iaStor.sys BSOD

I have a computer that is showing this error in blue screen of death. iastor.sys an attempt was made to write ot read-only memory.
I have used system restore not as far back as possible. But I don't know whether I should restore back to december 2010.
I can boot to safemode. Ran Kaspersky av from boot cd one java threat found and removed.
sfc can not repair all problems. I have the option of manually replacing file. But I need access to windows 7 cd. Does it have to be bit specific? 64 or 32?
I have not run combofix but I don't know if it is possible to run combofix on windows 7, I assumed that it could not be done and was only available for windows xp.
sorushAsked:
Who is Participating?
 
_3mp3ror_Connect With a Mentor Commented:
I thought that by renaming the driver that windows would use it's native driver. Hence the error.

By the way when you first had the bosd was the error stop:0x000000BE ?

Another idea to uninstall the driver is:

- Boot in Safe mode with command prompt (BSOD in regular Safe mode)
- Open device manager with command "devmgmt"
- Browse for "IDE ATA/ATAPI controllers"->"Intel...SATA AHCI Controller".
- Right-Click on it and select properties.
- In "Driver" tab, click on Roll Back Driver.

Source

What about the BIOS settings ?

Regarding combofix I never used it so I can't help you there.
0
 
_3mp3ror_Commented:
I have the option of manually replacing file. But I need access to windows 7 cd. Does it have to be bit specific? 64 or 32?
Yes if there are corrupt files involved.

Also the file is from Intel, since you have windows 7 I hope you installed the latest version

Intel® Rapid Storage Technology

If you get into a command prompt from a windows 7 cd try to delete the iastor.sys (or rename it).
After that it should boot, then uninstall the version you have and get the latest from intel's site. Link.

0
 
sorushAuthor Commented:
Would system file checker run from a windows 7 cd resolve the problem?
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
_3mp3ror_Commented:
Unlikely, but if you decide to use it then see this KB article on how to use SFC. But as they say "missing or corrupted system files"
While this may be true I am more inclined to believe it's just an older version of the driver.

Another idea is to check the BIOS and see if the hard drive is set to AHCI or IDE mode.  bios-ahci.png
Toggle these settings and see if it boots.
0
 
sorushAuthor Commented:
I tried renaming the iastor.sys to iastor.old and now I get a blue screen  0x0000007B (0xFFFFF880009A98E8 .....
There are a number of questions in my original post that haven't been answered.
0
 
sorushAuthor Commented:
In terms of AHCI or IDE mode, The bios is very low in features.. Aptio Setup Utility - Copyright 2007 American megatreds inc. I can not see any settings for the ID being in AHCI or IDE.
0
 
sorushAuthor Commented:
Yes the original error does have 0x000000BE, What does it mean and where can I find more information about these errors

0
 
sorushAuthor Commented:
Now when I try to login safe mode I get the error 0x0000007B etc etc.. I'm going to rename the iastor.sys back to its original name.
0
 
_3mp3ror_Commented:
And tell me if you have any luck getting into the command prompt in safe mode.
The error code is explained here
http://aumha.org/a/stop.htm

0x000000BE: ATTEMPTED_WRITE_TO_READONLY_MEMORY
A driver attempted to write to read-only memory. Commonly occurs after installing a faulty device driver, system service, or firmware. If a driver file is named in the error message, try to correct the problem by disabling, removing, or rolling back the driver.

More stop code info is also available here
http://pcsupport.about.com/lr/stop_codes/378033/1/
0
 
sorushAuthor Commented:
The resolution of this error has lead to a new error for which I have to open a new discussion
0
 
_3mp3ror_Commented:
Some users from this forum also reported this issue.
Some were infected with a root kit that seems to corrupt the iastor.sys file
This rootkit infects the storage drivers of your computer, by replacing them with modified versions. Such as iastor.sys on intel based machines.

I wanted to add this because the 0x0BE stop code may also refer to this.

By the way is this a fresh install of windows 7 or you had it installed for some time ?
If you just installed it then it may very well be a bad(old) driver but if this happened out of the blue (i.e. without changing anything important to the system such as drivers, registry settings, etc.) and your windows 7 was working well prior to the blue-screen  then this would sound more like malware/rootkit problem then a driver problem.

Although you did scan with kaspersky from a boot cd you should know that the virus definitions are quite old.
0
All Courses

From novice to tech pro — start learning today.