Windows 8 and 8.1 Forums

First ever Win8 BSOD 0x000000BE probably by ntkrnlmp.exe ?

  1. #1

    Posts : 5
    Windows 8

    First ever Win8 BSOD 0x000000BE probably by ntkrnlmp.exe ?

    Hi all,
    Yesterday (27 July) I experienced my first ever Windows 8 BSOD. What happened was that I had found myself on a website I didn't quite trust, and I closed it, then ran Malwarebytes out of precaution because I am a paranoid laptop user ^^; As soon as Malwarebytes had updated its database and was about to scan, I received a BSOD with the code "Attempt to write to read only memory" I panicked and started checking up on everything after the reboot and noticed that every site that usually remembered my login had logged me out, which made me worry about a possible virus intrusion since something (I assume) was trying to write to the Windows portion of my disk? Maybe it was trying to get my passwords too, I don't know.
    I shut down the laptop and went to work, and didn't touch it until this morning. Event viewer didn't really help that much except for identifying a problem with my wireless connection dropping, which I will attempt to fix soon . I then looked at the Minidump with WinDbg which pointed at ntkrnlmp.exe - after lots of Googling I found that apparently that isn't the cause at all, it's just that ntkrnlmp was handling the bad data at the time. It also said the process was mbam.exe, which I found is Malwarebytes.
    That's about as far as I can understand computer language, so here I am, bugging everyone here. This has only happened once on this machine that I am aware of, and doesn't seem to be showing signs of wanting to BSOD again. It's more a paranoia thing, I guess. If it's a virus, I don't want to be using it for sensitive tasks like banking. If it's a Windows thing that I can handle, great! If it's a possible hardware thing, I'll send it off to be repaired while it's still insured.
    Here is my laptop - I've had it for almost 2 years now, I think:
    HP ENVY m6 Notebook PC
    Intel core i5-3210M CPU @ 2.50 GHz
    Windows 8 x64 bit
    Perhaps another thing worth mentioning is that I recently had a problem with a Windows Update that was disabling my speakers and headphone adapters, so that particular update has been uninstalled. Everything else is up to date.
    Anyway, thank you everyone for taking the time to read this wall of text, and I will greatly appreciate any help thrown my way.

      My System SpecsSystem Spec

  2. #2

    Posts : 5
    Windows 8

    And apparently the SF Diagnostic tool hadn't finished running when I uploaded the compressed file of it.
    Here is the complete one!
      My System SpecsSystem Spec

  3. #3

    Posts : 5,139
    Win8.1Pro - Finally!!!

    I would suggest updating your audio drivers and trying that Windows Update again.
    Also, there's only 137 Windows Updates installed. Most systems have 160 or more. Please visit Windows Update and get ALL available updates (it may take several trips to get them all).

    These 2 devices have problems in Device Manager:
    USB-IF xHCI USB Host Controller ROOT\UOIP_BUS_DRIVER\0000 This device is not working properly because Windows cannot load the drivers required for this device.
    Intel(R) Centrino(R) Wireless Bluetooth(R) 4.0 + High Speed Adapter USB\VID_8087&PID_07DA\6&24DAA714&0&3 This device is disabled.
    For the USB-IF xHCI device, please right click on it and select "Uninstall". Then reboot the system to see if it comes back (let us know the results).
    As for the Wireless Bluetooth, is this deliberately disabled? If so, why? Please re-enable it and update it's drivers. Then feel free to disable it again AFTER the update.

    Daemon Tools (and Alcohol % software) are known to cause BSOD's on some Windows systems (mostly due to the sptd.sys driver, although I have seen dtsoftbus01.sys blamed on several occasions).
    Please un-install the program, then use the following free tool to ensure that the troublesome sptd.sys driver is removed from your system (pick the 32 or 64 bit system depending on your system's configuration): New link (15 Aug 2012): DuplexSecure - Downloads (pick the appropriate version for your system and select "Un-install" when you run it).
    Alternate link:
    Manual procedure here: Registry and SPTD problems | DAEMON Pro Help
    You have Norton and Avast installed. Please uninstall both and ensure that Windows Defender and the Windows Firewall are enabled. DO NOT RUN more than one antivirus or firewall at a time - they can conflict with each other and cause errors (to include BSOD's). Once the system has been stabilized, feel free to reinstall the latest version of the one antivirus/firewall that you'd like to use.

