BSoD on startup, login screen. Driver error

[Berbe]

Hello,

On startup today, my computer made 2 chained BSoD:

1. The first one did not write anything to disk (hung after the 'disk initialization' step).
2. The second one actually produced a memory dump. Minidump is attached

After a quick analysis, it appears the error was due to a driver:

DEFAULT_BUCKET_ID:  WIN7_DRIVER_FAULT

However, before enbling the Driver Verifier, I am seeking your help to check if any piece of information could be gathered to focus the verification on some of them with the help of the provided Minidump.

The blamed binary (csrss.exe) has of course nothing to do with those events.

Thanks for any specialized investigator willing to give a hand on the matter.

 

[Golden]

Very little can be done with just a single .dmp file, however, you have a 0xF4. Thats typically a hard disk error.

Run the LONG test of the DOS version of SeaTools as described here:
http://www.sevenforums.com/tutorials/313457-seatools-dos-windows-how-use.html

 

[Berbe]

There is a driver problem. You underline a link to disks.
Isn't it premature to talk about disk failure?

I reduced checks to disk-related drivers and produced a BSoD (cf. attachment). I will see to update it.

Anything else?

 

[Golden]

I've interrogated the first .dmp file using WinDBG and no drivers are flagged as a problem.

Since you only ever post a .dmp file - hint : read the instructions for seeking BSOD help - all I can do is take a guess at the error from the many 0xF4 ' s I have seen here. If you think it's premature, I'll leave you to work it out.

 

[Berbe]

I was merely asking a question, there. What I think is no conclusion.

What information are you seeking for? Are you talking about instructions from this thread?
If positive, it is said a ZIP file would be created on my desktop... Nothing there, although I accepted the UAC prompt and the terminal window was busy gathering information around for quite some time.

[EDIT]
I deactivated .vbs scripts on my machine, that is why the archive generation did not work.
I manually created the attached one from the folder where the information has been collected.

 

[Golden]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {23e, fffffa80128bf2c0, fffff9800366eea0, 0}

*** WARNING: Unable to verify timestamp for iaStorF.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStorF.sys
Probably caused by : [B][COLOR="Red"]iaStorF.sys[/COLOR][/B] ( iaStorF+1a8e )

Followup: MachineOwner
---------

Remove Intel Rapid Storage Technology applications.

1. Uninstall it from Control Panel > Programs and Features.
2. Uninstall the driver from device manager:
- Right click on "my computer" icon and click "manage" on the context menu.
- In the "Computer Management" window that opens:
- Select "Device Manager" in the left pane, It will list all the existing devices.
- Expand "IDE ATA/ATAPI controllers" by clicking on the triangle in front of it.
- Select one Intel device item under it, right click, then uninstall.
- Repeat the process for all Intel items under "IDE ATA/ATAPI controllers"
3. Now restart the computer.
4. Once booted, Windows will auto configure the appropriate native system driver.

 

[Berbe]

RAID
OK, I removed a stockpiled bunch of different RAID drivers getting activated one after the removal of another... :shock:
I ended up with

\Windows\system32\drivers\iaStorV.sys

for which the Device Manager does not offer any option to delete it. From what I read on the Web, it must be the default driver installed by the system.
It provides the name of my actual hardware Chipset RAID controller, that is thus reassuring.

Back to that state, I used the Driver Verifier to tickle the same driver which produced the last BSoD... and got another one. So disk-related trouble has not reached an end yet.


Hard-disks
I noticed some drivers I thought uninstalled are still there:

iaStorA      iaStorA                iaStorA                Kernel        Boot       Running    OK         TRUE        FALSE        4ÿ096      1ÿ310ÿ720  0      27/07/2015 11:26:48    C:\Windows\system32\DRIVERS\iaStorA.sys          4ÿ096     
iaStorF      iaStorF                iaStorF                Kernel        Boot       Running    OK         TRUE        FALSE        4ÿ096      12ÿ288     0      27/07/2015 11:27:05    C:\Windows\system32\DRIVERS\iaStorF.sys          4ÿ096

Looking through the Device Manager, I notice that, while the RAID controller is using the correct driver (iaStorV), the disk entries show they use 3 drivers:

\Windows\system32\drivers\disk.sys
\Windows\system32\drivers\iaStorF.sys
\Windows\system32\drivers\partmgr.sys

Is it safe to uninstall the disk? There is no checkbox to delete any driver, though...?
What should I do to get back to the default iaStorV?


