Windows 7 Blue Screen of Death - IRQL - iastor.sys

P

Partzfx

New Member
Joined
Jan 16, 2011
Messages
14
I was working in firefox and the screen went wild. The computer went wild and started shutting down. I get this that error. Sometimes it will allow me to start it with safe mode with command prompt or with networking. Here is the link to my minidump file located in office.live
Link Removed due to 404 Error

Does anyone have any idea what I can do?

Thanks for the help

Rick

My computer is

Dell XPS 1645
8 gig RAM
i7
ATI 1gb video card
 
Last edited by a moderator:
Solution
Partzfx said:
How to get this? No internet on the computer. I can copy file to the computer and that is it.
Click to expand...

Disable Ricoh Memorystick Controller in windows device manager while in safe mode.


To restore normal boot:

1. Try Last Good Known configuration
2. Startup Repair Options Link Removed
(Download Windows 7 System Recovery Discs )

3. On the Startup Repair from Command Prompt:
a) sfc /scannow
b) chkdsk /f

4. If you have a backup image you can restore from it
5. System reinstall would be your last option



~~~~~~~~~

If nothing works including the reinstall, test memory and the hard drive:

Memtest86+ - Advanced Memory Diagnostic Tool

Link Removed - Invalid URL
Sort by date Sort by votes
iastor.sys is the driver for Intel AHCI controller known as Intel Matrix Storage.

While I'm taking a look at the crash dump, go update the driver Link Removed.
 
Upvote 0 Downvote
Attach the .dmp file here, your Skydrive link says this:


Link Removed - Invalid URL

We can't show you that page

Our server is having a problem. We're working to fix it as soon as we can, so try again in a few minutes.
 
Upvote 0 Downvote
Rick said:
Sometimes it will allow me to start it with safe mode with command prompt or with networking.
Click to expand...

Safe mode sounds good, attach the .dmp files with your next post here (Manasge Attachments), or upload to rapidshasre.com
 
Upvote 0 Downvote
Yes, caused by Intel Matrix Storage driver. When you have a chance, update it:

iaStor.sys Thu Jun 04 21:53:40 2009
Link Removed


Update drivers:

rimspe64.sys Wed Jul 01 19:54:49 2009
Ricoh Memorystick Controller

SynTP.sys Mon Aug 24 13:37:05 2009
Touchpad







Crash Dumps:

Code: 
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [F:\a\Minidump\D M P\DMP\011511-24258-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Executable search path is: 
Windows 7 Kernel Version 7600 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0281a000 PsLoadedModuleList = 0xfffff800`02a57e50
Debug session time: Sat Jan 15 12:38:09.111 2011 (UTC - 5:00)
System Uptime: 0 days 0:02:55.611
Loading Kernel Symbols
...............................................................
...........................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {0, 2, 1, fffff88001054771}

Unable to load image \SystemRoot\system32\DRIVERS\iaStor.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for iaStor.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStor.sys
Probably caused by : iaStor.sys ( iaStor+4a771 )

Followup: MachineOwner
---------

1: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88001054771, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ac20e0
 0000000000000000 

CURRENT_IRQL:  2

FAULTING_IP: 
iaStor+4a771
fffff880`01054771 488911          mov     qword ptr [rcx],rdx

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  VISTA_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff880009fb6f0 -- (.trap 0xfffff880009fb6f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000002 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001054771 rsp=fffff880009fb880 rbp=0000000000000000
 r8=fffffa8007987000  r9=0000000000000000 r10=fffff8800100f6b8
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei ng nz na po nc
iaStor+0x4a771:
