Solved BSOD: How does one run the V2 Log Collector on the BSOD PC?

JeffFinnan · Nov 1, 2024

Here is RAM module a quarter of the way through its ninth pass.

On starting up a normal boot:

Back to the blue-screen automatic repair:

As I write, another module after seven hours is working through test 10 in the fourth pass with no errors as of yet.

Jeff

JeffFinnan · Nov 1, 2024

In the meantime, I ran another module this time almost to the completion of its tenth pass. No errors. I disconnected the other drives in the system. I tried to boot into windows the same results as before.

zbook · Nov 1, 2024

The main problem appears to be:

Code:

iastorvd.sys is corrupt.

This driver is Intel rapid storage technology.

The corrupt driver can be disabled.

It's unclear to me methods that work to reinstall when only Windows RE is available and whether this will be the complete fix.

[Windows 11/10] Troubleshooting - Cannot find drives when installing Windows 11/10 | Official Support | ASUS USA

Boot to Windows RE command prompt > type:

bcdedit | "find osdevice"

Dism /image:W:\ /Get-Drivers

(change the letter W to the partition drive letter displayed in the first command result)

Post a share link.

JeffFinnan · Nov 1, 2024

Quick Question. I have the other drives disconnected as stated earlier. Should I leave them as such?

JeffFinnan · Nov 1, 2024

By Windows RE, I presume that means what the bc boots into normaly, not the MCT. If so, bcdedit | "find osdevice" appears not to work.

I did leave the other drives disconnected. Using Notepad as kind of a Windows Explorer, here is what shows up:

zbook · Nov 1, 2024

Please see post #10:

X:\sources>bcdedit | find "osdevice"
osdevice partition=F:

X:\sources>

Something happened with bcdedit in post #25?

Boot to the flash drive (MCT)(Windows 11 iso) > troubleshoot > command prompt (this is Windows Recovery Environment (RE) > type:

bcdedit | find "osdevice"

dism /image:W:\ /Get-Drivers

(change the letter W to the partition drive letter displayed in the first command result)

Post a share link.

(the location of " in the command was incorrect in post #23.
bcdedit | "find osdevice" should have been bcdedit | find "osdevice"

JeffFinnan · Nov 2, 2024

Here is what I got:

Code:

X:\sources>bcdedit | find "osdevice"

osdevice                partition=C:

dism /image:C:\ /Get-Drivers yields the attached list. I suspect that not all of the list is here because the dism /image:C:\ /Get-Drivers and beginning lines that showed initially are missing at the top of the attached list.

JeffFinnan · Nov 2, 2024

In the meantime, I continued with RAM module testing us Memtest86+. When I put in the module that had been originally in slot B2 into slot A2 for single-module testing, I could not seem to get it to work. I thought I was not seating it in securely enough. When I turned the system on, the on button kept flashing with no booting occurring. On occasion, I would get this problem with other modules. If I pushed in with more pressure, the system would work. After many tries re-seating and pressing the original B2 module, the system would not boot.

I then used the two-module setup, with the suspect original B2 module, in the B2 slot. I got:

This is similar the very first time I ran the Memtest86+ with the modules in all the slots. It was during Test #2,

Out of an abundance of caution (ignorance), I put another module in slot B2 and this two-slot configuration is running just fine.

I assume then that original B2-slot RAM module is bad.

zbook · Nov 2, 2024

See if one of these commands can find more drivers in Windows RE:

dism /image:C:\ /Get-Drivers /all /format:table
dism /image:C:\ /Get-Drivers /all /format:list
dism /image:C:\Mount /Get-Drivers /all /format:table
dism /image:C:\Mount /Get-Drivers /all /format:list
driverquery /si

During each reboot into Windows RE the drive letter assignment may change.
Run bcdedit | find "osdevice" as needed.

Run as needed for possible reconfirmation of any errors found during Memtest86+ testing > run the free version Memtest86 (it runs a maximum of 4 passes and has fewer tests)

MemTest86 - Official Site of the x86 Memory Testing Tool

MemTest86 is the original self booting memory testing software for x86 and ARM computers. Supporting both BIOS and UEFI, with options to boot from USB.

www.memtest86.com

JeffFinnan · Nov 2, 2024

Yep, I have now been always confirming the osdevice. It has been C with all the other drives disconnected.

