2 Bluescreens for the first time

First time bluescreens ever with Win11, first time this machine. I read Brink's article but running went sideways right off. Could be my fault. Give me some direction and I'll pursue.

Just check the Minidumps directory which is %systemroot%\Minidump for now, usually that's enough to be honest.

I gotta tell you folks, there's a reason why regular people shy away from MS. And I'm not new to this crap.

I search for and find the minidump folder and files. There are two files since there were two instances this morning. First I go to the location and there are no files. But I know to open the extensions to All - which I shouldn't have to and which you all need to explain to others. Then, and this one befuddles me, I attempt to upload per 'attach files' and am greeted with 'you do not have permission' yet does not afford the opportunity to get permission. Give me a break (no reflection on you volunteers)!

Mark

Your issue isn't anything to do with Windows at all, its related to the forum settings, you will need to place those dump files into a .zip folder and then attach that to your post since the forum does not support .dmp attachments. I apologise for not mentioning this in my initial post.

Before I start with the new instructions, possibly an important point. I'm 90% certain the blue-screens started after Firefox updated earlier in the morning yesterday. Doing a search I see that Firefox has been associated with blue-screens previously but I'm not seeing the current version (125.0.2) associated.

Here's a zip file of yesterday's 3 instances.

Markg2 said:

Here's a zip file of yesterday's 3 instances.

Click to expand...

You've uploaded an empty .zip...

Now I see why. I'll try copying the .dmp files to the desktop and zipping from there

Again-
3 zipped too large, these are the first two of three bluescreens.

Thanks, from those two dump files you've provided, the issue appears to be related to NordDivert1064.sys which I believe is part of Nord Security or Nord VPN? Please remove that software completely using their removal tool if they provide one, otherwise you can just remove it using add/remove programs in Windows.

Afterwards, please do a FRST registry search using the following instructions to ensure that any remnants have been removed:

FRST Registry Search
1. Click your Start button and type in cmd.
2.After you find the Command Prompt, right click on it and select Run as Administrator.
3. Copy and paste the following into the Command Prompt:

reg load HKLM\DRIVERS C:\WINDOWS\SYSTEM32\CONFIG\DRIVERS

4. Please download Farbar Recovery Scan Tool and save it to your Desktop.
Note: You need to run the 64-bit Version so please ensure you download that one.
5. Run FRST64 by Right-Clicking on the file and choosing Run as administrator.
6. Copy and paste NordDivert1064.sys;NordDivert1064 into the Search box and click the Search Registry button.
7. When the scan is complete a notepad window will open with the results. Please attach this to your next reply. It is saved on your desktop named SearchReg.txt.

So does this infer I need to cancel the NordVPN subscription? Also, why couldn't I just logout of Nord? Wouldn't that stop the program from running? Notwithstanding my questions, I'll be following your instructions.
Mark

Farbar Recovery Scan Tool (x64) Version: 19.04.2024 01
Ran by MarkA (25-04-2024 17:04:14)
Running from C:\Users\MarkA\Downloads
Boot Mode: Normal

================== Search Registry: "NordDivert1064.sys;NordDivert1064" ===========


===================== Search result for "NordDivert1064.sys" ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\WinDivert]
"EventMessageFile"="C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.22.11\NordDivert1064.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NordDivert10]
"ImagePath"="\??\C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.22.11\NordDivert1064.sys"


===================== Search result for "NordDivert1064" ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\WinDivert]
"EventMessageFile"="C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.22.11\NordDivert1064.sys"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NordDivert10]
"ImagePath"="\??\C:\Program Files\NordVPN\NordSec ThreatProtection\1.4.22.11\NordDivert1064.sys"

====== End of Search ======

Markg2 said:

Also, why couldn't I just logout of Nord? Wouldn't that stop the program from running?

Click to expand...

No, because the service will likely continue to run in the background. I would cancel your subscription if you don't intend to use it anymore or you could raise a bug ticket with Nord VPN.

Could you please open an elevated command prompt and then enter the following commands:


Please reboot the system afterwards and then enter the following commands:


Please post the output of each in your next post.

Microsoft Windows [Version 10.0.22631.3447]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\System32>sc stop NordDivert10

SERVICE_NAME: NordDivert10
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

C:\Windows\System32>sc config NordDivert10 start= disabled
-----------------------
C:\Windows\System32>sc query NordDivert10
[SC] EnumQueryServicesStatus:OpenService FAILED 1060:

The specified service does not exist as an installed service.


C:\Windows\System32>sc qc NordDivert10

I thought I posted the information yesterday but I'm not seeing it. Here it is again in better form (attach).

Ok, I'll bite. As soon as I posted the text file, yesterday's post that I didn't see is now visible (to me).

Thanks, please use your system as you normally would for the next few days, if it crashes in the meantime, then please provide the dump files as you did before. Otherwise, I think we can safely say that the problem has been resolved, but you may want to raise a bug ticket with Nord if you want to continue using their software in the future.

Dmp files also show the causing proces:
PROCESS_NAME: nordsec-threatprotection-service.exe

Tester said:

Dmp files also show the causing proces:
PROCESS_NAME: nordsec-threatprotection-service.exe

Click to expand...

That isn't always the case, that PROCESS_NAME field just refers to the last process context at the time of the crash.