Very frequent BSoDs - iastorA.sys and ntoskrnl.exe related

[Wilson Yau]

Hi,
I've been getting a lot of BSoDs lately. I'm getting BSoD VERY often, which is very frustrating.. I've been trying to find what the problem is, but no result at all.
Please help me find the roots of the problem and help me fix it?
Thanks a lot!

 

[bagavan]

update your Intel RST (Rapid Storage Technology) driver to the latest version possible.

Intel Download Center

 

[Wilson Yau]

I just updated my Intel RST. However, I just got another BSoD..

 

[koolkat77]

Welcome to SevenForums

1. If you have a SSD, make sure the firmware is up-to-date

Upload a screenshot of your hard disk using CrystalDiskInfo:
​

• CrystalDiskInfo - Software - Crystal Dew World
• http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

2. McAfee: McAfee is a frequent cause of BSOD-s, consider uninstalling it with the McAfee Removal Tool and replace with Microsoft Security Essentials (To test)

• How to uninstall or reinstall supported McAfee products using the Consumer Products Removal tool (MCPR)

• McAfee Removal Tool - McAfee Uninstaller

3. Microsoft Security Essentials.

Recommended from a strict BSOD perspective, compatibility & stability compared to other antiviruses/internet security software. It is free and lightweight:-
​

• Microsoft Security Essentials - Free Antivirus for Windows
  • Malwarebytes : Malwarebytes Anti-Malware removes malware including viruses, spyware, worms and trojans, plus it protects your computer
    • http://www.sevenforums.com/system-security/206705-good-free-system-security-combination.html

   Warning

:ar: Do not start the free trial of Malware Bytes; remember to deselect that option when prompted.

Run a full scan with both (separately) once downloaded, installed and updated.
4. Perform a System File Check:

1. Click on the start rb:
2. Type CMD on Search
3. Left click and Run as Administrator
4. Type SFC /scannow

Full tutorial here:

• http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

5. Disk Check on your hard drive for file system errors and bad sectors on it:

• http://www.sevenforums.com/tutorials/433-disk-check.html

6. Make scans with the following:

-Kaspersky TDSSKiller

• Anti-rootkit utility TDSSKiller

-ESET online scanner

• Free Online Virus Scanner | ESET

7. Reduce items at start-up. Nothing except anti-virus is required:

• http://www.sevenforums.com/tutorials/1401-startup-programs-change.html
• http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

Let us know if this helps and further BSOD reports.

BSOD SUMMARY:

[FONT=Lucida Console]*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {38, 2, 0, fffff88001513f08}

*** WARNING: Unable to verify timestamp for iaStorA.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStorA.sys
Probably caused by : iaStorA.sys ( iaStorA+5bf08 )

Followup: MachineOwner
---------

2: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000038, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff88001513f08, address which referenced memory

Debugging Details:
------------------


READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800030c1100
GetUlongFromAddress: unable to read from fffff800030c11c0
 0000000000000038 Nonpaged pool

CURRENT_IRQL:  2

FAULTING_IP: 
iaStorA+5bf08
fffff880`01513f08 488b4a38        mov     rcx,qword ptr [rdx+38h]

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  System

TRAP_FRAME:  fffff880047e5790 -- (.trap 0xfffff880047e5790)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000fff2fbf9 rbx=0000000000000000 rcx=fffffa800b1cd590
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001513f08 rsp=fffff880047e5920 rbp=fffffa8008e4f700
 r8=fffffa800efc31b8  r9=0000000000000000 r10=fffffa8008e4f388
r11=fffffa8008e4f000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
iaStorA+0x5bf08:
fffff880`01513f08 488b4a38        mov     rcx,qword ptr [rdx+38h] ds:00000000`00000038=????????????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff80002e91569 to fffff80002e91fc0