The two lines

dism /image:C:\ /Get-Drivers /all /format:table
dism /image:C:\ /Get-Drivers /all /format:list

yield results but not the next three lines. All the information is in text file.

zbook · Nov 2, 2024

Run as needed for possible reconfirmation of any errors found during Memtest86+ testing > run the free version Memtest86 (it runs a maximum of 4 passes and has fewer tests)

MemTest86 - Official Site of the x86 Memory Testing Tool

MemTest86 is the original self booting memory testing software for x86 and ARM computers. Supporting both BIOS and UEFI, with options to boot from USB.

www.memtest86.com

On a working Windows computer please download Farbar 64 bit to a flash drive.

Download Farbar Recovery Scan Tool

Farbar Recovery Scan Tool, or FRST, is a portable application designed to run on Windows XP, Windows Vista, Windows 7, Windows 8, and Windows 10 in normal or safe mode to diagnose malware issues.

www.bleepingcomputer.com

Move the flash drive to the problematic computer.

Open Windows RE > Command Prompt > type: notepad and press Enter > select open > select "Computer" and find your flash drive letter and close the notepad.

Type:
diskpart
lis dis
lis vol
sel dis 0
det dis
lis par
sel dis 1
det dis
lis par
exit

Type w:\frst64 > press Enter
(replace letter w with the flash drive letter)

After the disclaimer > press the scan button

It will make a log (FRST.txt) on the flash drive.

Please post a share link.

JeffFinnan · Nov 2, 2024

Will run MemTest86 as long time intervals permit.

Attached are the Diskpart commands and the FRST scan.

zbook · Nov 2, 2024

What are the status of backup images: Acronis and / or Macrium

Which of these restore points were tried?

==================== Restore Points =========================

Restore point date: 2024-10-09 13:17
Restore point date: 2024-10-13 03:47
Restore point date: 2024-10-16 06:01
Restore point date: 2024-10-16 06:03
Restore point date: 2024-10-20 07:27
Restore point date: 2024-10-20 07:29
Restore point date: 2024-10-21 08:36
Restore point date: 2024-10-21 11:01
Restore point date: 2024-10-25 09:45
Restore point date: 2024-10-25 09:46
Restore point date: 2024-10-25 09:46

Bitdefender and Kaspersky were seen.
Which is / are in use?

Were there prior modifications made to the drive partitions?

How come there is no reserved partition?

DISKPART> sel dis 0

Disk 0 is now the selected disk.

DISKPART> lis par

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 System 578 MB 1024 KB
Partition 2 Primary 1861 GB 580 MB
Partition 3 Recovery 680 MB 1861 GB
Partition 4 Primary 517 MB 1862 GBv

JeffFinnan · Nov 2, 2024

I have an Acronis backup from over a year ago.

I wrote early on that I had tried a 10/8 restore.

Bitdefender was used to replace Kaspersky. This Windows problem starter when Bitdefender wanted a reboot..

<<<Were there prior modifications made to the drive partitions?>>> Not that I know of.
<<<How come there is no reserved partition?>>> I do not know.

zbook · Nov 2, 2024

Please try the 10/13, 16, and 20 restore points (oldest first)(5 restore points)> post images or share links

JeffFinnan · Nov 2, 2024

Completed these four restores

After each restart, got the "Preparing Automatic Repair" followed by "Diagnosing your PC" which ends with the BSOD Automatic Repair screen.

zbook · Nov 3, 2024

After the system restores please perform the following steps: (similar to earlier steps)

Please post share links for each group of commands within code.

1) Disconnect all non-essential attached devices (drives, monitors, USB hubs, port replicators, joy stick, etc.)

