0x0BE "read only" error, can not get to ANY Windows startup (safe etc)

[Vigilante]

Hey guys, need some verteran help here. I'm at my wits end.

I've got a machine here, or course, that has an issue, I'll try to be quick.

It originally was smothered in spyware and possibly viruses. I was able to go in Normal mode, but it was useless as the system resources were gone, and every program locked up and nothing worked, but it at least got IN normal mode. This is key.

I cleaned it up mostly all from Safe Mode and SM with networking. Everything went fine, it ran all the normal tools, nothing fancy. When it seemed clean enough to go back in Normal Mode, it would not! The system restarts itself shortly after the Windows logo with the moving progress bar.

At first I was able to still get in Safe Mode. So I double checked through the registry, and tried a couple registry "cleaning" programs that I trust and have never had issue with. When it seemed like it was spotless, it still would NOT go in Normal mode, just restarts.
So now I figured it was just a leftover spyware entry, perhaps a service or shared dll. Which is hard to find. So I did a Repair Install of XP. Didn't help at ALL!! It gets past "setup is initializing windows", then the setup program restarts the machine, and XP still won't load, just restarts :evil: :evil:

And now it doesn't want to go in ANY mode!!
It won't even go to Safe Mode Command Prompt. Now if I try to go into any "safe" modes, it says "setup cannot run from safe mode". Now I'm really screwed. All I can use is Recovery Console. And half the time I try to go in Safe Mode, it will restart instead. And sometimes it goes in and throws the error.

Next, from the startup menu, I choose to not have the system auto-restart. And here is the BSOD I get:

"An attempt was made to write to read only memory"
0X000000BE (0xF7906A84, 0X206C6148, 0XF7900180, 0X0000000F)

Thus far my googling has not turned up much. I can't run driver verifier or SFC of course. I can only work in Recovery. I went through the System32 directory and moved all the DLLs and SYS files that had a current date. With no luck there.

This problem is likely a driver of some sort, but whether the "read only memory" is RAM or HDD or maybe a system folder or a registry key, I can't tell.

Obviously the dumb thing just needs to be reloaded, but I wouldn't have typed all this if I was gunna reload. Surely there is a way to find out what driver is causing this, and delete or rename the file. I'm sure Windows is just fine except for this one corrupt driver.
How can I find out what is causing this? Using just Recovery Console?

I have used the Boot Logging option, but have not read the file yet, have to find it in R.C.

Thanks

 

[Vigilante]

Don't everybody jump up at once

I finally tracked the culprit down to one of 5 driver files in the system32\drivers folder. I had taken the HDD out and hooked it up to my machine, scanned it for viruses and spyware. It did delete a couple viruses, nothing major. And so I went in to the System32 and driver folders and quarantined all the files that had recent dates. Some looked bad, some good, some obviously from norton. But I moved them all anyhow.

Upon reboot, the system did NOT restart! HURRAY. And it continued the Repair Install I had started earlier, luckily the repair install finished with only one error message saying it couldn't install something, and I should call the hardware vendor. But it went through smoothly after that message.

So after it came up in Windows, all seemed well except both CD-ROMs didn't work. Device Manager said it could not start the driver, that it is missing or corrupt. So I looked at what drivers the CD-ROMs used, and all those files are in place. So not sure what driver it's talking about.
Anyhow, I started replacing my quarantined files in chunks, and that's how I narrowed it down to these 5 in the drivers folder. I don't know all the specific file names and what not, I will post the details on Friday hopefully. Because of the trouble, we may still reload, it's up to the customer, we'll decide that tomorrow.

Even if we reload it, at least I get the satisfaction of figuring out how to stop this retched restarting business. So if anybody in the future, has this issue, hopefully this will help you.

 

[RealBlackStuff]

Maybe now you should/could run the verifier.exe program?
http://support.microsoft.com/?kbid=244617&sd=RMVP

 

[cpc2004]

A confirmed case of bugcheck code BE
https://www.techspot.com/vb/showthread.php?p=188117#post188117

 

[Vigilante]

thx guys. Come tomorrow, I'll know if it was reloaded or is still needing to be fixed. If so, I'll run the verifier and finish replaceing the non-corrupt drivers that I quarantined.

 

[cpc2004]

You must provide the minidumps hence experts in this forum can diagnostic your problem. If you sure that it is a corrupted device driver, it is no need to open a post here.

 

[Vigilante]

I AM an expert in this forum. I do this for a living you know.

After troubleshooting the problem myself, I found the corrupt driver that was causing the restarts. But to be on the safe side for the customer's sake, we are still reloading it.

Anyhoo, now I know how to tshoot this issue in the future, and anybody else with this issue will hopefully find help in this thread.

Thanks guys.