STACK_TEXT:  
fffff880`047e5648 fffff800`02e91569 : 00000000`0000000a 00000000`00000038 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`047e5650 fffff800`02e901e0 : fffff880`009f6f40 00000000`00000000 fffff880`014d092c fffffa80`0b1cd590 : nt!KiBugCheckDispatch+0x69
fffff880`047e5790 fffff880`01513f08 : 00000000`000000ce fffffa80`0b142708 fffff880`009f6f40 fffffa80`082a3e68 : nt!KiPageFault+0x260
fffff880`047e5920 00000000`000000ce : fffffa80`0b142708 fffff880`009f6f40 fffffa80`082a3e68 fffffa80`08e4f000 : iaStorA+0x5bf08
fffff880`047e5928 fffffa80`0b142708 : fffff880`009f6f40 fffffa80`082a3e68 fffffa80`08e4f000 fffff880`01505ce9 : 0xce
fffff880`047e5930 fffff880`009f6f40 : fffffa80`082a3e68 fffffa80`08e4f000 fffff880`01505ce9 fffffa80`0b1cd590 : 0xfffffa80`0b142708
fffff880`047e5938 fffffa80`082a3e68 : fffffa80`08e4f000 fffff880`01505ce9 fffffa80`0b1cd590 fffffa80`0efc31b8 : 0xfffff880`009f6f40
fffff880`047e5940 fffffa80`08e4f000 : fffff880`01505ce9 fffffa80`0b1cd590 fffffa80`0efc31b8 00000000`00000000 : 0xfffffa80`082a3e68
fffff880`047e5948 fffff880`01505ce9 : fffffa80`0b1cd590 fffffa80`0efc31b8 00000000`00000000 fffff880`01505b8b : 0xfffffa80`08e4f000
fffff880`047e5950 fffffa80`0b1cd590 : fffffa80`0efc31b8 00000000`00000000 fffff880`01505b8b fffff880`01545140 : iaStorA+0x4dce9
fffff880`047e5958 fffffa80`0efc31b8 : 00000000`00000000 fffff880`01505b8b fffff880`01545140 00000000`00000000 : 0xfffffa80`0b1cd590
fffff880`047e5960 00000000`00000000 : fffff880`01505b8b fffff880`01545140 00000000`00000000 00000000`00000000 : 0xfffffa80`0efc31b8


STACK_COMMAND:  kb

FOLLOWUP_IP: 
iaStorA+5bf08
fffff880`01513f08 488b4a38        mov     rcx,qword ptr [rdx+38h]

SYMBOL_STACK_INDEX:  3

SYMBOL_NAME:  iaStorA+5bf08

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: iaStorA

IMAGE_NAME:  iaStorA.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  50aa9204

FAILURE_BUCKET_ID:  X64_0xD1_iaStorA+5bf08

BUCKET_ID:  X64_0xD1_iaStorA+5bf08

Followup: MachineOwner
---------

2: kd> lmvm iaStorA
start             end                 module name
fffff880`014b8000 fffff880`01783000   iaStorA  T (no symbols)           
    Loaded symbol image file: iaStorA.sys
    Image path: \SystemRoot\system32\DRIVERS\iaStorA.sys
    Image name: iaStorA.sys
    Timestamp:        Tue Nov 20 02:09:40 2012 (50AA9204)
    CheckSum:         000A393C
    ImageSize:        002CB000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4[/FONT]

 

[Wilson Yau]

how do i check whether my SSD firmware is up-to-date? Sorry for my ignorance about computers..

 

[koolkat77]

Please attach screen shots of the storage devices

 

[essenbe]

how do i check whether my SSD firmware is up-to-date? Sorry for my ignorance about computers..

Click on the start button, type Device Manager, on the entries that appear, click on device manager, go to the section that lists disk drives and expand it, right click on your SSD and select properties, click on the detail tab, you will see a drop down box there, click on the drop down box and select the 2nd entry, Hardware IDs. it will show the model of the SSD and some numbers at the end. The numbers at the end is the firmware on your SSD. Go to the manufacturers web site and find the latest firmware update and see if it is later than yours. They will tell you how to update it. this is my firmware CXMO3B1Q

View attachment 248167

 

[Wilson Yau]

I cant seem to find any updates for my SSD firmware.
Please see attached for the screenshots of my storage devices.
I'm running the scans right now, so I'll keep you guys updated.
Thanks!

 

[essenbe]

There may or may not be firmware updates for your SSD, But, Samsung SSDs usually come with a Samsung Magician program that is supposed to find if there are updates, among several other things.

 

[Wilson Yau]

I ran all the scans, and found no threats. However, i couldnt finish the system file check. I always get the BSoD at the last step of the system file check.. any clues?

 

[Wilson Yau]

and i found out something, like some sort of a pattern.. whenever i stay idle for a while, i get the BSoD..
but then.. even then i dont stay idle, i'll get the BSoD after a certain time..
this is very frustrating..

 

[koolkat77]

Let us know when you're done with all the steps in my post #4.

 

[essenbe]

Wilson, also please fill out your system specs. You can click 'My System Specs' in the bottom left of your last post, In that window will be a link 'Update my system specs', click that. Update them as completely as possible including model numbers where appropriate. When finished, click save at the bottom. It will help us to help you. At the bottom left of this post, click My system Specs to see mine for an example of what we would like to see.

