Solved First ever Win8 BSOD 0x000000BE probably by ntkrnlmp.exe ?

Babble · Jul 28, 2014

Hi all,
Yesterday (27 July) I experienced my first ever Windows 8 BSOD. What happened was that I had found myself on a website I didn't quite trust, and I closed it, then ran Malwarebytes out of precaution because I am a paranoid laptop user ^^; As soon as Malwarebytes had updated its database and was about to scan, I received a BSOD with the code "Attempt to write to read only memory" I panicked and started checking up on everything after the reboot and noticed that every site that usually remembered my login had logged me out, which made me worry about a possible virus intrusion since something (I assume) was trying to write to the Windows portion of my disk? Maybe it was trying to get my passwords too, I don't know.
I shut down the laptop and went to work, and didn't touch it until this morning. Event viewer didn't really help that much except for identifying a problem with my wireless connection dropping, which I will attempt to fix soon

. I then looked at the Minidump with WinDbg which pointed at ntkrnlmp.exe - after lots of Googling I found that apparently that isn't the cause at all, it's just that ntkrnlmp was handling the bad data at the time. It also said the process was mbam.exe, which I found is Malwarebytes.
That's about as far as I can understand computer language, so here I am, bugging everyone here.

This has only happened once on this machine that I am aware of, and doesn't seem to be showing signs of wanting to BSOD again. It's more a paranoia thing, I guess. If it's a virus, I don't want to be using it for sensitive tasks like banking. If it's a Windows thing that I can handle, great! If it's a possible hardware thing, I'll send it off to be repaired while it's still insured.
Here is my laptop - I've had it for almost 2 years now, I think:
HP ENVY m6 Notebook PC
Intel core i5-3210M CPU @ 2.50 GHz
Windows 8 x64 bit
Perhaps another thing worth mentioning is that I recently had a problem with a Windows Update that was disabling my speakers and headphone adapters, so that particular update has been uninstalled. Everything else is up to date.
Anyway, thank you everyone for taking the time to read this wall of text, and I will greatly appreciate any help thrown my way.

Babble · Jul 28, 2014

And apparently the SF Diagnostic tool hadn't finished running when I uploaded the compressed file of it.

Here is the complete one!

usasma · Jul 28, 2014

I would suggest updating your audio drivers and trying that Windows Update again.
Also, there's only 137 Windows Updates installed. Most systems have 160 or more. Please visit Windows Update and get ALL available updates (it may take several trips to get them all).

These 2 devices have problems in Device Manager:

USB-IF xHCI USB Host Controller ROOT\UOIP_BUS_DRIVER\0000 This device is not working properly because Windows cannot load the drivers required for this device.
Intel(R) Centrino(R) Wireless Bluetooth(R) 4.0 + High Speed Adapter USB\VID_8087&PID_07DA\6&24DAA714&0&3 This device is disabled.

For the USB-IF xHCI device, please right click on it and select "Uninstall". Then reboot the system to see if it comes back (let us know the results).
As for the Wireless Bluetooth, is this deliberately disabled? If so, why? Please re-enable it and update it's drivers. Then feel free to disable it again AFTER the update.

Daemon Tools (and Alcohol % software) are known to cause BSOD's on some Windows systems (mostly due to the sptd.sys driver, although I have seen dtsoftbus01.sys blamed on several occasions).

Please un-install the program, then use the following free tool to ensure that the troublesome sptd.sys driver is removed from your system (pick the 32 or 64 bit system depending on your system's configuration): New link (15 Aug 2012): DuplexSecure - Downloads (pick the appropriate version for your system and select "Un-install" when you run it).
Alternate link: Disk-Tools.com
Manual procedure here: Registry and SPTD problems | DAEMON Pro Help

You have Norton and Avast installed. Please uninstall both and ensure that Windows Defender and the Windows Firewall are enabled. DO NOT RUN more than one antivirus or firewall at a time - they can conflict with each other and cause errors (to include BSOD's). Once the system has been stabilized, feel free to reinstall the latest version of the one antivirus/firewall that you'd like to use.

