst das die Kollision?

  • Gibt es einen Workaround, einzelne Apps (wie Betterbird) unter dem Sockfilter-Treiber sauber vom Sockfilter auszuschließen?

Ich möchte beide Produkte produktiv einsetzen (Norton als AV-Schutz, AdGuard als systemweiter Werbe-/Trackerblocker) und suche nach einer tragfähigen Lösung – auch über eine reine Konfiguration hinaus bin ich für Hinweise dankbar. Ebenso interessiert mich, ob andere hier dieselbe Kombination erfolgreich am Laufen haben.

Danke vorab!

1 Like
2

I have no experience with AdBlocker, but a quick search gave this older support article that specifically notes " While a WFP driver is generally preferrable and is enabled by default for all newer Windows OS versions (Windows 8 and newer), it can potentially cause compatibility problems, especially with some antiviruses."

Have you posted your issue to AdGuard’s support to see if they can provide any insight?

1 Like
3

@Andreas_Busch If you have read your Windows dump file, is “nvlddmkm.sys” referenced there?

AI Overview

The nvlddmkm.sys blue screen error is caused by a crash or timeout in your NVIDIA graphics card driver. [1]

Common Fixes for nvlddmkm.sys

  • Clean reinstall drivers: Boot into Safe Mode and use a tool like Display Driver Uninstaller (widely recommended on forums like Tom’s Hardware) to remove old NVIDIA files completely, then install a fresh driver from the NVIDIA Driver Download page. [1]

  • Check file permissions: Grant full control permissions to the nvlddmkm.sys file located in C:\Windows\System32\drivers via its properties security tab, as permissions can get locked or corrupted by system updates. [1, 2]

  • Disable power saving: Open Control Panel, go to Power Options, and change advanced settings for your PCIe / wireless adapter state to maximum performance to prevent power throttling. [1]

  • Test hardware stability: Ensure your GPU isn’t overheating, lower overclocking or use software like MSI Afterburner to slightly underclock the core clock, and run a memory check if the error persists

Additionally please tell us what your full version of Windows is, include its build as well. Do you also have an Nvidia GPU?

My cross reference to the above: “WER, Event ID 1019”

AI Overview

Windows Error Reporting (WER) Event ID 1019 typically indicates that the computer has unexpectedly rebooted or recovered from a bug check (a Blue Screen of Death or critical kernel-level failure), often pointing to hardware instability or a faulty driver like nvlddmkm.sys. [1, 2]

What Event ID 1019 Means

  • Bugcheck Recovery: Windows successfully recorded that the system restarted following a critical system error or crash.

  • Associated Logs: It frequently appears alongside Event ID 1001 (WER fault reporting) or LiveKernelEvent entries.

  • Common Triggers: Outdated or corrupted graphics drivers (such as NVIDIA’s nvlddmkm.sys), unstable hardware overclocks, failing power supplies, or recent BIOS/firmware updates. (Note: If you are working in a Citrix environment, Event ID 1019 can alternatively refer to a Citrix TDICA transport driver connection or SSL handshake issue rather than a system bugcheck). [1, 2, 3, 4, 5]

How to Troubleshoot and Fix It

  • Check the Error Details: Open the Event Viewer, click on the specific 1019 event, and read the text in the General tab. Look for a “Possibly related driver” mention or a bugcheck code (like 0x00000116 or VIDEO_TDR_FAILURE). [1, 2]

  • Clean-Install GPU Drivers: If a graphics driver is named, use a tool like Display Driver Uninstaller (DDU) in Safe Mode to completely wipe your display drivers, then install the latest stable version from the manufacturer. [1]

  • Revert Overclocks and BIOS: Remove any CPU or RAM memory (XMP/EXPO) overclocks. If the crashes started after a recent motherboard update, consider rolling back to a more stable BIOS version. [1]

  • Test System Stability: Run hardware diagnostics like MemTest86 for RAM or OCCT/Prime95 for the CPU and power supply to isolate failing hardware components

Does Removal of Norton temporarily remove the BSOD issue? FWIW, TDI has already been depreciated with the introduction of Windows 8 and higher versions. Newer versions of Windows should NOT try falling back on TDI.

AI Overview

Yes, Windows now blocks unregistered third-party Transport Driver Interface (TDI) transports following security updates released in July 2026. [1, 2]

What Changed

  • Enforcement: Starting with the July 14, 2026, security updates, Windows actively enforces TDI transport registration requirements that were previously unenforced. [1, 2]

  • Blocking: Windows now blocks and logs unregistered third-party TDI providers. [1]

  • Impact: Applications using sockets over unregistered third-party TDI transports may stop working. Properly registered TDI transports are not affected. [1, 2]

Background and Alternatives

  • Deprecation: TDI is a legacy feature from older Windows eras and has long been deprecated by Microsoft in favor of newer APIs.