Resources
Attached is provided another Zip archive (purged from past minidumps you already got before).

As an addition, digging into the batch file behind the information collection, I suggest you use the correct way to determine the right Desktop location in Windows 7 (parsing Registry values):

REG QUERY "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop

When one's move his/her personal folders around, the usual trick of using the 'Desktop' folder of the user's home directory fails to end-up at the right location.

Maybe should you also find a way to start VBS scripts when the default file association is removed, if possible, since you got the UAC prompt elevating the script's privileges when it started.

 

[Golden]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {23e, fffffa80115862c0, fffff9800496ae50, 0}

*** WARNING: Unable to verify timestamp for ElbyCDFL.sys
*** ERROR: Module load completed but symbols could not be loaded for ElbyCDFL.sys
*** WARNING: Unable to verify timestamp for iaStorF.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStorF.sys
Probably caused by : ElbyCDFL.sys ( ElbyCDFL+2453 )

Followup: MachineOwner
---------

1: kd> lmvm ElbyCDFL
start             end                 module name
fffff880`07b97000 fffff880`07ba5000   ElbyCDFL T (no symbols)           
    Loaded symbol image file: ElbyCDFL.sys
    Image path: \SystemRoot\System32\Drivers\ElbyCDFL.sys
    Image name: ElbyCDFL.sys
    Timestamp:        Fri [B][COLOR="Red"]Dec 15 [/COLOR][/B]07:52:27 [B][COLOR="red"]2006[/COLOR][/B] (4581C093)
    CheckSum:         000113B5
    ImageSize:        0000E000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4

Systems with pre-Windows 7 drivers running on Windows 7 are bound to be unstable. I recommend you update all the device drivers on your system.

 

[Berbe]

Thanks for your help so far.

How do you get such information?

Having read and following the instructions on the Getting Started thread everytime I wanna dig into some memorydump, the analysis is inconclusive at best or wrong at worst (blaming system processes)...

I removed that old driver but it was not there in the past BSoD (I installed it recently because the default Windows disk image burner failed me)... So the root cause of those BSoD is still there.

Any word on how to get totally rid of the remaining Intel (Matrix|Rapid) Storage services & drivers?

 

[Berbe]

Generated another BSoD after removal of the problematic (and freshly -un-installed driver)

 

[Golden]

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C9, {23e, fffffa801179e2c0, fffff98004dcaea0, 0}

*** WARNING: Unable to verify timestamp for iaStorF.sys
*** ERROR: Module load completed but symbols could not be loaded for iaStorF.sys
Probably caused by : iaStorF.sys ( iaStorF+1a8e )

Followup: MachineOwner
---------

Are you running a hardware RAID setup on any of the disks?

 

[Berbe]

My BIOS is configured in RAID mode (as opposed to AHCI), but no software RAID is configured, as I thought my chipset was RAID-1 compatible (based on what Intel says), but seems not to be in practice (a RAID-0 option was solely available).

The Intel Rapid Storage program was uninstalled as requested in a previous post, but I still can see existing services about it.

I got different versions of the iaStor driver being loaded, but I do not know what to do about them: see the previous posts about it.

Trying to force some iaStor drivers (iaStorA & iaStorF if I remember well, since their last modified timestamp is way more recent than iaStor & iaStorV, see below) to not get loaded on startup by renaming them produced immediate BSoD in HDD access attempt at boot time. Thus, Win7 seems not to be able to automatically scale-down drivers by itself.
There is no 'uninstall' option available anymore on the RAID controller in the Device Manager.

'Last modified' timestamps for iaStor driver files:

iaStor.sys  2010-11-05 22:45
iaStorA.sys 2015-07-29 19:44
iaStorF.sys 2015-07-29 19:44
iaStorV.sys 2011-03-11 07:41

 

[Golden]

In the BIOS, change from RAID to AHCI. Reboot and monitor for BSOD.

 

[Berbe]

I am surprised by you solution: changing BIOS options from/to RAID from/to AHCI usually never works as-is, and usually it ends up with OS reinstall.