fffff880`01054771 488911          mov     qword ptr [rcx],rdx ds:3e20:00000000`00000000=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002889ca9 to fffff8000288a740

STACK_TEXT:  
fffff880`009fb5a8 fffff800`02889ca9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`009fb5b0 fffff800`02888920 : 00000000`00000000 00000000`00000000 fffffa80`098394a8 fffff800`02869e05 : nt!KiBugCheckDispatch+0x69
fffff880`009fb6f0 fffff880`01054771 : fffffa80`07987ad0 fffffa80`06b4c1a0 fffffa80`098392c0 00000000`00000000 : nt!KiPageFault+0x260
fffff880`009fb880 fffffa80`07987ad0 : fffffa80`06b4c1a0 fffffa80`098392c0 00000000`00000000 00000000`00000001 : iaStor+0x4a771
fffff880`009fb888 fffffa80`06b4c1a0 : fffffa80`098392c0 00000000`00000000 00000000`00000001 fffffa80`06b4c1a0 : 0xfffffa80`07987ad0
fffff880`009fb890 fffffa80`098392c0 : 00000000`00000000 00000000`00000001 fffffa80`06b4c1a0 fffffa80`08d4d7e0 : 0xfffffa80`06b4c1a0
fffff880`009fb898 00000000`00000000 : 00000000`00000001 fffffa80`06b4c1a0 fffffa80`08d4d7e0 fffff880`0105c733 : 0xfffffa80`098392c0


STACK_COMMAND:  kb

FOLLOWUP_IP: 
iaStor+4a771
fffff880`01054771 488911          mov     qword ptr [rcx],rdx

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  iaStor+4a771

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: iaStor

IMAGE_NAME:  iaStor.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4a287aa4

FAILURE_BUCKET_ID:  X64_0xD1_iaStor+4a771

BUCKET_ID:  X64_0xD1_iaStor+4a771

Followup: MachineOwner
---------




Drivers:

Code: 
start             end                 module name
fffff880`02ee2000 fffff880`02f20000   1394ohci 1394ohci.sys Mon Jul 13 20:07:12 2009 (4A5BCC30)
fffff880`00f76000 fffff880`00fcd000   ACPI     ACPI.sys     Mon Jul 13 19:19:34 2009 (4A5BC106)
fffff880`01174000 fffff880`0117f000   amdxata  amdxata.sys  Tue May 19 13:56:59 2009 (4A12F2EB)
fffff880`01126000 fffff880`0112f000   atapi    atapi.sys    Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`0112f000 fffff880`01159000   ataport  ataport.SYS  Mon Jul 13 19:19:52 2009 (4A5BC118)
fffff960`00aa0000 fffff960`00b01000   ATMFD    ATMFD.DLL    unavailable (00000000)
fffff880`00e5e000 fffff880`00e6a000   BATTC    BATTC.SYS    Mon Jul 13 19:31:01 2009 (4A5BC3B5)
fffff880`019df000 fffff880`019e6000   Beep     Beep.SYS     Mon Jul 13 20:00:13 2009 (4A5BCA8D)
fffff880`02e4f000 fffff880`02e60000   blbdrive blbdrive.sys Mon Jul 13 19:35:59 2009 (4A5BC4DF)
fffff880`02e0f000 fffff880`02e39000   cdrom    cdrom.sys    Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`00cc5000 fffff880`00d85000   CI       CI.dll       Mon Jul 13 21:32:13 2009 (4A5BE01D)
fffff880`01869000 fffff880`01899000   CLASSPNP CLASSPNP.SYS Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00c67000 fffff880`00cc5000   CLFS     CLFS.SYS     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`012fd000 fffff880`01370000   cng      cng.sys      Mon Jul 13 19:49:40 2009 (4A5BC814)
fffff880`00e55000 fffff880`00e5e000   compbatt compbatt.sys Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`02e60000 fffff880`02e70000   CompositeBus CompositeBus.sys Mon Jul 13 20:00:33 2009 (4A5BCAA1)
fffff880`033d0000 fffff880`033de000   crashdmp crashdmp.sys Mon Jul 13 20:01:01 2009 (4A5BCABD)
fffff880`01435000 fffff880`0144b000   disk     disk.sys     Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`033de000 fffff880`033f1000   dump_dumpfve dump_dumpfve.sys Mon Jul 13 19:21:51 2009 (4A5BC18F)
fffff880`01899000 fffff880`019b5000   dump_iaStor dump_iaStor.sys Thu Jun 04 21:53:40 2009 (4A287AA4)
fffff880`03352000 fffff880`0335e000   Dxapi    Dxapi.sys    Mon Jul 13 19:38:28 2009 (4A5BC574)
fffff960`005a0000 fffff960`005be000   dxg      dxg.sys      unavailable (00000000)
fffff880`011cb000 fffff880`011df000   fileinfo fileinfo.sys Mon Jul 13 19:34:25 2009 (4A5BC481)
fffff880`0117f000 fffff880`011cb000   fltmgr   fltmgr.sys   Mon Jul 13 19:19:59 2009 (4A5BC11F)