    Please update these older drivers. Links are included to assist in looking up the source of the drivers. If unable to find an update, please remove (un-install) the program responsible for that driver. DO NOT manually delete/rename the driver as it may make the system unbootable! :

    Please uninstall this one:
    moufiltr.sys Sun Mar 8 23:16:13 2009 (49B489FD)
    Tablet Mouse Filter Driver most likely from a WalTop Slimline Widescreen Tablet

    Please uninstall this one:
    walvhid.sys Wed Aug 26 01:15:08 2009 (4A94C4DC)
    Generic Virtual HID Driver most likely from a WalTop Slimline Widescreen Tablet

    Please uninstall this one:
    WPRO_41_2001.sys Mon Nov 7 16:04:48 2011 (4EB847F0)
    CACE Technologies WinPcap Packet Driver

    You may not find an update for this one, if so - uninstall it:
    CLVirtualDrive.sys Mon Dec 26 08:26:47 2011 (4EF87617)
    CyberLink Virtual Device Driver

    The following is for informational purposes only.
    **************************Sun Jul 27 06:12:45.958 2014 (UTC - 4:00)**************************
    Loading Dump File [C:\Users\John\SysnativeBSODApps\072714-111828-01.dmp]
    Windows 8 Kernel Version 9200 MP (4 procs) Free x64
    Built by: 9200.16864.amd64fre.win8_gdr.140309-1509
    System Uptime:9 days 14:27:42.267
    Probably caused by :ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+339bb )
    BugCheck BE, {fffff8a00fcf2030, 8000000010412121, fffff88009d666d0, b}
    Arg1: fffff8a00fcf2030, Virtual address for the attempted write.
    Arg2: 8000000010412121, PTE contents.
    Arg3: fffff88009d666d0, (reserved)
    Arg4: 000000000000000b, (reserved)
    PROCESS_NAME:  mbam.exe
    FAILURE_BUCKET_ID: 0xBE_nt!_??_::FNODOBFM::_string_
    CPUID:        "Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz"
    MaxSpeed:     2500
    CurrentSpeed: 2494
      BIOS Version                  F.12
      BIOS Release Date             09/06/2012
      Manufacturer                  Hewlett-Packard
      Product Name                  HP ENVY m6 Notebook PC
    3rd Party Drivers:
    The following is for information purposes only.
    Any drivers in red should be updated or removed from your system. And should have been discussed in the body of my post.
    **************************Sun Jul 27 06:12:45.958 2014 (UTC - 4:00)**************************
    moufiltr.sys                 Sun Mar  8 23:16:13 2009 (49B489FD)
    walvhid.sys                  Wed Aug 26 01:15:08 2009 (4A94C4DC)
    WPRO_41_2001.sys             Mon Nov  7 16:04:48 2011 (4EB847F0)
    CLVirtualDrive.sys           Mon Dec 26 08:26:47 2011 (4EF87617)
    GEARAspiWDM.sys              Thu May  3 15:56:17 2012 (4FA2E2E1)
    ISCTD64.sys                  Fri May  4 20:44:01 2012 (4FA477D1)
    ikbevent.sys                 Tue Jun 12 15:22:18 2012 (4FD796EA)
    imsevent.sys                 Wed Jun 13 21:35:28 2012 (4FD93FE0)
    IntcDAud.sys                 Tue Jun 19 10:40:51 2012 (4FE08F73)
    HECIx64.sys                  Mon Jul  2 18:14:58 2012 (4FF21D62)
    amdkmpfd.sys                 Mon Jul  9 21:49:35 2012 (4FFB8A2F)
    igdpmd64.sys                 Fri Jul 20 17:47:55 2012 (5009D20B)
    stwrt64.sys                  Sat Jul 21 09:36:42 2012 (500AB06A)
    iwdbus.sys                   Mon Jul 23 16:19:17 2012 (500DB1C5)
    Ironx64.SYS                  Mon Jul 23 20:34:50 2012 (500DEDAA)
