BSOD stop error 0x000000BE on loading Windows XP

[praziquantum]

BSOD stop error 0x000000BE on loading Windows XP

I can't load Windows XP in normal or safe mode ... I keep getting the following BSOD / GSOD (green) error: "An attempt was made to write to read-only memory" with Stop error 0x000000BE (0x806FE800, 0x006FE121, 0xF78AE784, 0x0000000B) at the Windows XP start-up screen.

Over the last few days I cleaned a few viruses (maybe 1 or 2 rootkits) off my computer using Spybot S&D, Super AntiSpyware, MalwareBytes, AntiVir, CWShredder, HiJackThis, several other online anti-virus/malware scanning engines and then cleaned the leftover temp files and registry keys using CCleaner and RegistryBooster. Throughout the process, I made several registry backups using ERUNT. Windows XP did not have any noticeable problems loading throughout all this.

Last night, I installed DataPilot software by Susteen (used to backup data from cell phones). This software installs over 300 registry entries along with numerous [unsigned] cell phone drivers. The installation seemed to go well and Windows XP loaded up fine 2-3 times after the initial install.

When I booted up the computer this morning, I received the BSOD error. The BSOD screen was actually greenish colored (GSOD) instead of the normal blue color. I have tried all of the following but still receive the BSOD error: I disconnected all USB devices and rebooted; I used some compressed air to clean out the case; I reseated the RAM; I de-/re-attached the hard drives; I tried “last known good configuration”. When I try “Safe Mode”, “Safe Mode with Networking” or “Safe Mode with Command Prompt I notice that all drivers load up to a question asking “Press enter to continue loading SPTD.sys” … whether I press enter or not, I still get the BSOD. (I noticed that SPTD is related to Daemon tools. I uninstalled Daemon tools last week and didn’t notice any problems at that time. I guess SPTD may still be trying to load. Disabling the “SPTD” service via the Recovery Console did not affect the BSOD error.)

A few other things I tried, but no improvement …
* Chkdsk fixed a few errors
* I tried restoring a previous “good” registry via ERUNT
* From the Ultimate Boot CD (UBCD), I ran the following: Memtest86+ (no faults detected after 16 cycles), Windows Memory Diagnostics (no faults detected after 6 cycles)

I can’t use restore points because I stopped those during the virus removal steps (they contained some viruses).

I just burned a UBCD4Win DVD to look for faulty registry entries (like a deleted or disabled safeboot).

I read that I can use NirSoft's BlueScreenView to read the minidumps to look for problematic drivers. The BSOD screen is not showing that it is saving minidumps nor could I find any recent minidumps in the “C:\Windows\minidump” directory. So, how do I access the minidumps (if they are being produced) when I can’t load Windows XP?

If the problem is related to bad drivers and/or registry entries made by DataPilot, how can I identify and remove those without being logged in to Windows XP?

System specs:
Asus P6T V2
Core i7 920
Corsair Dominator RAM
Windows XP SP3

 

[linney]

It is possible to load Registry Hives from a non Windows environment.

It is possible to delete DataPilot registry entries and even folders from the same environment.

As an Administrator highlight one of the two following Keys, it will only be available for these Keys.

HKEY_LOCAL_MACHINE
HKEY_USERS

These two articles in the RegEdit Help are a good explanation of the process.

To load a hive into the registry
To unload a hive from the registry

How to edit the registry offline using BartPE boot CD

http://windowsxp.mvps.org/peboot.htm

In the Recovery Console you have the Listsvc Command to use in conjunction with the Disable and Enable Commands.

How to install and use the Recovery Console in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;307654&FR=1&PA=1&SD=HSCH

While in the Recovery Console this may be an attractive solution to get back to before the trouble.

An easy to follow recovery console description when unable to start computer due to corrupt registry.

http://www.digitalwebcast.com/2002/03_mar/tutorials/cw_boot_toot.htm

This is a layman's version of KB307545 in simple language.

 

[BadBigBen]

You probably guessed it, that the BSOD is driver related...

To remove drivers, when you cannot boot up XP, would involve using a BartPE or WinPE CD/DVD, ergo working from outside. Then navigating to the Driver Folder and deleting the driver(s)...

Driver Location: C:\WINDOWS\system32\drivers
Inf location: C:\WINDOWS\inf



Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[kjv1611]

If none of that works, or if it sounds too technical for your usage, or you want the best case scenario, I hate to say it, but the best bet for this sort of situation is a clean install. Next best would be to attempt a repair install. If you run a repair install, then none of the programs/data will be touched - only the Windows system.

The thing is, if you DO fix this one issue, who's to say you don't find another.... and another... and another, and spend hours troubleshooting. If the malware/spyware/viruses messed up system files and/or settings in various locations, you could be stuck playing "whack-a-mole".

How much time have you already spent fixing the issue? How much more do you want to spend?

A full reinstall for most people can be done in under a couple of hours. Especially if you are using (or want to use) mostly free software.

So, all that said, here's what I suggest:
1. Use a Bootable CD to back-up any data and even drivers you want to keep just in case... or create an image of your current setup onto another hard drive in image format. You can do this with

http://www.UltimateBootCD.com,

many Linux distros, and others.

2. Since this is all in relation to malware/virus activity, it's at least worth mentioning - If you don't have a router between your cable or dsl modem, then get one. That'll provide good security, and I don't think it's advisable at all, currently, to use a PC on broadband without having a router in front of it.

3. Once you've gotten whatever backed up as you prefer (I would suggest having another source for obtaining the network adapter driver(s), even if it's just another working machine, in case Windows doesn't have the necessary drivers), wipe the drive clean using DBAN or Active KillDisk - both are free (well KillDisk is free for personal use, single-pass wipes). **NOTE: IF your system has a restore partition built-in on the hard drive, then these will not be the best options, unless you're willing to back up the restore partition, then move it back to the system hard drive... and then you'd probably have more work to get that partition to boot... but if you have a Windows CD that matches your installed OS, then that's typically the best route anyway..

4. Reinstall Windows with whatever setup you prefer.

5. If you reinstalled from a system restore disk/partition, then you can run

http://www.pcdecrapifier.com

to clean off any unwanted software from the PC manufacturer.

6. Get Windows fully up to date.

7. Update any drivers that aren't up to date - go to manufacturers' websites for each part... for instance, Intel for Intel based chipsets, nVidia for their stuff, aTi/Amd for their stuff, etc...

8. Install AV, Security, and other apps - you can do a bunch of it (assuming for personal/home use) using

http://ninite.com

- it's a fairly new and VERY good piece of software. It's SUPER simple and to the point, and gets the job done quicker than you will on your own.

9. Copy back your data to wherever you prefer to have it located.