1

Some years ago I had a failing HDD that, in its dying breath, had a cloned image of it installed onto a new HDD. The problem is that the old HDD wasn't working anymore in the end and some data (I think less than 100MB, out of 250GB) was irretrievably lost. Since then, I've had some BSOD, mostly due to random causes (loosened RAM, drivers, etc.), but for some time now I've been having exactly the same problem.

BlueScreenViewer tells me that I have a 0x01a MEMORY_MANAGEMENT crash caused by ntoskrnl.exe . The fist parameter is always 41790, which, according to this https://msdn.microsoft.com/en-us/library/windows/hardware/ff557391%28v=vs.85%29.aspx means that: "A page table page has been corrupted. On a 64 bit version of Windows, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32 bit version of Windows, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs." Indeed, the second parameter is almost always the same.

Here are the most recent crashes: (sorry about the untidiness, I couldn't format it properly)

Dump File           Crash Time          Bug Check String    Bug Check Code  Parameter 1     Parameter 2         Parameter 3         Parameter 4         Caused By Driver    Caused By Address   File Description        Product Name                Company         File Version                    Processor   Crash Address       Stack Address 1     Stack Address 2     Stack Address 3 Computer Name   Full Path               Processors Count    Major Version   Minor Version   Dump File Size  Dump File Time
061415-35100-01.dmp 14/06/2015 00:24    MEMORY_MANAGEMENT   0x0000001a  00000000`00041790   fffffa80`07a45fd0   00000000`0000ffff   00000000`00000000   dump_ataport.sys    dump_ataport.sys+4fb4a40                                                                                                  x64       ntoskrnl.exe+748c0                                                                          C:\Windows\Minidump\061415-35100-01.dmp 8           15      7601              302.111       14/06/2015 00:26
061315-38657-01.dmp 13/06/2015 21:28    MEMORY_MANAGEMENT   0x0000001a  00000000`00041790   fffffa80`07a5c050   00000000`0000ffff   00000000`00000000   ntoskrnl.exe        ntoskrnl.exe+748c0  NT Kernel & System      Microsoft® Windows® Operating System    Microsoft Corporation   6.1.7601.18869 (win7sp1_gdr.150525-0603)    x64     ntoskrnl.exe+748c0                                          C:\Windows\Minidump\061315-38657-01.dmp 8               15      7601              302.047       13/06/2015 21:30
060715-40185-01.dmp 07/06/2015 19:53    MEMORY_MANAGEMENT   0x0000001a  00000000`00041790   fffffa80`07a5cf20   00000000`0000ffff   00000000`00000000   USBSTOR.SYS         USBSTOR.SYS+57dfa40 USB Mass Storage Class Driver   Microsoft® Windows® Operating System    Microsoft Corporation   6.1.7601.17577 (win7sp1_gdr.110310-1504)    x64     ntoskrnl.exe+72a40                                          C:\Windows\Minidump\060715-40185-01.dmp 8       15      7601              302.047       07/06/2015 19:55
050915-56113-01.dmp 08/05/2015 23:43    MEMORY_MANAGEMENT   0x0000001a  00000000`00061940   00000000`06e00000   00000000`00000000   00000000`00000000   ntoskrnl.exe        ntoskrnl.exe+72a40  NT Kernel & System      Microsoft® Windows® Operating System    Microsoft Corporation   6.1.7601.18869 (win7sp1_gdr.150525-0603)    x64     ntoskrnl.exe+72a40                                              C:\Windows\Minidump\050915-56113-01.dmp 8           15      7601              302.047       09/05/2015 00:10

I've ran lots of malware scanners, all of them come clean.

When I run sfc /scannow, no integrity violations are found.

But when I run chkdsk /f or /r (which I need to use /x, otherwise no repairs are made, even in reboot) some strange things appear:

1- I always have "4 KB in bad sectors."

2- This is almost constant:"Cleaning up 152[*or a different number, but the next two unused things are the same number] unused index entries from index $SII of file 0x9. Cleaning up 152 unused index entries from index $SDH of file 0x9. Cleaning up 152 unused security descriptors."

