Windows 10 – restarts randomly – appears to be caused by NDIS?

Topic

New Reply

My windows 10 installation fails randomly. I have a Dell 8700 computer and after upgrading to windows 10 I started having these intermittent restarts. To try and fix this I completely reloaded windows 10 (reformatted disk and performed a clean install). This didn’t help. After this my MB died and I replaced it and did another clean install but still having the same problems but seems to be more frequently.

Downloaded “BlueScreenView” from Nirsoft v1.55. This analyzes the mini dump files and reports on dump information. I’m attaching three files that are a single screen dump of the information (Too long to get on one screen).

Most of the entries in the dump analysis say the problem was caused by NDIS (although the most recent was NETIO.sys). I can’t find any update to the NDIS file. If anyone has run into this same problem I would really appreciate some help. Very frustrating.

Reply | Quote

Replies

Do you have the latest drivers for your network card?

--Joe

Reply | Quote

Do you have the latest drivers for your network card?

I thought I’d got the latest drivers from driver update on the device manager window. The one I had loaded from MS was dated 10-1-2014. I decided to check the Realtek web site and found a much newer version of the driver dated 4/22/2016. I’ve just installed that driver and will wait and see if I have another restart event.

Thanks,
Bri-ko

Reply | Quote

The majority are (device) driver-related, esp. with NETIO.sys involved, this could be a remnant of a previously installed security software/firewall, or the current one. Copy the dumps to your Desktop, zip them and attach the zip file, I’ll take a look at them.

Reply | Quote

I thought I’d got the latest drivers from driver update on the device manager window. The one I had loaded from MS was dated 10-1-2014. I decided to check the Realtek web site and found a much newer version of the driver dated 4/22/2016. I’ve just installed that driver and will wait and see if I have another restart event.

If the problem continues I’ll zip the dumps and send them. Appreciate your offer.

Thanks,
Bri-ko

Reply | Quote

The majority are (device) driver-related, esp. with NETIO.sys involved, this could be a remnant of a previously installed security software/firewall, or the current one. Copy the dumps to your Desktop, zip them and attach the zip file, I’ll take a look at them.

satrow, this morning the machine restarted again. This time didn’t product a mini dump file. That often happens were it immediately restarts without collecting minidump information. I’ve compressed the existing dumps into a single file and am attaching it.

Thank you in advance.
Bri-ko.45188-DumpFiles

Reply | Quote

satrow,

Windows restarted again this morning after installing the latest software from Realtek for my network card.

I’ve compressed my minidump files and will attach them to this message. This morning’s restart did not produce a mini dump. This often happens the machine just restarts without collecting data.

Thank you for you assistance.

bri-ko

Reply | Quote

The device OEM is still the best source for a driver when you have a problem. Drivers available through Windows are often not current.

--Joe

Reply | Quote

A quick look at the driver dates from the last dump, while I’m waiting for the debugger to process the dumps, shows x10ufx2.sys (http://www.carrona.org/drivers/driver.php?id=x10ufx2.sys) as being from 2006! That makes it very suspect, is there a later driver available for that wireless device?

Reply | Quote

A quick look at the driver dates from the last dump, while I’m waiting for the debugger to process the dumps, shows x10ufx2.sys (http://www.carrona.org/drivers/driver.php?id=x10ufx2.sys) as being from 2006! That makes it very suspect, is there a later driver available for that wireless device?

Unfortunately there are no new drivers. This supports my Active Home automations products. Turns on lights automatically, but it seems they are no longer in operation. I can try to turn off this driver to see if it will stop the restart problems. The software still is controlling my devices and responds to motion detectors as expected. I’ll wait to see if your debugger detects any other questionable drivers, etc.

Thank you,
bri-ko.

Reply | Quote

Okay, a quick look at the base debug logs and I think the problem is too many AV/AM’s trying to check on the same networking drivers.

Backup/save any license/keys needed during a reinstall of the below:

Uninstall Malwarebytes, also use their cleaning tool. Reboot.

Remove McAfee as well, use their cleaning tool.

Run the PC for a few hours with just Defender and the Windows firewall, try to provoke another crash if you can.

Download/reinstall both those security software again later, install one – reboot, install the other – reboot.