2) Post a new srttrail.txt

3) Run these command prompt commands:

Code:

bcdedit /enum all
bcdedit | find "osdevice"

Code:

diskpart
lis dis
lis vol
sel dis 0
det dis
lis par
sel par 1
det par
sel par 2
det par
sel par 3
det par
sel par 4
det par
sel par 5
det par
sel dis 1
det dis
lis par
sel par 1
det par
sel par 2
det par
sel par 3
det par
sel par 4
det par
sel par 5
det par
sel dis 3
det dis
lis par
exit

Code:

bcdedit /set {default} recoveryenabled No

Code:

bcdedit /deletevalue {badmemory} badmemorylist
bcdedit /enum {badmemory}

Code:

cd C:\windows\system32\drivers
dir

Code:

cd..
chkdsk /b /v C:

If prompted:

The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process. Would you like to schedule this volume to be
checked the next time the system restarts? (Y/N)

Type: y

Reboot as needed

JeffFinnan · Nov 3, 2024

Reran a restore of 10/13. Completed the tasks above. SrtRail and Diskpart commands, results are attached. I used the built in Windows RE not the one on the MCT usb. (I saved the SrtRail and Diskpart commands to the C: drive and then copied them to a usb I popped in just before I restarted the PC.)

The chkdsk was a little diferent than describe above.

Code:

C:\Windows\System32\drivers>cd..

C:\Windows\System32>chkdsk /b /v C:
The type of the file system is NTFS.
Cannot lock current drive.

Chkdsk cannot run because the volume is in use by another
process.  Chkdsk may run if this volume is dismounted first.
ALL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
Would you like to force a dismount on this volume? (Y/N) Y
Volume dismounted.  All opened handles to this volume are now invalid.

Then this:

I hit "enter." I did not get a screen shot. However, there was some checking option to choose the Memory Diagnostic too.

I missed the very end of it but at 97% overall not problems showed yet.

I got the first screen (black) again.

In the meantime I will run another Memtest86.

zbook · Nov 3, 2024

As a trial and error step while in Windows RE (if somebody knows) try to reinstall Intel Rapid Storage Technology (IRST) driver iastorvd.sys.

Threads may be able to be opened in each Asus and Intel support forums.

After the system restores rerun Farbar as in post # 31 > post a new share link

And using Farbar this time use its registry search feature > enter: iastorvd

Post a share link.

Open administrative command prompt and type or copy and paste:

dism /image:W:\ /Get-Drivers
(change W to the applicable drive letter)
Post a share link.

bootrec /fixmbr
bootrec /fixboot
bootrec /scanos
bootsect /nt60 all

Post a share link.

reboot

Post images or share links displaying any error messages or codes.

Code:

Root cause found:
---------------------------
Startup Repair has tried several times but still cannot determine the cause of the problem.

Iastorvd.sys

Code:

Error code: (NTSTATUS) 0xc0000428 (3221226536) - Windows cannot verify the digital signature for this file.
A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Drivers displayed started with alphabet letter L

Drivers beginning with letters a - k were not displayed

Code:

X:\Windows\System32>

====================================================================
07/09/2024  07:58 PM           184,320 luafv.sys
10/26/2012  05:42 AM           266,828 LVAFT.cfg
10/26/2012  05:42 AM           351,520 lvrs64.sys
10/26/2012  05:42 AM         4,758,176 lvuvc64.sys
05/06/2022  09:19 PM           566,632 mausbhost.sys
05/06/2022  09:19 PM            99,664 mausbip.sys
10/09/2024  09:52 AM           462,848 MbbCx.sys
05/06/2022  09:19 PM            61,440 mcd.sys
05/06/2022  09:19 PM            81,752 MegaSas2i.sys
05/06/2022  09:19 PM           101,224 megasas35i.sys
05/06/2022  09:19 PM           576,856 megasr.sys
05/29/2024  05:10 PM            98,304 Microsoft.Bluetooth.AvrcpTransport.sys
07/25/2024  05:54 PM           147,456 Microsoft.Bluetooth.Legacy.LEEnumerator.sys
05/06/2022  09:19 PM         1,132,392 mlx4_bus.sys
03/26/2024  01:43 PM            86,016 mmcss.sys
10/27/2023  06:47 AM            81,920 modem.sys
05/29/2024  05:10 PM           118,784 monitor.sys
05/06/2022  09:19 PM            95,592 mouclass.sys
05/06/2022  09:19 PM            69,632 mouhid.sys
10/27/2023  06:45 AM           136,688 mountmgr.sys
05/06/2022  09:19 PM            90,472 mpi3drvi.sys
10/27/2023  06:44 AM           110,592 mpsdrv.sys
01/01/2021  03:05 AM           105,248 mrcbt.sys
08/05/2020  07:11 AM           101,528 mrcbt.sys.{346A5770-1F11-4976-A552-635C0C0FECE3}.bak
01/01/2021  03:05 AM            79,840 mrigflt.sys
02/11/2020  06:01 AM            79,840 mrigflt.sys_
08/15/2019  08:18 AM            65,936 MRVDP.sys
05/06/2022  09:20 PM           196,608 mrxdav.sys
09/27/2024  01:27 AM           673,288 mrxsmb.sys
09/27/2024  01:27 AM           333,296 mrxsmb20.sys
10/27/2023  06:45 AM            79,216 msfs.sys
08/27/2024  12:45 PM           222,688 msgpioclx.sys
10/27/2023  06:45 AM            95,728 msgpiowin32.sys
05/06/2022  09:19 PM            49,152 mshidkmdf.sys
05/06/2022  09:19 PM            49,152 mshidumdf.sys
05/06/2022  09:19 PM            61,440 mshwnclx.sys
05/06/2022  09:19 PM            54,608 msisadrv.sys
10/27/2023  06:44 AM           333,288 msiscsi.sys
10/09/2024  09:52 AM            73,728 mskssrv.sys
10/27/2023  06:45 AM           102,400 mslldp.sys
05/06/2022  09:19 PM            49,152 mspclock.sys
05/06/2022  09:19 PM            49,152 mspqm.sys
03/26/2024  01:43 PM           441,824 msquic.sys
09/27/2024  01:27 AM           411,120 msrpc.sys
05/06/2022  09:19 PM            79,216 mssmbios.sys
05/06/2022  09:19 PM            53,248 mstee.sys
05/06/2022  09:19 PM            53,248 MTConfig.sys
10/27/2023  06:45 AM           169,328 mup.sys
05/06/2022  09:19 PM            64,872 mvumis.sys
05/06/2022  09:19 PM           147,304 ndfltr.sys
09/10/2024  04:21 PM         1,635,832 ndis.sys
05/06/2022  09:20 PM            86,016 ndiscap.sys
05/29/2024  05:11 PM           167,936 NdisImPlatform.sys
10/27/2023  06:45 AM            65,536 ndistapi.sys
05/06/2022  09:19 PM           102,400 ndisuio.sys
05/06/2022  09:19 PM            57,344 NdisVirtualBus.sys
10/27/2023  06:45 AM           237,568 ndiswan.sys
05/06/2022  09:20 PM            83,288 NDKPerf.sys
05/06/2022  09:20 PM           107,872 NDKPing.sys
10/27/2023  06:45 AM           122,880 ndproxy.sys
10/27/2023  06:46 AM           188,416 Ndu.sys
07/25/2024  05:54 PM           398,832 NetAdapterCx.sys
10/27/2023  06:45 AM            95,728 netbios.sys
10/27/2023  06:45 AM           327,680 netbt.sys
07/25/2024  05:54 PM           660,856 netio.sys
07/25/2024  05:54 PM           329,088 netvsc.sys
10/27/2023  06:45 AM           120,176 npfs.sys
05/06/2022  09:19 PM            65,536 npsvctrig.sys
05/06/2022  09:19 PM            77,824 nsiproxy.sys
08/13/2024  09:22 AM         3,331,552 ntfs.sys

JeffFinnan · Nov 3, 2024

I am about 75% through Pass 4 for Memtest86 on a module. Not sure I understand a lot of the above. I've got some questions.

<<<As a trial and error step while in Windows RE (if somebody knows) try to reinstall Intel Rapid Storage Technology (IRST) driver iastorvd.sys.>>>

I presume this relates to the link and ASUS video you shared in post #23 and info on downloading IRST. Since I cannot get Windows RE to work from the PC itself, I then I boot to the MCT then, correct? Also, the Asus video suggest disabling it in BIOS. Is that worth a try?

<<<Threads may be able to be opened in each Asus and Intel support forums.> Are you suggesting that I ask for help there?

Not sure how I missed a-k drivers. Will repeat.

I see where the "Root cause found" comes from but not the error code related to Iastorvd.sys.

Thanks for all this work.
Jeff

Solved BSOD: How does one run the V2 Log Collector on the BSOD PC?

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

Attachments

My Computer

Well-known member

My Computer

Well-known member

My Computer

Similar threads