fffff960`00910000 fffff960`00919000   framebuf framebuf.dll unavailable (00000000)
fffff880`0142b000 fffff880`01435000   Fs_Rec   Fs_Rec.sys   Mon Jul 13 19:19:45 2009 (4A5BC111)
fffff880`013bc000 fffff880`013f6000   fvevol   fvevol.sys   Fri Sep 25 22:34:26 2009 (4ABD7DB2)
fffff880`02e39000 fffff880`02e46000   GEARAspiWDM GEARAspiWDM.sys Mon May 18 08:17:04 2009 (4A1151C0)
fffff800`02df6000 fffff800`02e3f000   hal      hal.dll      Mon Jul 13 21:27:36 2009 (4A5BDF08)
fffff880`01200000 fffff880`01224000   HDAudBus HDAudBus.sys Mon Jul 13 20:06:13 2009 (4A5BCBF5)
fffff880`016b5000 fffff880`016be000   hwpolicy hwpolicy.sys Mon Jul 13 19:19:22 2009 (4A5BC0FA)
fffff880`02f7c000 fffff880`02f9a000   i8042prt i8042prt.sys Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`0100a000 fffff880`01126000   iaStor   iaStor.sys   Thu Jun 04 21:53:40 2009 (4A287AA4)
fffff880`02f20000 fffff880`02f7c000   itecir   itecir.sys   Wed Feb 24 03:59:35 2010 (4B84EA77)
fffff880`02f9a000 fffff880`02fa9000   kbdclass kbdclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff800`00baf000 fffff800`00bb2000   kdcom    kdcom.dll    Tue Nov 30 09:40:39 2010 (4CF50CE7)
fffff880`03255000 fffff880`03298000   ks       ks.sys       Wed Mar 03 23:32:25 2010 (4B8F37D9)
fffff880`01400000 fffff880`0141a000   ksecdd   ksecdd.sys   Mon Jul 13 19:20:54 2009 (4A5BC156)
fffff880`01660000 fffff880`0168b000   ksecpkg  ksecpkg.sys  Fri Dec 11 01:03:32 2009 (4B21E0B4)
fffff880`00c0f000 fffff880`00c53000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Mon Jul 13 21:29:10 2009 (4A5BDF66)
fffff880`02e00000 fffff880`02e0f000   mouclass mouclass.sys Mon Jul 13 19:19:50 2009 (4A5BC116)
fffff880`00e7f000 fffff880`00e99000   mountmgr mountmgr.sys Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff880`01159000 fffff880`01164000   msahci   msahci.sys   Fri Nov 13 23:36:50 2009 (4AFE33E2)
fffff880`01835000 fffff880`01840000   Msfs     Msfs.SYS     Mon Jul 13 19:19:47 2009 (4A5BC113)
fffff880`00fd6000 fffff880`00fe0000   msisadrv msisadrv.sys Mon Jul 13 19:19:26 2009 (4A5BC0FE)
fffff880`0129f000 fffff880`012fd000   msrpc    msrpc.sys    Mon Jul 13 19:21:32 2009 (4A5BC17C)
fffff880`02e70000 fffff880`02e7b000   mssmbios mssmbios.sys Mon Jul 13 19:31:10 2009 (4A5BC3BE)
fffff880`016a3000 fffff880`016b5000   mup      mup.sys      Mon Jul 13 19:23:45 2009 (4A5BC201)
fffff880`016cb000 fffff880`017bd000   ndis     ndis.sys     Mon Jul 13 19:21:40 2009 (4A5BC184)
fffff880`01600000 fffff880`01660000   NETIO    NETIO.SYS    Mon Jul 13 19:21:46 2009 (4A5BC18A)
fffff880`01840000 fffff880`01851000   Npfs     Npfs.SYS     Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff800`0281a000 fffff800`02df6000   nt       ntkrnlmp.exe Sat Jun 19 00:16:41 2010 (4C1C44A9)
fffff880`01456000 fffff880`015f9000   Ntfs     Ntfs.sys     Mon Jul 13 19:20:47 2009 (4A5BC14F)
fffff880`019d6000 fffff880`019df000   Null     Null.SYS     Mon Jul 13 19:19:37 2009 (4A5BC109)
fffff880`00e40000 fffff880`00e55000   partmgr  partmgr.sys  Mon Jul 13 19:19:58 2009 (4A5BC11E)
fffff880`00e00000 fffff880`00e33000   pci      pci.sys      Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`01164000 fffff880`01174000   PCIIDEX  PCIIDEX.SYS  Mon Jul 13 19:19:48 2009 (4A5BC114)
fffff880`0141a000 fffff880`0142b000   pcw      pcw.sys      Mon Jul 13 19:19:27 2009 (4A5BC0FF)
fffff880`00c53000 fffff880`00c67000   PSHED    PSHED.dll    Mon Jul 13 21:32:23 2009 (4A5BE027)
fffff880`01293000 fffff880`0129ee00   PxHlpa64 PxHlpa64.sys Tue Jun 23 19:16:35 2009 (4A416253)
fffff880`02e7b000 fffff880`02e86000   rdpbus   rdpbus.sys   Mon Jul 13 20:17:46 2009 (4A5BCEAA)
fffff880`017bd000 fffff880`017f7000   rdyboost rdyboost.sys Mon Jul 13 19:34:34 2009 (4A5BC48A)
fffff880`011df000 fffff880`011f8000   rimspe64 rimspe64.sys Wed Jul 01 19:54:49 2009 (4A4BF749)
fffff880`0127a000 fffff880`01293000   risdpe64 risdpe64.sys Wed Jul 01 05:31:57 2009 (4A4B2D0D)