    RtsBaStor.sys                Mon Jul 30 02:08:03 2012 (501624C3)
    Rt630x64.sys                 Mon Jul 30 12:03:12 2012 (5016B040)
    iaStorA.sys                  Tue Jul 31 14:21:21 2012 (50182221)
    dump_iaStorA.sys             Tue Jul 31 14:21:21 2012 (50182221)
    atikmdag.sys                 Wed Aug  1 23:34:54 2012 (5019F55E)
    atikmpag.sys                 Thu Aug  2 00:09:28 2012 (5019FD78)
    hpdskflt.sys                 Thu Aug  9 10:17:49 2012 (5023C68D)
    Accelerometer.sys            Thu Aug  9 10:19:28 2012 (5023C6F0)
    SYMEVENT64x86.SYS            Wed Aug 22 01:33:18 2012 (50346F1E)
    SynTP.sys                    Fri Aug 24 19:20:26 2012 (50380C3A)
    Smb_driver_Intel.sys         Fri Aug 24 19:22:13 2012 (50380CA5)
    WirelessButtonDriver64.sys   Wed Aug 29 23:11:29 2012 (503ED9E1)
    intelppm.sys                 Mon Nov  5 22:55:02 2012 (50988A16)
    cbfs3.sys                    Sat Nov 10 03:49:57 2012 (509E1535)
    SYMEFA64.SYS                 Fri Jan 18 19:31:37 2013 (50F9E969)
    SRTSPX64.SYS                 Fri Jan 25 16:30:05 2013 (5102F95D)
    ccSetx64.sys                 Thu Mar 21 23:02:33 2013 (514BC9C9)
    SYMNETS.SYS                  Tue Apr  9 19:24:13 2013 (5164A31D)
    SYMDS64.SYS                  Thu Apr 25 19:19:47 2013 (5179BA13)
    AMPPAL.sys                   Tue May 21 11:12:37 2013 (519B8EE5)
    NETwew00.sys                 Thu Aug 22 17:20:34 2013 (521680A2)
    eeCtrl64.sys                 Wed Oct  9 16:50:19 2013 (5255C18B)
    EraserUtilRebootDrv.sys      Wed Oct  9 16:50:19 2013 (5255C18B)
    BHDrvx64.sys                 Thu Dec  5 17:05:28 2013 (52A0F8A8)
    point64.sys                  Thu Dec 12 08:16:17 2013 (52A9B721)
    IDSvia64.sys                 Wed Feb 19 18:03:58 2014 (5305385E)
    dtsoftbus01.sys              Fri Feb 21 04:49:36 2014 (53072130)
    MBAMSwissArmy.sys            Thu Mar 20 18:12:35 2014 (532B67D3)
    aswHwid.sys                  Thu Jun 26 07:31:26 2014 (53AC048E)
    aswMonFlt.sys                Thu Jun 26 07:32:51 2014 (53AC04E3)
    aswRdr2.sys                  Thu Jun 26 07:33:28 2014 (53AC0508)
    aswSnx.sys                   Thu Jun 26 07:34:44 2014 (53AC0554)
    aswRvrt.sys                  Thu Jun 26 07:35:39 2014 (53AC058B)
    aswVmm.sys                   Thu Jun 26 07:35:49 2014 (53AC0595)
    aswStm.sys                   Thu Jun 26 07:47:09 2014 (53AC083D)
    aswSP.sys                    Wed Jul  2 13:38:12 2014 (53B44384)
      My System SpecsSystem Spec

  4. #4

    Posts : 5
    Windows 8

    Okay, just a quick update on what I'm doing right now because I suspect I'll be in restart cycles for the rest of the afternoon:
    • Uninstalled the USB-IF xHCI device and rebooted, no sign of it now as far as I can see. I knew it was in error, but I didn't know what it belonged to or if it was safe to get rid of it.
    • I had no idea the Bluetooth device was disabled, so it is now enabled and I'm updating it as well as my audio drivers from the HP website.
    • Norton was previously uninstalled, but I suspect it came back when I was doing System Restores after the offending Windows Update. So it's gone now.
    • Avast is next to be uninstalled.
    • Regarding the Windows Update, I found on the Eight Forums here that it was best to uninstall that one. But I will update the audio drivers and try again anyway.

