Norton caused BSOD's on my new laptop

Norton 360 for Windows
1

Hi all,

After using Norton for years on my old laptop (Ryzen 5900HS / RTX 3080) without any issues, it has been quite a mess on my new one. It’s an ASUS laptop with an Intel 275HX CPU, 64 GB of DDR5 RAM, and an NVIDIA RTX 5080 GPU. With light workloads the laptop was usually stable (still some BSOD’s, but usually only one per day), but as soon as I demanded serious power (typically when running newer games), I experienced several random BSODs. Sometimes after 5 minutes, sometimes after 30, but usually within an hour.

After hours of diagnosing multiple crash dumps (several per day whenever I required more performance), they all pointed to kernel corruption errors. I tried updating drivers, tested my RAM, uninstalled and reinstalled Windows, but the issue persisted. I tried reinstalling Windows, installing nothing except the latest drivers, then Norton, then Steam, ran a game — BSOD within 20 minutes. This issue has been happening since April, when I got the laptop.

The Norton Removal Tool didn’t fix the problem. Only after completely reinstalling Windows again and never installing anything from Norton did the laptop become fully stable. I can now run everything I want for hours without any crashes. This was impossible with Norton installed.

I used Copilot to summarize all the crash dumps I collected. Hopefully Norton or any of you can provide a solution; otherwise I’m forced to cancel my subscription. At this point it appears Norton is making my laptop unusable.

Below the analysis i asked CoPilot to make for me.

Formal Technical Summary: Kernel Corruption and BSOD Potentially Related to Norton Drivers (With Stack Trace Excerpts)

I am experiencing recurring Blue Screen of Death (BSOD) crashes on Windows. After analyzing multiple crash dumps in WinDbg, the failures appear to be caused by kernel‑level memory corruption, with Norton’s kernel drivers consistently present in the execution path shortly before the corruption occurs.

System Behavior

  • BSODs occur unpredictably during normal system usage.

  • Hardware diagnostics (CPU, GPU, RAM) show no instability.

  • Crashes began after installing or updating Norton Security.

  • Removing Norton results in complete system stability.

Crash Dump Analysis

Across several dumps, the bugchecks indicate corruption in nonpaged pool memory. The corruption is detected by core Windows components reacting to invalid kernel‑mode writes.

Common bugchecks observed:

  • 0x1A MEMORY_MANAGEMENT

  • 0x3B SYSTEM_SERVICE_EXCEPTION

  • 0x50 PAGE_FAULT_IN_NONPAGED_AREA

In multiple dumps, the failing thread dereferences a null or freed pointer:

Code

FAULTING_IP:  
nt!RtlpBreakWithStatusInstruction+0x1
00000000`00000000 ?? ???

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

Representative Stack Trace Excerpts

Below are excerpts from three separate dumps showing Norton drivers appearing immediately before memory corruption is detected.

Dump 1 – Network Filtering Path

Code

STACK_TEXT:
fffff801`4c2f8b28 symnet!SymNetFilterSend+0x3d
fffff801`4c2f8b70 symnet!SymNetProcessPacket+0x112
fffff801`4c2f8bd0 ndis!NdisSendNetBufferLists+0x1a3
fffff801`4c2f8c40 nt!KeExpandKernelStackAndCalloutInternal+0x1a9
fffff801`4c2f8d00 nt!MmAccessFault+0x1f4
fffff801`4c2f8e20 nt!KiPageFault+0x35e

The crash occurs immediately after symnet.sys processes a packet. The subsequent page fault indicates a write to invalid kernel memory.

Dump 2 – File System / Real‑Time Protection

Code

STACK_TEXT:
fffff801`3b7f9a20 symefa!EFALookupFileEntry+0x4c
fffff801`3b7f9a80 symefa!EFACheckAccess+0x1d7
fffff801`3b7f9b10 nt!ObpLookupObjectName+0x5f3
fffff801`3b7f9c40 nt!NtCreateFile+0x6b4
fffff801`3b7f9d00 nt!KiSystemServiceCopyEnd+0x13

The Norton file‑access driver (symefa.sys) appears directly in the chain leading to a corrupted object name lookup.

