Tripredacus

My co-worker's computer (around noon time EST) decided to do some BSOD. It is 0x8E pointing to iaStorv.sys (Intel Matrix). His data volume is a 4 drive RAID5. It is healthy in the RAID BIOS. The computer will BSOD after being in Windows after about 2-5 minutes. Logging into the OS is not required. Safe Mode works fine, even when accessing (copy, move, delete files) the RAID volume. I have already updated to the latest driver for the board. OS: Windows 7 Enterprise SP1 x86 Board: Intel DX58SO The same BSOD happens with either driver. He has already tried a previous restore point without a problem. MODULE_NAME: iaStor FAULTING_MODULE: 82c37000 nt DEBUG_FLR_IMAGE_TIMESTAMP: 4cd505bd EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. FAULTING_IP: iaStor+2ff15 8be3af15 8b4704 mov eax,dword ptr [edi+4] TRAP_FRAME: b000f744 -- (.trap 0xffffffffb000f744) ErrCode = 00000000 eax=8890e800 ebx=00000000 ecx=0000000e edx=8890e790 esi=8890e790 edi=00000000 eip=8be3af15 esp=b000f7b8 ebp=b000f7c8 iopl=0 nv up ei ng nz na pe nc cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286 iaStor+0x2ff15: 8be3af15 8b4704 mov eax,dword ptr [edi+4] ds:0023:00000004=???????? Resetting default scope DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT BUGCHECK_STR: 0x8E CURRENT_IRQL: 0 LAST_CONTROL_TRANSFER: from 82cec01c to 82d15e9c STACK_TEXT: WARNING: Stack unwind information not available. Following frames may be wrong. b000f2b4 82cec01c 0000008e c0000005 8be3af15 nt!KeBugCheckEx+0x1e b000f6d4 82c75e66 b000f6f0 00000000 b000f744 nt!RtlAppendUnicodeToString+0x45d b000f764 82c05ba9 85e4cc7c 00000000 00000000 nt!Kei386EoiHelper+0x1de b000f7c8 82c6e5be 864aab50 8890e800 94057888 hal!KfLowerIrql+0x61 b000f7e0 8bf86f2b 8bf8a4a4 82c6e539 00000001 nt!IofCallDriver+0x64 b000f814 8bf92aba b000f8e8 2a861fdf 00000000 MpFilter+0xf2b b000f8a8 8bf926af c0000004 b000f8e8 00000000 MpFilter+0xcaba b000f8c4 8bf5519a 85f5fc78 b000f8e8 b000f900 MpFilter+0xc6af b000f930 8bf5a9ec 85e28008 85f5fc18 3bf5d18d fltmgr!FltDetachVolume+0x832 b000f998 8bf5ac5b 88ceaeb0 88edb4f8 88edb4f8 fltmgr!FltProcessFileLock+0x20a0 b000f9c8 82c6e5be 88ceaeb0 88edb4f8 82d6eb88 fltmgr!FltProcessFileLock+0x230f b000f9e0 82dd0daf 82c03870 864aab50 82c03900 nt!IofCallDriver+0x64 b000fa44 82cdf57e 864aab50 85f5f301 00000000 nt!NtDeleteFile+0x67c b000fa7c 82e7cd19 85f5f320 b000fba8 b000fb40 nt!RtlCopyUnicodeString+0x16e b000fb60 82e5cc2e 864aab50 a5bbf3f8 85f73008 nt!NtClose+0x821 b000fbdc 82e6d040 00000000 b000fc30 00000040 nt!ObCreateObject+0x90b b000fc38 82e63b1e 00bbe4d0 85bbf3f8 00000001 nt!ObOpenObjectByName+0x165 b000fcb4 82e87396 00bbe52c 80100080 00bbe4d0 nt!NtAllocateVirtualMemory+0x1f52 b000fd00 82c7527a 00bbe52c 80100080 00bbe4d0 nt!NtCreateFile+0x34 b000fd34 76e67094 badb0d00 00bbe498 00000000 nt!ZwYieldExecution+0xb66 b000fd38 badb0d00 00bbe498 00000000 00000000 0x76e67094 b000fd3c 00bbe498 00000000 00000000 00000000 0xbadb0d00 b000fd40 00000000 00000000 00000000 00000000 0xbbe498 STACK_COMMAND: kb FOLLOWUP_IP: iaStor+2ff15 8be3af15 8b4704 mov eax,dword ptr [edi+4] SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: iaStor+2ff15 His PC does not have the debugger installed, and it won't let me install it in Safe Mode due to a DCOM error with MSIServer. So I had to analyze on my own PC. Other than updating the drivers, I can't think what else to try, and I'm not sure what I'm looking for in the dump. Any ideas?