    moufiltr.sys Sun Mar 8 23:16:13 2009 (49B489FD) + walvhid.sys Wed Aug 26 01:15:08 2009 (4A94C4DC)
    Have been uninstalled. The tablet they pertain to is 'permanently borrowed' by my brother anyway.
    WPRO_41_2001.sys Mon Nov 7 16:04:48 2011 (4EB847F0) Has been updated to the latest version on the website.
    CLVirtualDrive.sys Mon Dec 26 08:26:47 2011 (4EF87617) I wasn't sure which CyberLink program this pertained to, but searching seems to indicate YouCam, which uses the webcam. Youcam has interrupted shutdowns before, so that's uninstalled now. Hopefully this file is, too, because I don't want to lose all of the Cyberlink programs.
    Daemon tools has also been removed, and the checker said that it couldn't find the evil system file, and offered to install it instead? I didn't install the file, so I assume that means all is well in that respect.

    Course of action now:
    • Uninstall Avast - done
    • Update Bluetooth and audio drivers - done
    • Get all Windows updates - done
    • Hope for the best! - currently doing!

    Thank you so much for your help so far. I really appreciate it.

    EDIT: All further actions completed
    There were some optional Windows Updates that included drivers; I installed those, too. As the audio drivers haven't been updated further than what I already had installed, I decided not to reinstall the offending update. It was an optional update, so hopefully it'll be okay to leave it until the audio drivers are updated by HP.
    The USB controller hasn't reappeared exactly as it was, but there is something in the USB controllers in device manager called USB Root Hub (xHCI) - could that be it? Some intel things installed with the Windows Update, and I heard the USB disconnect/reconnect noise several times while it was going. Maybe the correct drivers were picked up.

    Anyway, again, thank you for your help so far, and I hope you're having a lovely day.
    Last edited by Babble; 28 Jul 2014 at 08:25.
      My System SpecsSystem Spec

  5. #5

    Posts : 5,139
    Win8.1Pro - Finally!!!

    IMO it's never OK to uninstall/omit a Windows Update. They are released for a reason, so it's better to fix the problem that's causing it to not work. I don't worry as much about optional updates as I do about others.

    The xHCI thing has been a problem since Win8 first came out.
    As long as it doesn't have an error mark by it - then it's OK.
    It should be listed in the USB controllers section of Device Manager after the error problem is fixed.

    Newer versions of Daemon Tools don't have the sptd.sys driver - but they still have problems.
    It's good that you got rid of it.

    And now we wait and see what happens........
    Should the system BSOD again, please zip up and upload the contents of C:\Windows\Minidump (you may have to copy it to your desktop in order to zip it up).

    In case I forget, we may also want to try a UEFI/BIOS update using the HP Support Assistant - but that's for later on. We had some problems at work with the M6's UEFI a while back.
      My System SpecsSystem Spec

  6. #6

    Posts : 5
    Windows 8

    Firstly, apologies for the super late reply- I was at work after I replied to you yesterday ^^;
    I totally agree, but as far as I can tell from threads here and on HP's site, there is no known fix other than taking the update away. I'm following the forums though and I will keep re-trying the update.
    Okay, so the xHCI seems to be in the right place then.
    I don't think the system will blue screen again. It's never done it before, and it was being used heavily yesterday with no problems (although it's mainly my Photoshop machine, so it's used to it), so I'm glad all of the drivers are nice and happy now. Do you have any idea what might have caused it? It seemed to come out of absolutely nowhere. I've tried two full Avast scans and am running a Malwarebytes one as I type, so my initial fear seems to have been wrong.
    Uh oh. I hope nothing else happens. That UEFI/BIOS thing sounds scary and complicated. Fingers crossed I don't need to do that. o-o
    But as always, thank you for your help.
      My System SpecsSystem Spec

  7. #7

    Posts : 5,139
    Win8.1Pro - Finally!!!

    I suspect that the cause was Daemon Tools - but only because we've seen continuing problems with it (and the Alcohol % software) for several years.

    The test to see if a BSOD is fixed is to wait....
    For how long? I generally say wait a week to think that it's gone, then wait another week in order to be pretty sure that it's gone.
    And, before Win8 the advice for a BSOD was to restart and wait to see if it happened again (quite a few of them fixed themselves with automatic Windows Updates).