System Uptime and some basic debugging details, for reference only:

Code:

System Uptime: 0 days 1:04:25.853
System Uptime: 0 days 3:43:36.080
System Uptime: 0 days 11:14:04.521
System Uptime: 2 days 5:00:37.189
System Uptime: 0 days 20:35:34.250
System Uptime: 0 days 0:01:49.634
System Uptime: 0 days 4:57:12.705
System Uptime: 0 days 18:20:17.420
System Uptime: 0 days 0:21:29.016
System Uptime: 2 days 13:38:58.076
System Uptime: 1 days 4:00:56.768
System Uptime: 4 days 14:34:39.696

Code:

Built by: 10586.494.amd64fre.th2_release_sec.160630-1736
Debug session time: Wed Aug  3 22:43:03.151 2016 (UTC + 1:00)
System Uptime: 0 days 1:04:25.853
BugCheck C2, {7, 126c, 0, ffffe00135cf2008}
*** WARNING: Unable to verify timestamp for [B]mfewfpk.sys[/B]
*** ERROR: Module load completed but symbols could not be loaded for [B]mfewfpk.sys[/B]
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string’+9bb0 )
BUGCHECK_STR:  0xc2_7
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“
Built by: 10586.494.amd64fre.th2_release_sec.160630-1736
Debug session time: Wed Aug  3 21:37:31.378 2016 (UTC + 1:00)
System Uptime: 0 days 3:43:36.080
BugCheck C2, {7, 126c, 2c826248, ffffe0002c8262d8}
*** WARNING: Unable to verify timestamp for [B]mwac.sys[/B]
*** ERROR: Module load completed but symbols could not be loaded for [B]mwac.sys[/B]
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string’+9bb0 )
BUGCHECK_STR:  0xc2_7
PROCESS_NAME:  mbamservice.ex
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“
Built by: 10586.494.amd64fre.th2_release_sec.160630-1736
Debug session time: Mon Jul 25 18:37:00.819 2016 (UTC + 1:00)
System Uptime: 0 days 11:14:04.521
BugCheck C2, {7, 126c, a9c54ac0, ffffe001a5ce7358}
*** WARNING: Unable to verify timestamp for [B]mfewfpk.sys[/B]
*** ERROR: Module load completed but symbols could not be loaded for [B]mfewfpk.sys[/B]
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string’+9bb0 )
BUGCHECK_STR:  0xc2_7
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“
Built by: 10586.494.amd64fre.th2_release_sec.160630-1736
Debug session time: Mon Jul 25 07:21:02.979 2016 (UTC + 1:00)
System Uptime: 2 days 5:00:37.189
BugCheck A, {8, 2, 0, fffff8008ab4ac9f}
Probably caused by : ntkrnlmp.exe ( nt!KiInsertTimerTable+af )
BUGCHECK_STR:  [B]AV[/B]
PROCESS_NAME:  iexplore.exe
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“
Built by: 10586.494.amd64fre.th2_release_sec.160630-1736
Debug session time: Sat Jul 23 02:18:52.548 2016 (UTC + 1:00)
System Uptime: 0 days 20:35:34.250
BugCheck C2, {7, 126c, 310035, ffffe0002735a6e8}
*** WARNING: Unable to verify timestamp for [B]mfewfpk.sys[/B]
*** ERROR: Module load completed but symbols could not be loaded for [B]mfewfpk.sys[/B]
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string’+9bb0 )
BUGCHECK_STR:  0xc2_7
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“
Built by: 10586.494.amd64fre.th2_release_sec.160630-1736
Debug session time: Wed Jul 20 21:48:59.931 2016 (UTC + 1:00)
System Uptime: 0 days 0:01:49.634
BugCheck C2, {7, 126c, 6c0064, ffffe001e47ff268}
*** WARNING: Unable to verify timestamp for [B]mwac.sys[/B]
*** ERROR: Module load completed but symbols could not be loaded for [B]mwac.sys[/B]
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string’+9bb0 )
BUGCHECK_STR:  0xc2_7
PROCESS_NAME:  [B]mbamservice.ex[/B]
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“
Built by: 10586.420.amd64fre.th2_release_sec.160527-1834
Debug session time: Wed Jul 13 14:34:56.003 2016 (UTC + 1:00)
System Uptime: 0 days 4:57:12.705
BugCheck C2, {7, 126c, 0, ffffe000db710818}
*** WARNING: Unable to verify timestamp for [B]mfewfpk.sys[/B]
*** ERROR: Module load completed but symbols could not be loaded for [B]tcpip.sys[/B]
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string’+9bb0 )
BUGCHECK_STR:  0xc2_7
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“
Built by: 10586.420.amd64fre.th2_release_sec.160527-1834
Debug session time: Tue Jul 12 15:49:46.717 2016 (UTC + 1:00)
System Uptime: 0 days 18:20:17.420
BugCheck C2, {7, 126c, 0, ffffe00105ab5768}
*** WARNING: Unable to verify timestamp for [B]mfewfpk.sys[/B]
*** ERROR: Module load completed but symbols could not be loaded for [B]mfewfpk.sys[/B]
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string’+9bb0 )
BUGCHECK_STR:  0xc2_7
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“
Built by: 10586.420.amd64fre.th2_release_sec.160527-1834
Debug session time: Fri Jul  8 18:41:29.314 2016 (UTC + 1:00)
System Uptime: 0 days 0:21:29.016
BugCheck 1000007E, {ffffffffc0000005, fffff8025f54df87, ffffd00093b4cfb8, ffffd00093b4c7d0}
*** WARNING: Unable to verify timestamp for [B]rt640x64.sys[/B]
*** ERROR: Module load completed but symbols could not be loaded for [B]tcpip.sys[/B]
Probably caused by : Ndu.sys ( Ndu!NduInboundMacClassify+1b6 )
BUGCHECK_STR:  [B]AV[/B]
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“
Built by: 10586.420.amd64fre.th2_release_sec.160527-1834
Debug session time: Tue Jun 28 17:33:48.368 2016 (UTC + 1:00)
System Uptime: 2 days 13:38:58.076
BugCheck C2, {7, 126c, 0, ffffe000191cbdd8}
*** WARNING: Unable to verify timestamp for [B]mfewfpk.sys[/B]
*** ERROR: Module load completed but symbols could not be loaded for [B]mfewfpk.sys[/B]
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string’+9bb0 )
BUGCHECK_STR:  0xc2_7
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“
Built by: 10586.420.amd64fre.th2_release_sec.160527-1834
Debug session time: Wed Jun 22 20:37:07.066 2016 (UTC + 1:00)
System Uptime: 1 days 4:00:56.768
BugCheck C2, {7, 126c, 0, ffffe000c257ebf8}
*** WARNING: Unable to verify timestamp for [B]mfewfpk.sys[/B]
*** ERROR: Module load completed but symbols could not be loaded for [B]rt640x64.sys[/B]
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string’+9bb0 )
BUGCHECK_STR:  0xc2_7
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“
Built by: 10586.306.amd64fre.th2_release_sec.160422-1850
Debug session time: Tue Jun 21 11:16:14.949 2016 (UTC + 1:00)
System Uptime: 4 days 14:34:39.696
BugCheck C2, {7, 126c, 0, ffffe0015b352288}
*** WARNING: Unable to verify timestamp for [B]mfewfpk.sys[/B]
*** ERROR: Module load completed but symbols could not be loaded for [B]tcpip.sys[/B]
Probably caused by : NETIO.SYS ( NETIO! ?? ::FNODOBFM::`string’+9bb0 )
BUGCHECK_STR:  0xc2_7
PROCESS_NAME:  System
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨“