fffff880`02e8c000 fffff880`02ee2000   rixdpe64 rixdpe64.sys Sat Jul 04 06:27:00 2009 (4A4F2E74)
fffff880`02e86000 fffff880`02e87480   swenum   swenum.sys   Mon Jul 13 20:00:18 2009 (4A5BCA92)
fffff880`02fa9000 fffff880`02ff4000   SynTP    SynTP.sys    Mon Aug 24 13:37:05 2009 (4A92CFC1)
fffff880`00e99000 fffff880`00ead000   termdd   termdd.sys   Mon Jul 13 20:16:36 2009 (4A5BCE64)
fffff960`00700000 fffff960`0070a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`0337b000 fffff880`033d0000   udfs     udfs.sys     Tue Oct 06 22:34:35 2009 (4ACBFE3B)
fffff880`032aa000 fffff880`032bc000   umbus    umbus.sys    Mon Jul 13 20:06:56 2009 (4A5BCC20)
fffff880`0335e000 fffff880`0337b000   usbccgp  usbccgp.sys  Mon Jul 13 20:06:45 2009 (4A5BCC15)
fffff880`02ff4000 fffff880`02ff5f00   USBD     USBD.SYS     Mon Jul 13 20:06:23 2009 (4A5BCBFF)
fffff880`01851000 fffff880`01862000   usbehci  usbehci.sys  Mon Jul 13 20:06:30 2009 (4A5BCC06)
fffff880`032f8000 fffff880`03352000   usbhub   usbhub.sys   Fri Sep 04 23:24:43 2009 (4AA1D9FB)
fffff880`01224000 fffff880`0127a000   USBPORT  USBPORT.SYS  Mon Jul 13 20:06:31 2009 (4A5BCC07)
fffff880`00e33000 fffff880`00e40000   vdrvroot vdrvroot.sys Mon Jul 13 20:01:31 2009 (4A5BCADB)
fffff880`019e6000 fffff880`019f4000   vga      vga.sys      Mon Jul 13 19:38:47 2009 (4A5BC587)
fffff880`01800000 fffff880`01825000   VIDEOPRT VIDEOPRT.SYS Mon Jul 13 19:38:51 2009 (4A5BC58B)
fffff880`0168b000 fffff880`0169b000   vmstorfl vmstorfl.sys Mon Jul 13 19:42:54 2009 (4A5BC67E)
fffff880`00e6a000 fffff880`00e7f000   volmgr   volmgr.sys   Mon Jul 13 19:19:57 2009 (4A5BC11D)
fffff880`00d85000 fffff880`00de1000   volmgrx  volmgrx.sys  Mon Jul 13 19:20:33 2009 (4A5BC141)
fffff880`01370000 fffff880`013bc000   volsnap  volsnap.sys  Mon Jul 13 19:20:08 2009 (4A5BC128)
fffff880`032bc000 fffff880`032f8000   vpchbus  vpchbus.sys  Tue Sep 22 21:32:32 2009 (4AB97AB0)
fffff880`01825000 fffff880`01835000   watchdog watchdog.sys Mon Jul 13 19:37:35 2009 (4A5BC53F)
fffff880`00ec3000 fffff880`00f67000   Wdf01000 Wdf01000.sys Mon Jul 13 19:22:07 2009 (4A5BC19F)
fffff880`00f67000 fffff880`00f76000   WDFLDR   WDFLDR.SYS   Mon Jul 13 19:19:54 2009 (4A5BC11A)
fffff960`00090000 fffff960`003a0000   win32k   win32k.sys   unavailable (00000000)
fffff880`02e46000 fffff880`02e4f000   wmiacpi  wmiacpi.sys  Mon Jul 13 19:31:02 2009 (4A5BC3B6)
fffff880`00fcd000 fffff880`00fd6000   WMILIB   WMILIB.SYS   Mon Jul 13 19:19:51 2009 (4A5BC117)
fffff880`03200000 fffff880`03221000   WudfPf   WudfPf.sys   Mon Jul 13 20:05:37 2009 (4A5BCBD1)

Unloaded modules:
fffff880`01899000 fffff880`018a7000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0000E000
fffff880`018a7000 fffff880`019c3000   dump_iaStor.
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0011C000
fffff880`019c3000 fffff880`019d6000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00013000
fffff880`03298000 fffff880`032aa000   circlass.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00012000
fffff880`0169b000 fffff880`016a3000   spldr.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  00008000
fffff880`01214000 fffff880`01293000   mfehidk.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
    ImageSize:  0007F000
 
Upvote 0 Downvote
How do I update the intel Matrix from command prompt. Cant install from safe mode in computer
 
Last edited:
Upvote 0 Downvote
Partzfx said:
How to get this? No internet on the computer. I can copy file to the computer and that is it.
Click to expand...

Disable Ricoh Memorystick Controller in windows device manager while in safe mode.


To restore normal boot:

1. Try Last Good Known configuration
2. Startup Repair Options Link Removed
(Download Windows 7 System Recovery Discs )

3. On the Startup Repair from Command Prompt:
a) sfc /scannow
b) chkdsk /f

4. If you have a backup image you can restore from it
5. System reinstall would be your last option