Please update these older drivers. Links are included to assist in looking up the source of the drivers. If unable to find an update, please remove (un-install) the program responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable! :

Please uninstall this one:
moufiltr.sys Sun Mar 8 23:16:13 2009 (49B489FD)
Tablet Mouse Filter Driver most likely from a WalTop Slimline Widescreen Tablet
http://www.carrona.org/drivers/driver.php?id=moufiltr.sys

Please uninstall this one:
walvhid.sys Wed Aug 26 01:15:08 2009 (4A94C4DC)
Generic Virtual HID Driver most likely from a WalTop Slimline Widescreen Tablet
http://www.carrona.org/drivers/driver.php?id=walvhid.sys

Please uninstall this one:
WPRO_41_2001.sys Mon Nov 7 16:04:48 2011 (4EB847F0)
CACE Technologies WinPcap Packet Driver
http://www.carrona.org/drivers/driver.php?id=WPRO_41_2001.sys

You may not find an update for this one, if so - uninstall it:
CLVirtualDrive.sys Mon Dec 26 08:26:47 2011 (4EF87617)
CyberLink Virtual Device Driver
http://www.carrona.org/drivers/driver.php?id=CLVirtualDrive.sys

Analysis:
The following is for informational purposes only.

Code:

[font=lucida console]**************************Sun Jul 27 06:12:45.958 2014 (UTC - 4:00)**************************
Loading Dump File [C:\Users\John\SysnativeBSODApps\072714-111828-01.dmp]
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Built by: [B]9200[/B].16864.amd64fre.win8_gdr.140309-1509
System Uptime:[B]9 days 14:27:42.267[/B]
Probably caused by :[B]ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+339bb )[/B]
BugCheck [B]BE, {fffff8a00fcf2030, 8000000010412121, fffff88009d666d0, b}[/B]
BugCheck Info: [url=http://www.carrona.org/bsodindx.html#0x000000BE]ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)[/url]
Arguments: 
Arg1: fffff8a00fcf2030, Virtual address for the attempted write.
Arg2: 8000000010412121, PTE contents.
Arg3: fffff88009d666d0, (reserved)
Arg4: 000000000000000b, (reserved)
BUGCHECK_STR:  0xBE
DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT
PROCESS_NAME:  mbam.exe
FAILURE_BUCKET_ID: [B]0xBE_nt!_??_::FNODOBFM::_string_[/B]
CPUID:        "Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz"
MaxSpeed:     2500
CurrentSpeed: [B]2494[/B]
  BIOS Version                  F.12
  BIOS Release Date             09/06/2012
  Manufacturer                  Hewlett-Packard
  Product Name                  HP ENVY m6 Notebook PC
¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨``
[/font]

3rd Party Drivers:
The following is for information purposes only.
Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.

Code:

