2
1
Some years ago I had a failing HDD that, in its dying breath, had a cloned image of it installed onto a new HDD. The problem is that the old HDD wasn't working anymore in the end and some data (I think less than 100MB, out of 250GB) was irretrievably lost. Since then, I've had some BSOD, mostly due to random causes (loosened RAM, drivers, etc.), but for some time now I've been having exactly the same problem.
BlueScreenViewer tells me that I have a 0x01a MEMORY_MANAGEMENT crash caused by ntoskrnl.exe . The fist parameter is always 41790, which, according to this https://msdn.microsoft.com/en-us/library/windows/hardware/ff557391%28v=vs.85%29.aspx means that: "A page table page has been corrupted. On a 64 bit version of Windows, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32 bit version of Windows, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs." Indeed, the second parameter is almost always the same.
Here are the most recent crashes: (sorry about the untidiness, I couldn't format it properly)
Dump File Crash Time Bug Check String Bug Check Code Parameter 1 Parameter 2 Parameter 3 Parameter 4 Caused By Driver Caused By Address File Description Product Name Company File Version Processor Crash Address Stack Address 1 Stack Address 2 Stack Address 3 Computer Name Full Path Processors Count Major Version Minor Version Dump File Size Dump File Time
061415-35100-01.dmp 14/06/2015 00:24 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`07a45fd0 00000000`0000ffff 00000000`00000000 dump_ataport.sys dump_ataport.sys+4fb4a40 x64 ntoskrnl.exe+748c0 C:\Windows\Minidump\061415-35100-01.dmp 8 15 7601 302.111 14/06/2015 00:26
061315-38657-01.dmp 13/06/2015 21:28 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`07a5c050 00000000`0000ffff 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+748c0 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.18869 (win7sp1_gdr.150525-0603) x64 ntoskrnl.exe+748c0 C:\Windows\Minidump\061315-38657-01.dmp 8 15 7601 302.047 13/06/2015 21:30
060715-40185-01.dmp 07/06/2015 19:53 MEMORY_MANAGEMENT 0x0000001a 00000000`00041790 fffffa80`07a5cf20 00000000`0000ffff 00000000`00000000 USBSTOR.SYS USBSTOR.SYS+57dfa40 USB Mass Storage Class Driver Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.17577 (win7sp1_gdr.110310-1504) x64 ntoskrnl.exe+72a40 C:\Windows\Minidump\060715-40185-01.dmp 8 15 7601 302.047 07/06/2015 19:55
050915-56113-01.dmp 08/05/2015 23:43 MEMORY_MANAGEMENT 0x0000001a 00000000`00061940 00000000`06e00000 00000000`00000000 00000000`00000000 ntoskrnl.exe ntoskrnl.exe+72a40 NT Kernel & System Microsoft® Windows® Operating System Microsoft Corporation 6.1.7601.18869 (win7sp1_gdr.150525-0603) x64 ntoskrnl.exe+72a40 C:\Windows\Minidump\050915-56113-01.dmp 8 15 7601 302.047 09/05/2015 00:10
I've ran lots of malware scanners, all of them come clean.
When I run sfc /scannow, no integrity violations are found.
But when I run chkdsk /f or /r (which I need to use /x, otherwise no repairs are made, even in reboot) some strange things appear:
1- I always have "4 KB in bad sectors."
2- This is almost constant:"Cleaning up 152[*or a different number, but the next two unused things are the same number] unused index entries from index $SII of file 0x9. Cleaning up 152 unused index entries from index $SDH of file 0x9. Cleaning up 152 unused security descriptors."
I ran some tests on the HDD and it gets a pass. I ran HCI MemTest and the RAM seems to be fine, but when it gets to the page file recorded on the HDD some errors start to appear. Windows Memory Diagnostic also found no problems with my RAM.
So, this got me wondering: could my BSOD be caused by some corrupt files from the old HDD image (like the ntoskrnl.exe)? If so, how can I repair these files? Would it be safe or a good idea to delete ntoskrnl.exe and install it again (assuming I can copy this out of another Windows machine)? And is it possible to build a new MFT file record?
As you can see I'm not very savvy, so thank you very much for any help!
My setup is a Windows 7 Ultimate x64, Core i7, 12GB RAM, Nvidia GeForce GTX260, OS HDD is a WD5000AVCS, plus 4 other HDDs (3 are external USB drives)
PS: I've just updated my GPU driver, but I don't think this will help
PS2: I never did any overclocking and my RAM settings are correct according to the motherboard manufacturer (Intel ran some tests with my RAM Kingstone setup), 2 x 2GB 1333, 2x 4GB 1333
EDIT: one thing I just realised is that I was running a lot of programs at the time of the last crashes... Could it be a conflict problem? I'll try to run some of them at the same time and see if a BSOD happens
windows memory diagnostics are ok for a fully failing memory, but you need to boot off a memdisk86 usb to test the memory hard , and for long times. SFC assumes that your files are ok, which should include the kernel file items. What the raw data shows from a hard drive smart test, would be better information then some software saying it passed. Certain areas of the hard disk are used/abused a Lot more than others, if you used a lot of paging , , , potentially you could change the location of the paging, and lock the size and all which could shift the location, and test more. – Psycogeek – 2015-06-14T08:26:07.837
Paging memory problems could be caused by tiny fails in the ram, written out to paging. Or could be the hard drive getting tiny error including cable issues if you have had errors of this type before. I dont follow error info well (it can lead to looking the wrong places),but you basically know what is suspect, you just need to investigate them closer. (of course it could be 101 other things). Right after boot specific (un-needed) components of the os are paged out in xp and win 7 , probably re-used on the way out only, there is a tweak that can keep these in ram, it would "change" things. – Psycogeek – 2015-06-14T09:09:37.600
Thanks a lot for all the information!!! How can I change the location of the paging? I suspected it was a problem with the paging file because I read somewhere (I tried to find the site now, but no luck...) that when HCI MemTest is running on multiple instances (e.g., 6x 2048MB) and presents errors only in the last one (that uses "All unused RAM"), then it isn't a RAM problem, it's a paging problem, because the HDD is used as memory in this case. All other instances were left running for a day and presented no errors. But you're right, as soon as I finish some work I'll run memdisk86 – flen – 2015-06-14T21:06:21.567
In control pannel "system" Advanced system settings , Advanced Tab , performace settings , Advanced Tab , Virtual Memory , Change button. After making changes you must hit Set, and any change requires a reboot. Putting it on another disk is easy. Causing it to move is very trickey, you first have to disable it , reboot, put files items where it was, then create it again Set, and reboot again. Did i mention trickey :-) Is better to check your cables and hard disk and replace hard disk, IF that was the problem, it wont go away forever anyway until you replace it. – Psycogeek – 2015-06-14T21:17:45.700
Thanks again!:) I've been running chkdsk /r every night since the last BSOD, somehow I think this fixed it (though the 1st one I had to also put /x, otherwise the disk would be locked and no corrections would be made). I tried stressing the machine (with AIDA, or simply running all programs I could at the same time) and there's been no BSODs anymore. But I'm going to do tonight the suggestion you mentioned about disabling the page file. I'm going to disable and run chkdsk, maybe then the sectors can get repaired(?). About the cables, I already checked them, no loose cables – flen – 2015-06-16T19:54:01.747