I forgot to post this as I posted it in that thread as well: There is some changes to how VBScript is handled between WinPE 2.0 and WinPE 3.0, this I ran into when I updated my HTA as well. The changes aren't documented as far as I know. But I wonder if you are having the same problem in WinPE 2.0?

I'll agree. The WMI code is suspect because it is written expecting it to work 100% of the time. For example, there is no check to see if the data collected is an object, or is an array. Did you install the WMI package into your WinPE? Are you using WinPE 2.0 like the OP has this coded for? There is some changes to how VBScript is handled between WinPE 2.0 and WinPE 3.0, this I ran into when I updated my HTA as well. The changes aren't documented as far as I know.

Clicking through some thing, it seems that these old Excel macros used something called "XLM" format saved into an .xlm file. Not to be confused with XML. Anyways, it looks like XLM macros were platform independent and allowed you to use them in both Windows and Macintosh versions of Excel. I found this link: http://plymdesign.com/microsoft-excel/macros-for-macintosh-excel-2008-using-xlm/ My search terms: XLM Macros Excel 4.0 macro language I hope this isn't what you were looking for... since... it would be strange to find something for The Finder. Its like the Keymaster going to the hardware store to copy a key.

I knew it ran in the background now (its in the event logs)... Does it still do the disk space check?

Seems he comes up with more math to try out.

Hmmm I see, second welcome...

I'll presume this is a typo...

What packages have you added into your WinPE?

Link to WinPE builds removed.

I don't think we have one either.

Did you try this one? http://blogs.technet.com/b/fixit4me/archive/2009/03/31/error-code-2738-when-running-a-microsoft-fix-it-solution.aspx

You should try to keep enough free diskspace for whatever that % that Defrag needs to be able to run.

Something you could test on a VM or other system... just an idea (probably not a good one). Is to delete the data in those keys, then change the permissions on them so that they cannot be written to. So as an example, you would still have an ".ai" class but with no data. But a situation may occur that locking those keys would cause an update to fail if it couldn't write the registry key.

I think it would be possible if you had a dual boot, but the problem would be that the processes that is running setup.exe would not be able to replace themselves during the repair.

I can't get to the company's website (Ruanmei) but their certificate is valid.

If the mass storage driver is not installed, Diskpart can't see anything. If you do a LIST DISK, it will return "No fixed disks" message.

Is it conceivable that Tihiy might post a procedure for accomplishing what he did, rather than uploading OS files? (The assumption would be that the user already has the necessary files, and only needs to port and modify them accordingly.) Or would the procedure be too difficult to replicate? --JorgeA He mentions to me that it wouldn't be a redist, but a patcher. Anyways, he knows our rules already so I'm sure it will be fine.

What is the actual formatted size of the boot partition? Some BIOSes do not support booting 2GB+ over USB. If you can do a test, build a bootable WinPE using a small USB to see if it works on those problem computers.

Ok I didn't know about "cutting the wire shorter" before. I suppose it depends entirely on whether or not the thing you are plugging into is also designed to not have a connection at that point as well. I had a certain picture in my head when typing that (ie USB connector block) which has the N/C pin physically removed.

I see what you mean. First let me point out that the actual appearance of the memory doesn't matter. Unless you are running a computer fashion contest, most people never actually ever see their memory after it is installed. I think what we will need (unless you get lucky with searching) is the part number off the RAM itself. That will make it easier to locate, rather than searching for those generic terms which lead to finding a false positive on Crucial's website. I know a Crucial guy, maybe I can ask him if he can track it down using the name you posted.

How about at Crucial? http://www.crucial.com/store/partspecs.aspx?imodule=BLT2G3D1337DT1TX0

Intel AMT is aimed mainly at Enterprises. You can read about it here: http://en.wikipedia.org/wiki/Intel_Active_Management_Technology I never go about and disable those services, since the only one that may be annoying is the one that writes the event logs saying the service isn't started. I imagine that you wouldn't use any of those features if it is just your home computer.

I've only used that page to run recovery, but is there any Warnings or Errors in Event Viewer that might give some more detailed information?

You can do your own boot options using Terabyte Unlimited's MBR program. You can see some example here where I created my own recovery partition.