[font=lucida console]**************************Sun Jul 27 06:12:45.958 2014 (UTC - 4:00)**************************
[COLOR=RED][B]moufiltr.sys                 Sun Mar  8 23:16:13 2009 (49B489FD)[/B][/COLOR]
[COLOR=RED][B]walvhid.sys                  Wed Aug 26 01:15:08 2009 (4A94C4DC)[/B][/COLOR]
[COLOR=RED][B]WPRO_41_2001.sys             Mon Nov  7 16:04:48 2011 (4EB847F0)[/B][/COLOR]
[COLOR=RED][B]CLVirtualDrive.sys           Mon Dec 26 08:26:47 2011 (4EF87617)[/B][/COLOR]
GEARAspiWDM.sys              Thu May  3 15:56:17 2012 (4FA2E2E1)
ISCTD64.sys                  Fri May  4 20:44:01 2012 (4FA477D1)
ikbevent.sys                 Tue Jun 12 15:22:18 2012 (4FD796EA)
imsevent.sys                 Wed Jun 13 21:35:28 2012 (4FD93FE0)
IntcDAud.sys                 Tue Jun 19 10:40:51 2012 (4FE08F73)
HECIx64.sys                  Mon Jul  2 18:14:58 2012 (4FF21D62)
amdkmpfd.sys                 Mon Jul  9 21:49:35 2012 (4FFB8A2F)
igdpmd64.sys                 Fri Jul 20 17:47:55 2012 (5009D20B)
stwrt64.sys                  Sat Jul 21 09:36:42 2012 (500AB06A)
iwdbus.sys                   Mon Jul 23 16:19:17 2012 (500DB1C5)
Ironx64.SYS                  Mon Jul 23 20:34:50 2012 (500DEDAA)
RtsBaStor.sys                Mon Jul 30 02:08:03 2012 (501624C3)
Rt630x64.sys                 Mon Jul 30 12:03:12 2012 (5016B040)
iaStorA.sys                  Tue Jul 31 14:21:21 2012 (50182221)
dump_iaStorA.sys             Tue Jul 31 14:21:21 2012 (50182221)
atikmdag.sys                 Wed Aug  1 23:34:54 2012 (5019F55E)
atikmpag.sys                 Thu Aug  2 00:09:28 2012 (5019FD78)
hpdskflt.sys                 Thu Aug  9 10:17:49 2012 (5023C68D)
Accelerometer.sys            Thu Aug  9 10:19:28 2012 (5023C6F0)
SYMEVENT64x86.SYS            Wed Aug 22 01:33:18 2012 (50346F1E)
SynTP.sys                    Fri Aug 24 19:20:26 2012 (50380C3A)
Smb_driver_Intel.sys         Fri Aug 24 19:22:13 2012 (50380CA5)
WirelessButtonDriver64.sys   Wed Aug 29 23:11:29 2012 (503ED9E1)
intelppm.sys                 Mon Nov  5 22:55:02 2012 (50988A16)
cbfs3.sys                    Sat Nov 10 03:49:57 2012 (509E1535)
SYMEFA64.SYS                 Fri Jan 18 19:31:37 2013 (50F9E969)
SRTSPX64.SYS                 Fri Jan 25 16:30:05 2013 (5102F95D)
ccSetx64.sys                 Thu Mar 21 23:02:33 2013 (514BC9C9)
SYMNETS.SYS                  Tue Apr  9 19:24:13 2013 (5164A31D)
SYMDS64.SYS                  Thu Apr 25 19:19:47 2013 (5179BA13)
AMPPAL.sys                   Tue May 21 11:12:37 2013 (519B8EE5)
NETwew00.sys                 Thu Aug 22 17:20:34 2013 (521680A2)
eeCtrl64.sys                 Wed Oct  9 16:50:19 2013 (5255C18B)
EraserUtilRebootDrv.sys      Wed Oct  9 16:50:19 2013 (5255C18B)
BHDrvx64.sys                 Thu Dec  5 17:05:28 2013 (52A0F8A8)
point64.sys                  Thu Dec 12 08:16:17 2013 (52A9B721)
IDSvia64.sys                 Wed Feb 19 18:03:58 2014 (5305385E)
[COLOR=RED][B]dtsoftbus01.sys              Fri Feb 21 04:49:36 2014 (53072130)[/B][/COLOR]
MBAMSwissArmy.sys            Thu Mar 20 18:12:35 2014 (532B67D3)
aswHwid.sys                  Thu Jun 26 07:31:26 2014 (53AC048E)
aswMonFlt.sys                Thu Jun 26 07:32:51 2014 (53AC04E3)
aswRdr2.sys                  Thu Jun 26 07:33:28 2014 (53AC0508)
aswSnx.sys                   Thu Jun 26 07:34:44 2014 (53AC0554)
aswRvrt.sys                  Thu Jun 26 07:35:39 2014 (53AC058B)
aswVmm.sys                   Thu Jun 26 07:35:49 2014 (53AC0595)
aswStm.sys                   Thu Jun 26 07:47:09 2014 (53AC083D)
aswSP.sys                    Wed Jul  2 13:38:12 2014 (53B44384)
[/font]

Babble · Jul 28, 2014

Okay, just a quick update on what I'm doing right now because I suspect I'll be in restart cycles for the rest of the afternoon:

Uninstalled the USB-IF xHCI device and rebooted, no sign of it now as far as I can see. I knew it was in error, but I didn't know what it belonged to or if it was safe to get rid of it.
I had no idea the Bluetooth device was disabled, so it is now enabled and I'm updating it as well as my audio drivers from the HP website.
Norton was previously uninstalled, but I suspect it came back when I was doing System Restores after the offending Windows Update. So it's gone now.
Avast is next to be uninstalled.
Regarding the Windows Update, I found on the Eight Forums here that it was best to uninstall that one. But I will update the audio drivers and try again anyway.

moufiltr.sys Sun Mar 8 23:16:13 2009 (49B489FD) + walvhid.sys Wed Aug 26 01:15:08 2009 (4A94C4DC)
Have been uninstalled. The tablet they pertain to is 'permanently borrowed' by my brother anyway.
WPRO_41_2001.sys Mon Nov 7 16:04:48 2011 (4EB847F0) Has been updated to the latest version on the website.
CLVirtualDrive.sys Mon Dec 26 08:26:47 2011 (4EF87617) I wasn't sure which CyberLink program this pertained to, but searching seems to indicate YouCam, which uses the webcam. Youcam has interrupted shutdowns before, so that's uninstalled now. Hopefully this file is, too, because I don't want to lose all of the Cyberlink programs.
Daemon tools has also been removed, and the checker said that it couldn't find the evil system file, and offered to install it instead? I didn't install the file, so I assume that means all is well in that respect.

Course of action now:

Uninstall Avast - done
Update Bluetooth and audio drivers - done
Get all Windows updates - done
Hope for the best! - currently doing!

Thank you so much for your help so far. I really appreciate it.