I just tried that and it produced an immediate BSoD which I cannot describe better than this forum post:

on my Dell E6510 I have my disk drive set to RAID mode. I have issues using the eSata port so I want to switch to AHCI. I followed the instructions here:http://support.microsoft.com/kb/922976. However when I boot my system after setting the disk mode to AHCI in the BIOS I see the Windows logo (using Win7 x64) and some seconds later I get a bluescreen with a message I can't read because the system is rebooting. Changing the BIOS back to RAID brings up the system again...
Anything I can do to make AHCI working?

The thing is I do not have the same machine as this guy so I do not know if the solution given to him, which I pasted below, applies to me. Have a look at my system specifications if you wish.

I believe I have the solution to your problem and I verified it against a Dell machine that has similar controller with your machine. Changing from AHCI to RAID,http://support.microsoft.com/kb/922976 fix will work. Changing from RAID to AHCI, you need one more step. Msahci driver requires Atapi.sys miniport to be loaded during boot as well. So you need to change theStart value to 0 for both of the following entries in your registry. You can use regedit.exe utility.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\msahci
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\atapi
Or you can also simply run the below command lines in an elevated window.
REG ADD HKLM\System\CurrentControlSet\Services\msahci /v Start /d 0 /f /t REG_DWORD
REG ADD HKLM\System\CurrentControlSet\Services\atapi /v Start /d 0 /f /t REG_DWORD

 

[Berbe]

I followed the advice I provided and I successfully restarted in AHCI BIOS mode.

I triggered another BSoD with the Driver Verifier. Information attached.

 

[Berbe]

Anyone? :huh:

 

[Berbe]

Everyone gave up on my case?

I am still triggering the BSoD with the same driver. I am unpiling the stack of crap, but... help, I need some help!

 

[Golden]

Now that you are booting in AHCI, see if you can uninstall all the Intel Rapid Storage drivers.

Uninstalling the Intel(R) Rapid Storage Technology driver - Microsoft Community

 

[Berbe]

I followed the procedure detailed on your link.

I was able to successfully disable startup of 3 of the 4 drivers. I also deleted the associated 'Non Plug-and-Play' devices created with their DISPLAY_NAME.

SERVICE_NAME: iastor
        TYPE               : 1  KERNEL_DRIVER
        START_TYPE         : 4   DISABLED
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : \SystemRoot\system32\DRIVERS\iaStor.sys
        LOAD_ORDER_GROUP   : SCSI Miniport
        TAG                : 25
        DISPLAY_NAME       : Intel RAID Controller
        DEPENDENCIES       :
        SERVICE_START_NAME :

SERVICE_NAME: iastora
        TYPE               : 1  KERNEL_DRIVER
        START_TYPE         : 4   DISABLED
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : \SystemRoot\system32\DRIVERS\iaStorA.sys
        LOAD_ORDER_GROUP   : SCSI miniport
        TAG                : 64
        DISPLAY_NAME       : iaStorA
        DEPENDENCIES       :
        SERVICE_START_NAME :

SERVICE_NAME: iastorv
        TYPE               : 1  KERNEL_DRIVER
        START_TYPE         : 4   DISABLED
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : \SystemRoot\system32\drivers\iaStorV.sys
        LOAD_ORDER_GROUP   : SCSI Miniport
        TAG                : 25
        DISPLAY_NAME       : Contrôleur RAID Intel Windows 7
        DEPENDENCIES       :
        SERVICE_START_NAME :

The DriverView utility does not show them loaded anymore.

However, iaStorF gives me trouble:

SERVICE_NAME: iastorf
        TYPE               : 1  KERNEL_DRIVER
        START_TYPE         : 0   BOOT_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : \SystemRoot\system32\DRIVERS\iaStorF.sys
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : iaStorF
        DEPENDENCIES       :
        SERVICE_START_NAME :

Its LOAD_ORDER_GROUP seems to be empty (is it a problem?), there is no device appearing with its alleged name iaStorF in the 'Non Plug-and-Play' devices list in the Device Manager.

Furthermore, having tried to disable it with:

sc config iastorf start= disabled

I got a BSoD on startup...

Questions:

1. How to find out its dependencies?
2. Is it safe to delete the 3 disabled services and removing their associated driver file?

Thanks,