    FYI - I don't normally suggest doing UEFI/BIOS updates unless it's a last resort. But with the latest generation of update tools from the OEM's (HP, Toshiba, Dell, Asus, etc) it's so much easier to do and much less likely to cause problems.

    What you do is:
    - go to the Start Screen
    - type in "support" (without the quotes)
    - Click on the HP Support Assistant to open it
    - Run the program and have it check for updates
    - click on the button to install updates (if the UEFI/BIOS update is available, it'll be listed in the one's to be installed)

    Good luck!
      My System SpecsSystem Spec

  8. #8

    Posts : 5
    Windows 8

    Again, sorry for the terrible lateness of my reply. Work, work, work..
    That's really strange! I've had Daemon Tools installed for while without noticing anything, but if it's known to cause problems like that, it's definitely being uninstalled from my other pc and never ever being downloaded again.
    It has almost been a week of normal use, anyway, and no signs of anything wrong. It's actually running a lot better, so thank you for that. I will wait another week, but for now I think I'll mark this one as solved so that everyone can concentrate on more pressing problems
    Oh! That's a lot less scary than I thought. Still something I don't really want to be messing around with, though. Not unless I have to. o-o
    But anyway, thank you so much for all of your help! It's really amazing what you guys do on this site, and for nothing at all. I hope you have a great day.
      My System SpecsSystem Spec

  9. #9

    Posts : 5,139
    Win8.1Pro - Finally!!!

    Don't worry about late replies - we understand that life sometimes gets in the way of computer time! :0)

    BSOD's are actually pretty rare - even with those who do use Daemon Tools. That's why specialists (like those here) are able to see these things that others may not.

    Good luck!
      My System SpecsSystem Spec

First ever Win8 BSOD 0x000000BE probably by ntkrnlmp.exe ?
Related Threads
ntkrnlmp.exe bsod in BSOD Crashes and Debugging
Hi, I just built a new rig and i have gotten two bsod in a day. Can anybody help in narrowing down the culprit. Thanks Specs Cpu : intel i7 4790k . not overclocked OS: window 8.1 x64 Mother board: msi z97s sli plus
BSOD - Fresh install W8 - ntkrnlmp.exe in BSOD Crashes and Debugging
Hi guys, So after trying to sort my last issue out, I decided to flatten my PC, take the OS off my SSD and on to a HDD and start again. With a brand new CPU, 16Gb Patriot RAM, currently a 500Gb HDD and 120Gb SSD and Nvidia GTX660 GPU I have once again hit the BSOD wall - ntkrnlmp.exe...
BSOD ntkrnlmp.exe KMODE_EXCEPTION_NOT_HANDLED in BSOD Crashes and Debugging
Hi all, I'm having a problem with a variety of BSODs, usually within a few minutes of booting the system. If the system hasn't blue screened within that first few minutes, it stays up and doesn't crash thereafter. These blue screens are usually one of the following: ...
Hi, I have a Windows 8.1 Pro machine that was built by a custom computer vendor. I've had it since mid December of 2013, and after about a month of owning it I experience the first BSOD induced restart. Since then it has BSOD induced restarted four more times. The interval between BSOD induced...
Solved Random BSOD - Mainly ntkrnlmp.exe in BSOD Crashes and Debugging
Hi, I brought a brand new laptop, and it BSODs quite abit .. please see attached. I couldn't pinpoint what was actually causing this so tried many different drivers and configurations .. probably installed windows 8 pro 20+ times now in the last 3 days ..
BSOD - ntkrnlmp.exe to blame? in BSOD Crashes and Debugging
Hi, my PC has developed a severe case of BSOD over the last couple of days - hopefully someone can help! The last change I remember making before this started to happen was auto-updating a driver for my xbox 360 controller. I've tried antivirus and antimalware programs but from research this...
BSOD Windows 8 - ntkrnlmp.exe in BSOD Crashes and Debugging
I've been getting some random BSOD when first booting the machine (after a shut down). It doesn't throw a BSOD all the time though, only randomly. Sometimes it goes without a problem for about a week. The bug check is 0x7A: KERNAL_DATA_INPAGE_ERROR. I ran Crystal Disk Info and everything shows...
Eight Forums Android App Eight Forums IOS App Follow us on Facebook