EDIT: All further actions completed
There were some optional Windows Updates that included drivers; I installed those, too. As the audio drivers haven't been updated further than what I already had installed, I decided not to reinstall the offending update. It was an optional update, so hopefully it'll be okay to leave it until the audio drivers are updated by HP.
The USB controller hasn't reappeared exactly as it was, but there is something in the USB controllers in device manager called USB Root Hub (xHCI) - could that be it? Some intel things installed with the Windows Update, and I heard the USB disconnect/reconnect noise several times while it was going. Maybe the correct drivers were picked up. :sarc:

Anyway, again, thank you for your help so far, and I hope you're having a lovely day.

usasma · Jul 28, 2014

IMO it's never OK to uninstall/omit a Windows Update. They are released for a reason, so it's better to fix the problem that's causing it to not work. I don't worry as much about optional updates as I do about others.

The xHCI thing has been a problem since Win8 first came out.
As long as it doesn't have an error mark by it - then it's OK.
It should be listed in the USB controllers section of Device Manager after the error problem is fixed.

Newer versions of Daemon Tools don't have the sptd.sys driver - but they still have problems.
It's good that you got rid of it.

And now we wait and see what happens........
Should the system BSOD again, please zip up and upload the contents of C:\Windows\Minidump (you may have to copy it to your desktop in order to zip it up).

In case I forget, we may also want to try a UEFI/BIOS update using the HP Support Assistant - but that's for later on. We had some problems at work with the M6's UEFI a while back.

Babble · Jul 29, 2014

Firstly, apologies for the super late reply- I was at work after I replied to you yesterday ^^;
I totally agree, but as far as I can tell from threads here and on HP's site, there is no known fix other than taking the update away. I'm following the forums though and I will keep re-trying the update.

Okay, so the xHCI seems to be in the right place then.

I don't think the system will blue screen again. It's never done it before, and it was being used heavily yesterday with no problems (although it's mainly my Photoshop machine, so it's used to it), so I'm glad all of the drivers are nice and happy now. Do you have any idea what might have caused it? It seemed to come out of absolutely nowhere. I've tried two full Avast scans and am running a Malwarebytes one as I type, so my initial fear seems to have been wrong.
Uh oh. I hope nothing else happens. That UEFI/BIOS thing sounds scary and complicated. Fingers crossed I don't need to do that. o-o
But as always, thank you for your help.

usasma · Jul 30, 2014

I suspect that the cause was Daemon Tools - but only because we've seen continuing problems with it (and the Alcohol % software) for several years.

The test to see if a BSOD is fixed is to wait....
For how long? I generally say wait a week to think that it's gone, then wait another week in order to be pretty sure that it's gone.
And, before Win8 the advice for a BSOD was to restart and wait to see if it happened again (quite a few of them fixed themselves with automatic Windows Updates).

FYI - I don't normally suggest doing UEFI/BIOS updates unless it's a last resort. But with the latest generation of update tools from the OEM's (HP, Toshiba, Dell, Asus, etc) it's so much easier to do and much less likely to cause problems.

What you do is:
- go to the Start Screen
- type in "support" (without the quotes)
- Click on the HP Support Assistant to open it
- Run the program and have it check for updates
- click on the button to install updates (if the UEFI/BIOS update is available, it'll be listed in the one's to be installed)

Good luck!

Babble · Aug 2, 2014

Again, sorry for the terrible lateness of my reply. Work, work, work..
That's really strange! I've had Daemon Tools installed for while without noticing anything, but if it's known to cause problems like that, it's definitely being uninstalled from my other pc and never ever being downloaded again.
It has almost been a week of normal use, anyway, and no signs of anything wrong. It's actually running a lot better, so thank you for that.

I will wait another week, but for now I think I'll mark this one as solved so that everyone can concentrate on more pressing problems

Oh! That's a lot less scary than I thought. Still something I don't really want to be messing around with, though. Not unless I have to. o-o
But anyway, thank you so much for all of your help! It's really amazing what you guys do on this site, and for nothing at all. I hope you have a great day.

usasma · Aug 2, 2014

Don't worry about late replies - we understand that life sometimes gets in the way of computer time! :0)

BSOD's are actually pretty rare - even with those who do use Daemon Tools. That's why specialists (like those here) are able to see these things that others may not.

Good luck!

Solved First ever Win8 BSOD 0x000000BE probably by ntkrnlmp.exe ?

Babble

New Member

My Computer

System One

Babble

New Member

My Computer

System One

usasma

Mr. Cranky Pants

My Computer

System One

Babble

New Member

My Computer

System One

usasma

Mr. Cranky Pants

My Computer

System One

Babble

New Member

My Computer

System One

usasma

Mr. Cranky Pants

My Computer

System One

Babble

New Member

My Computer

System One

usasma

Mr. Cranky Pants

My Computer

System One