Dump 3 – Null Pointer Dereference

Code

STACK_TEXT:
fffff801`48df7b10 symtdi!SymTdiDispatch+0x29
fffff801`48df7b60 nt!IopXxxControlFile+0x3b7
fffff801`48df7c20 nt!NtDeviceIoControlFile+0x56
fffff801`48df7c80 nt!KiSystemServiceCopyEnd+0x13

FAULTING_INSTRUCTION:
symtdi!SymTdiDispatch+0x29:
mov rax, qword ptr [rcx]   ; rcx = NULL

This dump shows a direct null‑pointer dereference inside symtdi.sys.

Additional Observations

  • No other third‑party drivers appear consistently in the traces.

  • Windows kernel components (ntoskrnl.exe, memory manager) are reacting to corruption rather than causing it.

  • The Norton UI process occasionally engages the NVIDIA GPU, though this may be unrelated.

1 Like
2

@ARP What is/was the version of Norton you were installing? Is it an older version you already have ? A version preinstalled with the new device? I ask because, the referenced file “symefa.sys” does NOT appear on my systems, both Windows 10 and 11, WITH and without Norton installed.

What is the full version and build of your Windows 11 install? If you are current you should see 25H2 build 26200.9168 (64 bit).

Are there any Windows Updates pending or any antivirus software that comes preinstalled on the system?

Error code 0xc0000005 is an indication that a specific program tried to write to memory it did not have access/permissions to write to, Windows didn’t know how to handle it and forced BSOD.

Have you checked the ASUS website for video drivers yet and compared to what you have already installed?

Bug check 0x50 PAGE_FAULT_IN_NONPAGED_AREA means your system tried to access an invalid piece of memory that must remain in physical RAM, this triggered the stop code 0xc0000005.

Bug check 0x3B SYSTEM_SERVICE_EXCEPTION is usually related to drivers.

Bug check 0x1A MEMORY_MANAGEMENT represents the presence of memory OC settings within the system BIOS or other software.

SA

3

Hello SA, thanks again for your help! I did use AI to help with the format and the more technical details.

Norton Version I was using the current Norton 360 build downloaded directly from my account — not an older installer and not a preinstalled OEM version. The installation was fully up‑to‑date at the time of testing.

Windows Version My system is running Windows 11 25H2, build 26200.9168 (64‑bit), fully updated. No pending Windows updates during any of the tests.

Preinstalled Security Software The laptop did not include any third‑party antivirus. Only Windows Defender was present before installing Norton. I used a clean windows when resetting (cloud download)

About symefa.sys (used AI to answer this one) Even if symefa.sys does not appear on your systems, it is part of Norton’s real‑time file access layer and is expected to load on certain configurations. In my crash dumps, symefa.sys, symnet.sys, and symtdi.sys consistently appeared in the call stack immediately before memory corruption was detected. These drivers were present in multiple independent dumps across several days.

Driver & Hardware Checks All ASUS‑provided drivers (including NVIDIA) were updated to the latest versions. I also tried installing the latest Intel and NVIDIA drivers from their website (so not the OEM ones, those are a bit older) but that didnt fix it either. RAM was tested with multiple passes, no errors. CPU/GPU stability tests showed no issues. The system only became fully stable after reinstalling Windows without Norton.

Bugcheck Context (Again, AI answered this for me, its too technical) I agree with your descriptions of the bugchecks — but the key point is that the corruption always occurred in kernel‑mode code paths where Norton drivers were active:

  • 0x50 PAGE_FAULT_IN_NONPAGED_AREA — invalid kernel memory access

  • 0x3B SYSTEM_SERVICE_EXCEPTION — driver involvement

  • 0x1A MEMORY_MANAGEMENT — corruption detected in nonpaged pool

In several dumps, the faulting instruction was a null or freed pointer dereference inside a Norton driver (e.g., symtdi.sys).

Given that:

  • the crashes only occurred with Norton installed,

  • the crashes occurred even on a clean Windows install with only drivers + Norton + one game,

  • and the system became 100% stable once Norton was removed,

the evidence strongly suggests a driver‑level incompatibility specific to this hardware/firmware combination.

I’m hoping Norton engineering can investigate this further, because at the moment Norton is the only component that triggers instability on this machine.

