Windows 10: BSODs random

Hello My fathers computer has been having random BSODs over the last month, we just wiped his computer and reinstalled windows 10 and started to redowload and install the different software he had on the system and it happened again. I tried to debug it myself following directions and using the windows debug tool. Below is the complete readout after opening the mini dump file from the event using the window debugging tool.





Microsoft R Windows Debugger Version 10.0.19041.1 AMD64

Copyright c Microsoft Corporation. All rights reserved.







Loading Dump File [C:\Windows\Minidump\062820-5218-01.dmp]

Mini Kernel Dump File: Only registers and stack trace are available




Symbol search path is: srv*

Executable search path is:

Windows 10 Kernel Version 18362 MP 8 procs Free x64

Product: WinNt, suite: TerminalServer SingleUserTS

Built by: 18362.1.amd64fre.19h1_release.190318-1202

Machine Name:

Kernel base = 0xfffff803`1aa00000 PsLoadedModuleList = 0xfffff803`1ae48190

Debug session time: Sun Jun 28 05:20:36.548 2020 UTC - 4:00

System Uptime: 0 days 13:54:45.200

Loading Kernel Symbols

...............................................................

................................................................

................................................................

.......................

Loading User Symbols

Loading unloaded module list

...........................

For analysis of this file, run !analyze -v

4: kd> !analyze -v

*******************************************************************************

* *

* Bugcheck Analysis *

* *

*******************************************************************************




SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M 1000007e

This is a very common bugcheck. Usually the exception address pinpoints

the driver/function that caused the problem. Always note this address

as well as the link date of the driver/image that contains this address.

Some common problems are exception code 0x80000003. This means a hard

coded breakpoint or assertion was hit, but this system was booted

/NODEBUG. This is not supposed to happen as developers should never have

hardcoded breakpoints in retail code, but ...

If this happens, make sure a debugger gets connected, and the

system is booted /DEBUG. This will let us see why this breakpoint is

happening.

Arguments:

Arg1: ffffffffc0000005, The exception code that was not handled

Arg2: fffff80326814540, The address that the exception occurred at

Arg3: ffff8983c8bc5a78, Exception Record Address

Arg4: ffffc7819005f930, Context Record Address




Debugging Details:

------------------




*** WARNING: Unable to verify timestamp for win32k.sys




KEY_VALUES_STRING: 1




Key : AV.Fault

Value: Write




Key : Analysis.CPU.Sec

Value: 4




Key : Analysis.DebugAnalysisProvider.CPP

Value: Create: 8007007e on DESKTOP-3KKHEGE




Key : Analysis.DebugData

Value: CreateObject




Key : Analysis.DebugModel

Value: CreateObject




Key : Analysis.Elapsed.Sec

Value: 12




Key : Analysis.Memory.CommitPeak.Mb

Value: 86




Key : Analysis.System

Value: CreateObject







BUGCHECK_CODE: 7e




BUGCHECK_P1: ffffffffc0000005




BUGCHECK_P2: fffff80326814540




BUGCHECK_P3: ffff8983c8bc5a78




BUGCHECK_P4: ffffc7819005f930




EXCEPTION_RECORD: ffff8983c8bc5a78 -- .exr 0xffff8983c8bc5a78

ExceptionAddress: fffff80326814540 Ndu!NduOutboundTransportClassify+0x00000000000002a0

ExceptionCode: c0000005 Access violation

ExceptionFlags: 00000000

NumberParameters: 2

Parameter[0]: 0000000000000001

Parameter[1]: ffff900aa7636800

Attempt to write to address ffff900aa7636800




CONTEXT: ffffc7819005f930 -- .cxr 0xffffc7819005f930

rax=ffff900aa7636800 rbx=ffff900bae1873a0 rcx=0000000000000002

rdx=ffff900ba46b76e0 rsi=0000000000000001 rdi=ffff900bac403ad0

rip=fffff80326814540 rsp=ffff8983c8bc5cb0 rbp=ffff8983c8bc5f30

r8=ffff900bae6c9b80 r9=ffff900bae1873a0 r10=fffff8031ded50c0

r11=ffff8983c8bc5c20 r12=0000000000000002 r13=ffff900baa329c30

r14=ffff900ba44c23f0 r15=ffff900ba41a4ab0

iopl=0 nv up ei ng nz na po nc

cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050286

Ndu!NduOutboundTransportClassify+0x2a0:

fffff803`26814540 f0480fc108 lock xadd qword ptr [rax],rcx ds:002b:ffff900a`a7636800=????????????????