I ran some tests on the HDD and it gets a pass. I ran HCI MemTest and the RAM seems to be fine, but when it gets to the page file recorded on the HDD some errors start to appear. Windows Memory Diagnostic also found no problems with my RAM.

So, this got me wondering: could my BSOD be caused by some corrupt files from the old HDD image (like the ntoskrnl.exe)? If so, how can I repair these files? Would it be safe or a good idea to delete ntoskrnl.exe and install it again (assuming I can copy this out of another Windows machine)? And is it possible to build a new MFT file record?

As you can see I'm not very savvy, so thank you very much for any help!

My setup is a Windows 7 Ultimate x64, Core i7, 12GB RAM, Nvidia GeForce GTX260, OS HDD is a WD5000AVCS, plus 4 other HDDs (3 are external USB drives)

PS: I've just updated my GPU driver, but I don't think this will help

PS2: I never did any overclocking and my RAM settings are correct according to the motherboard manufacturer (Intel ran some tests with my RAM Kingstone setup), 2 x 2GB 1333, 2x 4GB 1333

EDIT: one thing I just realised is that I was running a lot of programs at the time of the last crashes... Could it be a conflict problem? I'll try to run some of them at the same time and see if a BSOD happens

  • windows memory diagnostics are ok for a fully failing memory, but you need to boot off a memdisk86 usb to test the memory hard , and for long times. SFC assumes that your files are ok, which should include the kernel file items. What the raw data shows from a hard drive smart test, would be better information then some software saying it passed. Certain areas of the hard disk are used/abused a Lot more than others, if you used a lot of paging , , , potentially you could change the location of the paging, and lock the size and all which could shift the location, and test more. – Psycogeek Jun 14 '15 at 8:26
  • Paging memory problems could be caused by tiny fails in the ram, written out to paging. Or could be the hard drive getting tiny error including cable issues if you have had errors of this type before. I dont follow error info well (it can lead to looking the wrong places),but you basically know what is suspect, you just need to investigate them closer. (of course it could be 101 other things). Right after boot specific (un-needed) components of the os are paged out in xp and win 7 , probably re-used on the way out only, there is a tweak that can keep these in ram, it would "change" things. – Psycogeek Jun 14 '15 at 9:09
  • Thanks a lot for all the information!!! How can I change the location of the paging? I suspected it was a problem with the paging file because I read somewhere (I tried to find the site now, but no luck...) that when HCI MemTest is running on multiple instances (e.g., 6x 2048MB) and presents errors only in the last one (that uses "All unused RAM"), then it isn't a RAM problem, it's a paging problem, because the HDD is used as memory in this case. All other instances were left running for a day and presented no errors. But you're right, as soon as I finish some work I'll run memdisk86 – flen Jun 14 '15 at 21:06
  • In control pannel "system" Advanced system settings , Advanced Tab , performace settings , Advanced Tab , Virtual Memory , Change button. After making changes you must hit Set, and any change requires a reboot. Putting it on another disk is easy. Causing it to move is very trickey, you first have to disable it , reboot, put files items where it was, then create it again Set, and reboot again. Did i mention trickey :-) Is better to check your cables and hard disk and replace hard disk, IF that was the problem, it wont go away forever anyway until you replace it. – Psycogeek Jun 14 '15 at 21:17
  • Thanks again!:) I've been running chkdsk /r every night since the last BSOD, somehow I think this fixed it (though the 1st one I had to also put /x, otherwise the disk would be locked and no corrections would be made). I tried stressing the machine (with AIDA, or simply running all programs I could at the same time) and there's been no BSODs anymore. But I'm going to do tonight the suggestion you mentioned about disabling the page file. I'm going to disable and run chkdsk, maybe then the sectors can get repaired(?). About the cables, I already checked them, no loose cables – flen Jun 16 '15 at 19:54
0

Superuser tells me this old question still receives a lot of views. I think what ultimately worked for me was running this in a prompt with administrator priviledges: chkdsk /x /b (note the /b argument instead of /r). I think /b is important to remap the bad sectors.

My HDD is still alive and kicking, 4 years later.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.