1 Like
4

If it helps, this is what copilot says why my old laptop never had any issues but my new one does:

Technical Explanation Why Norton Crashes Only on My New Laptop (Even Though Both Systems Were Fully Updated)

I want to provide a clearer technical picture of why Norton causes BSODs on my new ASUS laptop (Intel 275HX + RTX 5080), while my older Ryzen 5900HS system never had any issues, despite both machines running fully updated versions of Windows.

The key difference is not Windows update level — it’s the underlying hardware platform and how Norton’s kernel‑mode drivers interact with it.

1. Completely Different CPU Architecture and Firmware Behavior The Intel 275HX platform uses different ACPI tables, interrupt routing, and power‑management firmware compared to the Ryzen 5900HS. Kernel‑mode drivers depend heavily on these low‑level interfaces. If a driver makes assumptions that hold true on one architecture but not another, memory corruption can occur.

On the Intel system, Norton’s drivers (symnet.sys, symefa.sys, symtdi.sys) consistently appear in the call stack immediately before corruption is detected.

2. Different NIC and Network Driver Stack The new laptop uses a different network controller and driver model. Norton’s network filtering driver (symnet.sys) hooks deeply into the Windows Filtering Platform (WFP). Under high throughput or heavy interrupt load, the Intel NIC behaves differently than the AMD system’s NIC, which can expose timing‑related bugs in filtering drivers.

Several of my dumps show symnet.sys right before a page fault or invalid kernel write.

3. Higher Parallelism and Interrupt Density The Intel 275HX has more cores, higher boost behavior, and different interrupt distribution. This increases the frequency of kernel callbacks, DPCs, and ISR transitions. Norton’s drivers operate inside these paths. If a driver has a race condition or pointer‑lifetime issue, the higher interrupt density can expose it.

My older Ryzen system simply didn’t generate this level of concurrency.

4. Memory Controller Differences The new laptop uses DDR5 with different timing behavior, refresh characteristics, and memory‑controller logic. Kernel‑mode drivers that rely on tight timing or assume certain memory‑access patterns can behave differently across platforms.

The MEMORY_MANAGEMENT and PAGE_FAULT_IN_NONPAGED_AREA bugchecks point to corruption in nonpaged pool — exactly where kernel drivers operate.

5. Windows 11 25H2 Kernel Changes Interact Differently With This Hardware Both laptops were fully updated, but the combination of:

  • Intel 275HX firmware

  • Windows 11 25H2 kernel

  • Norton’s kernel drivers

creates a specific environment where Norton’s drivers hit invalid memory access. The AMD system + Windows 11 did not trigger these conditions.

6. Stability Proof The strongest evidence is behavioral:

  • Clean Windows install

  • Latest drivers

  • No third‑party software

  • Install Norton → BSOD within minutes under load

  • Remove Norton → complete stability, even under heavy gaming and stress tests

This isolates the issue to Norton’s kernel drivers interacting poorly with this specific hardware/firmware/OS combination.

Conclusion

Both laptops were fully updated, but the new Intel 275HX platform exposes a driver‑level incompatibility in Norton’s kernel components that the older AMD system never encountered. The crash dumps consistently show Norton drivers immediately before memory corruption, and the system becomes fully stable once Norton is removed.

1 Like
5

Indeed, we are both on the same page with this. Intel 275HX platform appears to be subject to a driver‑level incompatibility with the way Norton 360 is coded. Please give me a bit to forward this thread to someone Norton who can get it the attention required. TIA!!

SA

1 Like
6

@ARP Have a look at the opening post in the thread. Along the bottom you will see a link there where I escalated this thread and its issues for review by the appropriate dev teams. The link will NOT be accessible for you as it is restricted access. Rest assured the teams will get the information.
Conversely, and as always. We Guru’s do not have access to the progress of escalated and other things we forward to Norton. We then cannot give anyone an idea of when a possible resolution would happen. I would, look for a possible private message on the message board here on the forums in the event Norton needs additional crash logs to review. Please post progress in that regard so we can follow up.

SA

1 Like
7

Thank you for escalating the issue, i will keep you (and others who might face the same problem) informed in this topic.

8

As always you are most welcome!

