REFERENCE_BY_POINTER (stop code 0x00000018) is a Windows blue screen error that occurs when a kernel-mode driver incorrectly decrements an object's reference count to zero — indicating a programming bug in a driver or Windows component.
This is typically not a hardware failure, but rather a software/driver issue that can be resolved by identifying and updating or removing the offending driver.
Part 1. What Causes REFERENCE_BY_POINTER?
This BSOD is exclusively caused by kernel-mode code — specifically when an object reference count reaches zero prematurely due to a bug in driver logic.
| Common Trigger | Explanation |
|---|---|
| Buggy device driver | Driver has a reference-counting bug in its code |
| Windows Update issue | Update installed a driver with a known bug |
| Antivirus/security software | Kernel-level security tools can cause this |
| File system filter driver | Third-party storage or backup software drivers |
| Outdated chipset or network driver | Older drivers with known reference-counting bugs |
💡 Tip: The crash dump file (
.dmp) created when this BSOD occurs often contains the exact driver filename that caused the crash. You can analyze it using WinDbg or upload it to online BSOD analysis tools like WhoCrashed.
Memory dump files are typically saved to C:\Windows\Minidump\. Check there for recent .dmp files.
Part 2. Identify the Responsible Driver
Before applying fixes, try to identify the specific driver causing the BSOD. This saves time and avoids unnecessary changes.
Method 1: Use WhoCrashed (free tool). Download and run WhoCrashed. It reads your minidump files and reports which driver caused the crash in plain English.
Method 2: Check Event Viewer. Press Win + X → Event Viewer → Windows Logs → System. Filter for Critical events near the crash time. Look for driver names in the event details.
Method 3: Note when the BSODs started. Did they start after a Windows Update, after installing new software, or after adding hardware? The timing often points directly to the cause.
| Information to Gather | Where to Find It |
|---|---|
| Minidump file | C:\Windows\Minidump\ |
| Crash timestamp | Event Viewer → System log |
| Recently installed drivers | Settings → Windows Update → Update History |
| Recently installed software | Control Panel → Programs → Sort by install date |
Part 3. Roll Back or Update the Problem Driver
Once you have identified the likely driver, roll it back or update it to a stable version.
Rolling back a driver:
- Press
Win + X→ Device Manager - Right-click the device associated with the problem driver
- Properties → Driver tab → Roll Back Driver
- Restart Windows and test
Updating a driver: If the crash started on an older driver version, updating to the latest may fix the bug. Download drivers only from official manufacturer websites:
- GPU drivers: NVIDIA or AMD
- Intel drivers: Intel Download Center
- Motherboard/chipset: Your motherboard manufacturer's support page
Uninstalling a driver: If no stable version is available, uninstall the driver entirely:
- In Device Manager, right-click the device → Uninstall device
- Check "Delete the driver software for this device"
- Restart — Windows will attempt to reinstall a generic driver
⚠️ Important: If the BSOD is caused by an antivirus or security software driver (common with older versions of Avast, AVG, Bitdefender, or Malwarebytes), uninstall the security software completely and use the vendor's dedicated removal tool for a clean uninstall before reinstalling the latest version.
🗣️ r/Windows11 user: "REFERENCE_BY_POINTER BSODs for two weeks. WhoCrashed pointed to avgntflt.sys — that's Avast's network filter driver. Uninstalled Avast, used their removal tool, and BSODs stopped. Switched to Windows Defender instead."
Part 4. Run SFC and DISM
If the driver is not identifiable or the issue persists after driver changes, corrupted Windows system files may be contributing.
Step 1: Open Command Prompt as Administrator. Press Win + X → Windows Terminal (Admin).
Step 2: Run DISM first.
DISM /Online /Cleanup-Image /RestoreHealth
This repairs the Windows component store and takes 15–30 minutes with an internet connection.
Step 3: Run SFC after DISM completes.
sfc /scannow
SFC replaces corrupted system files using the repaired component store.
Step 4: Restart and test. If SFC reports it fixed files, restart Windows and monitor for BSODs.
💡 Tip: Run
sfc /verifyonlybefore/scannowto check whether any corrupted files exist without making changes. If it reports no violations, SFC corruption is not the cause and you can focus on driver-level fixes instead.
🗣️ r/techsupport user: "After a botched Windows Update, I kept getting random REFERENCE_BY_POINTER crashes. SFC found 12 corrupted files after running DISM. Fixed them all and the crashes stopped. DISM+SFC combo is my first step for any mysterious BSOD now."
Part 5. Roll Back a Windows Update
If the BSODs started immediately after a Windows Update, that update may have installed a driver with a bug.
Step 1: Go to Settings → Windows Update → Update History → Uninstall Updates.
Step 2: Identify updates installed on or before the date the BSODs started.
Step 3: Uninstall the most recently installed driver-related updates (look for KB articles referencing drivers, graphics, or hardware).
Step 4: Restart and monitor.
You can temporarily pause future updates in Settings → Windows Update → Pause Updates to prevent the problematic update from reinstalling while you investigate.
Part 6. Recover Data Before Reinstalling Windows
If the BSOD is causing frequent crashes and you are considering a Windows reinstall, recover your important files first.
Ritridata can help if files were accidentally deleted during troubleshooting, or if a Windows reinstall removed personal data. Ritridata also offers bootable USB recovery for when Windows will not start at all — allowing you to scan for and recover files from outside the operating system.
FAQ
Q: Is REFERENCE_BY_POINTER a sign of failing hardware? A: Generally no. This BSOD is caused by software (driver bugs) rather than hardware failures. If the crash dump consistently points to the same driver, fixing that driver is the solution.
Q: What does "reference count decremented below zero" mean in plain English? A: Think of a reference count as a "users remaining" counter for a Windows object. When a driver signals "I'm done using this object" but no one was actually using it, the count goes negative — an impossible state that Windows handles by crashing.
Q: Can RAM cause REFERENCE_BY_POINTER? A: Indirectly yes — bad RAM can corrupt driver code in memory, causing any BSOD including this one. If you cannot identify a specific driver and the crashes are random, run MemTest86 to rule out RAM issues.
Q: What is WhoCrashed and is it safe? A: WhoCrashed is a free tool from Resplendence Software that reads Windows minidump crash files and presents the results in plain language. It is read-only and does not modify your system.
Q: How do I prevent this BSOD from recurring after fixing it? A: Keep drivers updated through official manufacturer sources (not Windows Update for GPU drivers), keep antivirus software current, and consider using Driver Verifier to stress-test new drivers before relying on them in daily use.