Resetting default scope




BLACKBOXBSD: 1 !blackboxbsd







BLACKBOXNTFS: 1 !blackboxntfs







BLACKBOXPNP: 1 !blackboxpnp







BLACKBOXWINLOGON: 1




CUSTOMER_CRASH_COUNT: 1




PROCESS_NAME: System




WRITE_ADDRESS: fffff8031af733b8: Unable to get MiVisibleState

Unable to get NonPagedPoolStart

Unable to get NonPagedPoolEnd

Unable to get PagedPoolStart

Unable to get PagedPoolEnd

fffff8031ae2a3c8: Unable to get Flags value from nt!KdVersionBlock

fffff8031ae2a3c8: Unable to get Flags value from nt!KdVersionBlock

unable to get nt!MmSpecialPagesInUse

ffff900aa7636800




ERROR_CODE: NTSTATUS 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.




EXCEPTION_CODE_STR: c0000005




EXCEPTION_PARAMETER1: 0000000000000001




EXCEPTION_PARAMETER2: ffff900aa7636800




EXCEPTION_STR: 0xc0000005




BAD_STACK_POINTER: ffffc7819005f0c8




STACK_TEXT:

ffff8983`c8bc5cb0 fffff803`1ded2f88 : 00000000`00000000 ffff8983`c8bc5db9 00000000`00000103 ffff8983`c8bc60c8 : Ndu!NduOutboundTransportClassify+0x2a0

ffff8983`c8bc5d50 fffff803`1e409122 : 00000000`c0000016 ffff900b`a62dc130 ffff900b`a61ba010 ffff900b`a61ba010 : NETIO!KfdClassify2+0x198

ffff8983`c8bc5e20 fffff803`1e407e51 : 00000000`00000007 00000000`00000014 ffff900b`9a505e10 00000000`02fc3eed : tcpip!IppInspectLocalDatagramsOut+0xac2

ffff8983`c8bc6140 fffff803`1e40788b : 00000000`00000000 ffff8983`c8bc64a0 fffff803`1e5be2e0 ffff900b`a61ba010 : tcpip!IppSendDatagramsCommon+0x391

ffff8983`c8bc62c0 fffff803`1e41d170 : 00000000`00000014 ffff8983`c8bc6401 ffff900b`ae438e10 00000000`00000000 : tcpip!IpNlpFastSendDatagram+0x23b

ffff8983`c8bc6390 fffff803`1e41cbf1 : 00000000`00004000 ffff8983`c8bc68e0 ffff8983`c8bc67d9 00000000`00000200 : tcpip!TcpTcbSend+0x540

ffff8983`c8bc6730 fffff803`1e4f3cd8 : ffff8983`c8bc6919 00000000`000000ff 00000000`00004000 fffff803`1aa00000 : tcpip!TcpEnqueueTcbSend+0xb41

ffff8983`c8bc6840 fffff803`1df1458f : 00000000`00000000 00000000`00000000 ffffc781`900a5180 ffff900b`a3c83040 : tcpip!InetInspectInjectSend+0x18

ffff8983`c8bc6870 fffff803`1df14bf7 : ffff900b`abd023b0 ffff900b`afb7aaa0 00000000`00000000 fffff803`1cb7ae70 : NETIO!StreamInjectRequestsToStack+0x237

ffff8983`c8bc6960 fffff803`1df14d55 : 00000000`00000000 ffff900b`a95dd9c0 fffff803`1cb7ae70 00000000`00000000 : NETIO!StreamPermitDataHelper+0x5f

ffff8983`c8bc6990 fffff803`1aa9208f : ffff900b`ac7055f0 ffff900b`ac705500 ffff900b`9a4c5c80 ffff900b`a46cb080 : NETIO!StreamPermitRemoveDataWorkerRoutine+0x105

ffff8983`c8bc6a00 fffff803`1aa83945 : ffff900b`975029e0 ffff900b`a3c83040 fffff803`1aa91f90 00000000`00000002 : nt!IopProcessWorkItem+0xff

ffff8983`c8bc6a70 fffff803`1ab1e135 : ffff900b`a3c83040 00000000`00000080 ffff900b`97468080 61706d6f`00000001 : nt!ExpWorkerThread+0x105

ffff8983`c8bc6b10 fffff803`1abc99a8 : ffffc781`900a5180 ffff900b`a3c83040 fffff803`1ab1e0e0 5300746e`656d7472 : nt!PspSystemThreadStartup+0x55

ffff8983`c8bc6b60 00000000`00000000 : ffff8983`c8bc7000 ffff8983`c8bc0000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28