If you ran the sfc /scannow System file verification, even if that is the one you BSOD during, see if anything is in the file it creates. Open an elevated command prompt (right click command prompt and select run as administrator) copy/paste this into the window. findstr /c:"[SR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfcdetails.txt" It should place a txt file on your desktop of the CBS log. Right click the txt file, select send to>compressed zip folder. place that on your desktop and upload the zip folder when you reply after finishing running Koolkat's other instructions.

Also, find a good utility like Core temp or real temp to monitor your system temps. If you have a dedicated graphics card there are utilities provided by the manufacturer of your card that will help with that. And as always with these type situations, if you are overclocking, reset everything to default values.

 

[Wilson Yau]

I'm sorry, i mean I couldnt finish the Disk Check step, because I always get the BSoD at the last step. I'm done with all other steps. All scans show no threats found.
After i ran the system file check, I followed your (essenbe) steps. However, nothing was in the text file that was created.
So what are the next steps I have to take to solve my BSod problem..?

 

[essenbe]

I suspect you are using the Hatachi drive for a data drive. I would recommend you backing up your data to an external drive. If you have an extra hard drive, replace the Hatachi. The Caution on the Crystal Disk Mark means the drive is likely to fail and may be the reason for at least the majority of your issues. If you are still under Warranty, Dell can replace the drive for you, if you run their diagnostic scan which should be built into your computer. Let me know exactly what you use the Hitachi for, and any other hardware you have replaced since owning the laptop. Try running this test for your memory. http://www.sevenforums.com/tutorials/105647-ram-test-memtest86.html It runs from ram and will not be using the hard drive. It is best run overnight as it takes quite a few hours to finish. Try to get 7 passes from it. If you get any errors you can stop right then.

 

[Wilson Yau]

I'm using my hitachi hard drive as my C drive, where everything is installed on it and downloaded on it. it's basically the main hard drive..
I've noticed something on my IRST: my hitachi drive is marked as failed.. any ways on how to fix it?
I ran the diagnostic scan from dell, no errors or whatsoever..

 

[essenbe]

Have you downloaded and monitored your temps with core temp, linked to in post #13? Also see what results you get from Hitachi's hard drive diagnostic test. I believe you said you were unable to complete disk check. Try that again along with Memtest86+. Chrystal disk Mark simply monitors the hard drive SMART results ( the drives own Self Monitoring and Error Reporting function).

Of all the tests you have done so far, the only one that has given any indication of having a problem is the Crystal Disk Mark test. Then you were unable to complete Check disk. So, I would continue to pursue that angle, while also monitoring temps whenever you are running the laptop. A very high percentage of BSODs are ram related, which is why I asked you to run Memtest86+. That is why we are asking these things. Also, if you have had several BSODs since you turned in the SF diagnostic results, you may want to run that again to see if Koolkat can get more info on the cause of the BSODs. Unfortunately, this is not an exact science and we have to run tests to find out the problem. I hope this explains a little of why we are asking you to do these things. Once we find the problem, we can usually rectify it. So far the only problem we have found is an indication it is a hard drive problem, possibly. In the first results, Kitkat asked you to remove the IRST driver, which is a storage driver, again pointing in that same direction.

 

[Wilson Yau]

I just downloaded Core Temp, and so far, the readings are around 45-47 C .. is that considered high?
So you want me to uninstall my Intel Rapid Storage Technology to see if BSoDs still occur after uninstallation?

 

[essenbe]

If those temps are at idle, yes a little high but not a great deal. Laptops always run hotter than desktops. I'll leave the IRST up to the expert. Koolkat reads the dump files, I'm not that smart. I use it and have never had a problem with it as long as you keep it updated, but again, that's up to Koolkat.

 

[Dave76]

The crashes are blaming the iaStorA.sys driver, this is the Intel RST SATA driver.
There are known issues with the latest Intel RST drivers, this can also be caused by the hard drive failing, it's possible that the issue with the Intel RST driver is causing the HDD to show errors.
Run the hard disk test first, then install an older RST driver if the HDD tests pass.

Crystal Disk Mark is indicating a problem with the hard drive.
First run the Hitachi HDD test.
D/L and run the HGST Drive Fitness Test
Use the Flash drive version, this will test the hard drive without the RST driver.
Run the Quick Test first, if it passes then run the Advanced Test.

Let us know the results.

If the above tests pass, then install the Intel RST Version: 11.2.0.1006 driver.
The drivers after this version have been known to cause instability in some computers, I have seen it with a couple Dells, using this version will help if the RST driver is causing the crashes.

Let us know if you have any questions.