  • Recommended Replacements: Microsoft recommends developers transition to the Windows Filtering Platform (WFP) or Winsock Kernel (WSK).

  • Read the official guidance on Third-party TDI transports might stop working after installing Windows security updates released on or after July 14, 2026.

  • Check BleepingComputer’s coverage on Microsoft releases Windows 10 KB5099539 extended security update.

  • View the server impacts in the July 14, 2026—KB5099536 (OS Build 26100.33158)

Are you also using Thunderbird?

SA

2 Likes
4

Thanks for digging that up! Yes, that’s exactly the article I based my diagnosis on – it confirms the WFP-vs-antivirus compatibility issue, which is what I’m experiencing (BSODs linked to NETIO.SYS, i.e. the WFP subsystem itself).

However, the suggested workaround from that article (switching to TDI) doesn’t really resolve it for me: AdGuard now considers TDI deprecated and plans to remove it, and the current recommended replacement (the experimental SockFilter driver, introduced in v7.22.4 precisely to avoid WFP conflicts) breaks my email client (Betterbird – IMAP/SMTP timeouts, even with app exclusions in place).

And yes, I have contacted AdGuard support with the full picture (minidump analysis, event logs, tested exclusions). I’m waiting for their response, but I was hoping someone here might have hands-on experience running Norton 360 together with a WFP-based ad blocker – specifically whether disabling Norton’s Intrusion Prevention or “Block vulnerable kernel drivers” helps stabilize the combination.

5

Thank you for the detailed reply! Let me answer your questions point by point:

Regarding nvlddmkm.sys: The dump/WER event points to NETIO.SYS (the Windows Filtering Platform network subsystem), not nvlddmkm.sys. I’ll double-check the full bugcheck code and post it here, but so far there is no indication of a GPU-related failure. The key evidence for the WFP-collision theory: switching AdGuard from the WFP driver to the experimental SockFilter driver stops the BSODs entirely – a pure GPU/hardware issue wouldn’t behave that way.

Regarding TDI: Good point, and this aligns with what AdGuard themselves say – TDI is deprecated on their side as well, so I’m not pursuing that route.

Windows version: 11 Pro

NVIDIA GPU: No, I have an AMD/integrated GPU

Have I tested without Norton? Not systematically yet – that’s a fair suggestion. When AdGuard runs on the SockFilter driver, BSODs stop, which already isolates the issue to the WFP stack interaction. But I’ll do a controlled test (Norton temporarily removed with AdGuard on WFP) to confirm whether the collision is symmetric, and report back.

Thunderbird: Yes, indirectly – I’m using Betterbird, which is a Thunderbird fork sharing its codebase. Under the SockFilter driver it can’t fetch mail (IMAP/SMTP timeouts), even with AdGuard app exclusions in place. That’s why SockFilter isn’t a viable alternative for me either.

1 Like
6

Update: AdGuard Support responded and pointed me to the latest Nightly build

Quick update for anyone following this thread: AdGuard support has responded to my ticket and recommended installing the latest Nightly version of AdGuard for Windows. According to them, it was recently released and includes several important changes that might fix the WFP driver issues.

I’m now running a structured test with the following setup and phases:

  • Norton 360 (full version), with Intrusion Prevention (“Angriffssignaturen”) currently disabled

  • AdGuard on the WFP driver, latest Nightly build installed

  • Mutual exclusions configured on both sides

Test plan:

  1. Phase 1: Nightly + Norton Intrusion Prevention OFF (current state) – observe for a few days

  2. Phase 2: Re-enable Norton Intrusion Prevention and observe whether the WFP collisions return

I’ll document any BSODs (date, WER-linked driver from Event Viewer) and share debug logs and minidumps with AdGuard if a crash occurs again.

For context: the earlier evidence pointed to a WFP driver collision – WER (Event ID 1019) linked the bugcheck to NETIO.SYS, and switching AdGuard to the SockFilter driver made the BSODs disappear entirely (which points strongly at the WFP interaction, not a hardware issue). Unfortunately SockFilter breaks my mail client (Betterbird, a Thunderbird fork – IMAP/SMTP timeouts even with app exclusions), so WFP + Norton is the combination I need to stabilize.

I’ll post my findings here as they come in. If you’re running the same Norton 360 + AdGuard combination, it would be great to hear your experiences with the current builds!

3 Likes