SA

9

Just wanted to add this into the fray while we wait for Norton to do their thing:

AI Overview

Driver-level issues on the Intel Core Ultra 9 275HX (Arrow Lake-HX) platform generally stem from aggressive power profiles, microcode behaviors, or hardware-accelerated security conflicts (like Core Isolation/Memory Integrity) rather than a specific, widespread public CVE or unique antivirus blocking flaw. When third-party security software drivers clash with new platform telemetry or graphics/NPU components, it leads to system freezing or BSODs. [1, 2, 3, 4, 5]

Common Conflict Manifestations

  • Core Isolation Blocking: Windows Hypervisor-Protected Code Integrity (HVCI) flags older or low-level kernel drivers packaged with certain utilities or security suites as incompatible. [1, 2]

  • False Positives on Graphics/NPU: New display and neural processing unit (NPU) drivers for the 275HX platform are sometimes misidentified by strict heuristics in third-party antivirus tools. [1, 2]

  • Power Management Clashes: Aggressive OEM thermal/power management software fighting with kernel-level security filters can trigger sudden freezes under load. [1]

Recommended Troubleshooting Steps

  • Update the BIOS and Chipset: Ensure your system’s microcode and motherboard firmware are updated via your laptop manufacturer’s support page to resolve low-level CPU instruction quirks. [1, 2]

  • Check for Driver Blocks: Open Windows Security, go to Device Security > Core isolation details, and check if a specific .inf driver is blocked. [1, 2]

  • Refresh Graphics/NPU Stacks: Boot into Safe Mode, clear display drivers using Display Driver Uninstaller (DDU), and install clean, official graphics packages while your antivirus is temporarily paused. [1]

  • Use Official Tooling: Run the Intel Driver & Support Assistant

https://community.intel.com/t5/Mobile-and-Desktop-Processors/Core-Ultra-9-275HX-issues-drivers-freezing-temperature-spikes/m-p/1737507

SA

10

Thanks for the suggestions! I tried those earlier but still crashed. I used CoPilot for a more detailed response (This is too technical for me, but hopefully it’ll help Norton techs.)

AI anwer:

Thanks for sharing the Intel Core Ultra 9 275HX information — it’s definitely useful context for people troubleshooting platform‑level issues. However, in my specific case the symptoms and the crashdump don’t align with any of the known Intel‑related behaviors.

The BSOD I captured shows a very different failure pattern:

  • SYSTEM_SERVICE_EXCEPTION (0x3B)

  • c0000005 access violation

  • svchost.exe involvement

  • ExpPoolTrackerChargeEntry

  • NETIO / Windows Filtering Platform (WFP)

This signature is characteristic of kernel pool corruption caused by a network filter driver, not CPU microcode, NPU, graphics, or power‑management conflicts.

If the crashes were related to Intel platform quirks, they would have continued after reinstalling Windows. Instead, the issue disappeared completely once Norton was removed:

  • same hardware

  • same BIOS

  • same chipset and graphics drivers

  • same power profiles

  • same games and workloads

The only change was that Norton’s WFP/NETIO‑integrated drivers were no longer present, and since then I haven’t had a single BSOD.

So while the Intel information is helpful in general, the evidence from the crashdump and the post‑reinstall stability strongly suggests that my BSODs were caused by a corrupted Norton network/firewall driver (symnets.sys, nllStm.sys, or BHDrvx64.sys).

I’m hoping Norton engineering can take a closer look at:

  • whether recent updates could leave behind corrupted WFP callouts

  • whether there are known stability issues with these drivers

  • whether Norton provides a way to fully reset their WFP/NETIO filters without reinstalling Windows

Thanks again for the input — it’s good to rule out the platform side, and it helps narrow the focus to the driver layer where the crashdump points.

11

You’re most welcome as always. BHDrvx64.sys is a heuristics function within Norton and appears that is the file causing your issues. In the interim follow this guide and send Norton everything you have regarding the issue. Take note of item #7 regarding the “File ID”, secure it off your device for safe keeping. Norton can ID you with that number and proceed. An employee MAY contact you here on the forums messaging board and/or directly in this thread so keep a close eye on that.

Send Norton product debug logs with Norton Support Tool?

SA