Reply | Quote

Okay, a quick look at the base debug logs and I think the problem is too many AV/AM’s trying to check on the same networking drivers.

Backup/save any license/keys needed during a reinstall of the below:

Uninstall Malwarebytes, also use their cleaning tool. Reboot.

Remove McAfee as well, use their cleaning tool.

Run the PC for a few hours with just Defender and the Windows firewall, try to provoke another crash if you can.

Download/reinstall both those security software again later, install one – reboot, install the other – reboot.

[/CODE][/QUOTE

satrow,

Thank you for the feedback. Will try your recommendation and let you know.

bri-ko

Reply | Quote

Okay, a quick look at the base debug logs and I think the problem is too many AV/AM’s trying to check on the same networking drivers.

Backup/save any license/keys needed during a reinstall of the below:

Uninstall Malwarebytes, also use their cleaning tool. Reboot.

Remove McAfee as well, use their cleaning tool.

Run the PC for a few hours with just Defender and the Windows firewall, try to provoke another crash if you can.

Download/reinstall both those security software again later, install one – reboot, install the other – reboot.

[/CODE]

satrow,

I’ve been running for over a week now with no McAfee or Malwarebytes. No re-starts. I think that what you identified as the problem was, in fact, the problem. I will reload my McAfee on Monday and let it run by itself for a while to see what happens. If the machine stays steady I’ll try reloading Malwarebytes and watch some more.

Thanks for putting me on the right track. I was getting pretty frustrated with the random restarts.

bri-ko

Reply | Quote

Fine, don’t fret over the x10ufx2.sys , continue with the suggestions from my previous post.

Reply | Quote