~~~~~~~~~

If nothing works including the reinstall, test memory and the hard drive:

Memtest86+ - Advanced Memory Diagnostic Tool

Link Removed - Invalid URL
 
Upvote 0 Downvote
Solution
Hi all,
I had the same issues with BSOD/iastor.sys and couldn't boot most times. Spent a few days trying to rollback, repair, restore, even rebuild the MBR, but nothing worked. It turned out to be a nasty rootkit infection. Had to use kapersky's tdsskiller.exe to kill it. I was able to boot into safemode with command prompt and run it (though 9 times out of ten safe mode would BSOD). Once I got it to run it took about 30 seconds to find it and kill it. See these threads and sites for more info:
Link Removed - Invalid URL
How to remove malware belonging to the family Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon)?
Good luck!
 
Upvote 0 Downvote
Elmer said:
How often do the rescue discs get updated with virus definitions? E.g. If I downloaded Disk10 now, would it be the same Disk10 in four weeks time?
Click to expand...

Actually when you download and burn the ISO, when you boot to the CD, it will autoconfig the network and from the interface you will have an option to update the current signatures to the most recent available. Excellent tool has recently saved my butt, actually my daughters butt, it was her laptop.
 
Upvote 0 Downvote
Thanks for that Trouble. It was actually for my daughter I was going to burn one for. She lives on Facebook. 'Nuff said!!

P.S. Bring back the owl!!
 
Upvote 0 Downvote
Not absolutely sure that the network configuration that it performs will work on all or any wireless adapters, but it did work very well for the integrated ethernet NIC on her laptop. So I would highly recommend using the Cat5 connection rather than the wireless whenever possible.
 
Upvote 0 Downvote
You must log in or register to reply here.