SYMBOL_NAME: Ndu!NduOutboundTransportClassify+2a0




MODULE_NAME: Ndu




IMAGE_NAME: Ndu.sys




IMAGE_VERSION: 10.0.18362.904




STACK_COMMAND: .cxr 0xffffc7819005f930 ; kb




BUCKET_ID_FUNC_OFFSET: 2a0




FAILURE_BUCKET_ID: AV_STACKPTR_ERROR_Ndu!NduOutboundTransportClassify




OS_VERSION: 10.0.18362.1




BUILDLAB_STR: 19h1_release




OSPLATFORM_TYPE: x64




OSNAME: Windows 10




FAILURE_ID_HASH: {47d16922-bbb0-7e41-1458-55c4cef74b36}




Followup: MachineOwner

---------




4: kd> lmvm Ndu

Browse full module list

start end module name

fffff803`26810000 fffff803`26837000 Ndu # pdb symbols C:\Program Files x86\Windows Kits\10\Debuggers\x64\sym\ndu.pdb\C76880784FACCB848E992FD130EF8A2D1\ndu.pdb

Loaded symbol image file: Ndu.sys

Mapped memory image file: C:\Program Files x86\Windows Kits\10\Debuggers\x64\sym\Ndu.sys\2372590827000\Ndu.sys

Image path: \SystemRoot\system32\drivers\Ndu.sys

Image name: Ndu.sys

Browse all global symbols functions data

Image was built with /Brepro flag.

Timestamp: 23725908 This is a reproducible build file hash, not a timestamp

CheckSum: 00021EF3

ImageSize: 00027000

File version: 10.0.18362.904

Product version: 10.0.18362.904

File flags: 0 Mask 3F

File OS: 40004 NT Win32

File type: 3.6 Driver

File date: 00000000.00000000

Translations: 0409.04b0

Information from resource tables:

CompanyName: Microsoft Corporation

ProductName: Microsoft® Windows® Operating System

InternalName: ndu.sys

OriginalFilename: ndu.sys

ProductVersion: 10.0.18362.904

FileVersion: 10.0.18362.904 WinBuild.160101.0800

FileDescription: Windows Network Data Usage Monitoring Driver

LegalCopyright: © Microsoft Corporation. All rights reserved.



After going through and following the directions it seemed like the ndu was the issue, so I downloaded and ran the fix for the file. Then it happened again so I don't think the fix worked. Can anyone help me out with the log and identify the issue causing the problem? According to the instructions I followed it would seem like the ndu.sys was the issue but maybe I am not reading it correctly or I did not apply the correct type of fix for it? Any help would be greatly appreciated!


Thank you!!

:)

 

Random BSOD while browsing internet


BitDefender is nothing special. mwac.sys causes BSODs anywhere.
A tiny documentation can be found here: Solved Random BSODs - Windows 10 Forums
In that very thread, the suggested action apparently worked.

The storage and network filters of any third party antivirus can cause BSODs. Neither MBAM nor BitDefender is any special. For a regular antivirus, it may be shifted to an alternative; but MBAM has no alternative. So a clean install of the said program is the most feasible first step.
As far as the first step is not failing, it is better to not think for the second step. Because the BSODs are not universal, failure at the first step is not universal; and success at the second step is also not universal.
That is why I posted that my suggestion may work, or may not. Let us see where it goes.

 

Random BSOD while browsing internet

Sorry, Bitdefender is a problem: BSOD BAD_POOL_HEADER - mwac.sys - Malwarebytes Anti-Malware Help - Malwarebytes Forums

 

Random BSODs "Bad_Pool_Caller"


This BSOD happens anywhere, irrespective of BitDefender. It takes place even when the antivirus is MSE in case of Windows 7. The most common cause is an expired trial or a cracked installation. Some examples:

• Norton: Windows 7 Random bsod caused by tcpip.sys - Windows 7 Help Forums
• MBAM only: Epic BSOD error appears just after few seconds from boot Solved - Windows 7 Help Forums
• McAfee: BSOD on Internet Related Programs (tcpip.sys) - Windows 7 Help Forums
• Avast: Bad Pool Header 0x00000019 at random times - Windows 7 Help Forums
• Avira: BSOD randomly Crashes my Laptop and freezes at Memory dump 100 - Windows 7 Help Forums
• Crack: BSOD every 6 minutes, also recent freezes - Windows 7 Help Forums

We are on our way of troubleshooting. If the uninstallation and reinstallation does not work, we will take the next step.

I, in general, know what I am doing and what I am suggesting. If I feel that I am unable to control the issue, I will definitely ask for help.