Random BSOD Potentially AV?

[Nicklt]

Hi,

For the past week or so I've been getting random BSOD's, two maybe three a day.

Using the Nirsoft program I thought it may have been a Wireless Driver issue, so updates all drivers etc. But still the problem remained. I read that the Nirsoft program isn't very reliable.

So, I was reading some other peoples issues with BSOD and one was caused by the persons AV. Around the same time as the BSOD started I had installed Bullguard, so I have just uninstalled it.

No BSOD since then, but that was only an hour ago

They are primarily happening when I'm watching something on Netflix etc, but every so often just happen randomly.

I've attach the .dmp's (hope I've done it correctly)....

Any help or the shedding of light on what the issue is is greatly appreciated.

Regards,

Nick

 

[ICIT2LOL]

Hello and welcome Nick there is something to do with a driver though I am not sure what it is as it mentions something about an update too specifically one titled NDIS Wrapper Driver 6.20 which on a search is containing a Linux based system of some sort.
So are you dual booting anything?

ADDITIONAL_DEBUG_TEXT:  
You can run '.symfix; .reload' to try to fix the symbol path and load symbols.
MODULE_NAME: ndis
FAULTING_MODULE: fffff80003068000 nt
DEBUG_FLR_IMAGE_TIMESTAMP:  5034f6b2
READ_ADDRESS: unable to get nt!MmSpecialPoolStart
unable to get nt!MmSpecialPoolEnd
unable to get nt!MmPagedPoolEnd
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
 00000000040020f1 
CURRENT_IRQL:  0
FAULTING_IP: 
ndis+a7bca
fffff880`01f90bca 488b4b20        mov     rcx,qword ptr [rbx+20h]
CUSTOMER_CRASH_COUNT:  1
DEFAULT_BUCKET_ID:  [COLOR=red]WIN7_DRIVER_FAULT[/COLOR]
BUGCHECK_STR:  0xD1
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) amd64fre
LAST_CONTROL_TRANSFER:  from fffff800030dab69 to fffff800030db5c0
STACK_TEXT:  
fffff800`00ba01e8 fffff800`030dab69 : 00000000`0000000a 00000000`040020f1 00000000`00000002 00000000`00000000 : nt+0x735c0
fffff800`00ba01f0 00000000`0000000a : 00000000`040020f1 00000000`00000002 00000000`00000000 fffff880`01f90bca : nt+0x72b69
fffff800`00ba01f8 00000000`040020f1 : 00000000`00000002 00000000`00000000 fffff880`01f90bca 00000000`c0000148 : 0xa
fffff800`00ba0200 00000000`00000002 : 00000000`00000000 fffff880`01f90bca 00000000`c0000148 00000000`00000000 : 0x40020f1
fffff800`00ba0208 00000000`00000000 : fffff880`01f90bca 00000000`c0000148 00000000`00000000 00000000`00000000 : 0x2

STACK_COMMAND:  .bugcheck ; kb
FOLLOWUP_IP: 
ndis+a7bca
fffff880`01f90bca 488b4b20        mov     rcx,qword ptr [rbx+20h]
SYMBOL_NAME:  ndis+a7bca
FOLLOWUP_NAME:  MachineOwner
IMAGE_NAME:  [COLOR=red]ndis.sys[/COLOR]
BUCKET_ID:  WRONG_SYMBOLS
FAILURE_BUCKET_ID:  WRONG_SYMBOLS
ANALYSIS_SOURCE:  KM
FAILURE_ID_HASH_STRING:  km:wrong_symbols
FAILURE_ID_HASH:  {70b057e8-2462-896f-28e7-ac72d4d365f8}
Followup: MachineOwner

 

[Nicklt]

Hi,

No, no dual boot. I have Ubuntu on a different machine and used this one to download it, can't imagine that would not anything though?

Thanks,

Nick

 

[Nicklt]

Hu again,

Just had a thought, I had the citrix receiver installed which I recently uninstalled, could if have come from there?

Thanks,

Nick

 

[ICIT2LOL]

I don't know Nick to be honest and I might just ask for some help on this one as it is an odd and new problem to me.

I just thought it might be worth running these

http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

http://www.sevenforums.com/tutorials/433-disk-check.html< if necessary include the /f and /r in the command line as per Option2 >in safe mode if need be

http://www.superantispyware.com/

http://www.malwarebytes.org/products/malwarebytes_free/

http://www.bleepingcomputer.com/download/adwcleaner/

ADW download from bleeping computer delete anyrubbish found with the malware scans

NB If anyone is running Kasperskysecurity it may rant about ADW - just ignore it or disable it for a while

 

[Nicklt]

Hi ICIT,

I'm at work currently but will take a look at those when I get home.

Will report back on any updates.

Thanks.

Nick

 

[ICIT2LOL]

Ok mate have asked for some help on this one as it is a new one on me.

 

[Nicklt]

Thats great, thank you very much for you help.

 

[GokAy]

Hmm, is there any NDIS filter in network connection properties? You can try disabling that one if so.

Sorry for the Turkish interface, I am not home
View attachment 370120

 

[Nicklt]

Hi Gokay,

Thanks, I will take a look when I get home and let you know.

Thanks,

Nick

 

[GokAy]

Wanted to add: I use ZoneAlarm and ZA uses Kaspersky NDIS filter for network connections. Here is what they say about it:

What is Kaspersky Anti-Virus NDIS Filter in Kaspersky Anti-Virus version 6.0.4.x

It is not recommended to use Kaspersky Anti-Virus NDIS Filter by disabling the option in Local Area Connection. That would make NDIS Filter to switch into a specific mode which could destabilize the entire operating system (e.g. cause a BSOD).

So for now, just check if it is there and perhaps uninstall rather than disable. Or perhaps it is disabled, then enable in that case. Of course if only if there is an NDIS filter

 

[Nicklt]

Ok, thanks for the heads up.

 

[Nicklt]

Hi GokAy,

No NDIS filter within the properties.

Thanks.