BSOD Win 7 0x1a MEMORY_MANAGEMENT (ntoskrnl.exe): Could it be a faulty HDD cloned image?

2

Some years ago I had a failing HDD that, in its dying breath, had a cloned image of it installed onto a new HDD. The problem is that the old HDD wasn't working anymore in the end and some data (I think less than 100MB, out of 250GB) was irretrievably lost. Since then, I've had some BSOD, mostly due to random causes (loosened RAM, drivers, etc.), but for some time now I've been having exactly the same problem.

BlueScreenViewer tells me that I have a 0x01a MEMORY_MANAGEMENT crash caused by ntoskrnl.exe . The fist parameter is always 41790, which, according to this https://msdn.microsoft.com/en-us/library/windows/hardware/ff557391%28v=vs.85%29.aspx means that: "A page table page has been corrupted. On a 64 bit version of Windows, parameter 2 contains the address of the PFN for the corrupted page table page. On a 32 bit version of Windows, parameter 2 contains a pointer to the number of used PTEs, and parameter 3 contains the number of used PTEs." Indeed, the second parameter is almost always the same.

Here are the most recent crashes: (sorry about the untidiness, I couldn't format it properly)

Dump File           Crash Time          Bug Check String    Bug Check Code  Parameter 1     Parameter 2         Parameter 3         Parameter 4         Caused By Driver    Caused By Address   File Description        Product Name                Company         File Version                    Processor   Crash Address       Stack Address 1     Stack Address 2     Stack Address 3 Computer Name   Full Path               Processors Count    Major Version   Minor Version   Dump File Size  Dump File Time
061415-35100-01.dmp 14/06/2015 00:24    MEMORY_MANAGEMENT   0x0000001a  00000000`00041790   fffffa80`07a45fd0   00000000`0000ffff   00000000`00000000   dump_ataport.sys    dump_ataport.sys+4fb4a40                                                                                                  x64       ntoskrnl.exe+748c0                                                                          C:\Windows\Minidump\061415-35100-01.dmp 8           15      7601              302.111       14/06/2015 00:26
061315-38657-01.dmp 13/06/2015 21:28    MEMORY_MANAGEMENT   0x0000001a  00000000`00041790   fffffa80`07a5c050   00000000`0000ffff   00000000`00000000   ntoskrnl.exe        ntoskrnl.exe+748c0  NT Kernel & System      Microsoft® Windows® Operating System    Microsoft Corporation   6.1.7601.18869 (win7sp1_gdr.150525-0603)    x64     ntoskrnl.exe+748c0                                          C:\Windows\Minidump\061315-38657-01.dmp 8               15      7601              302.047       13/06/2015 21:30
060715-40185-01.dmp 07/06/2015 19:53    MEMORY_MANAGEMENT   0x0000001a  00000000`00041790   fffffa80`07a5cf20   00000000`0000ffff   00000000`00000000   USBSTOR.SYS         USBSTOR.SYS+57dfa40 USB Mass Storage Class Driver   Microsoft® Windows® Operating System    Microsoft Corporation   6.1.7601.17577 (win7sp1_gdr.110310-1504)    x64     ntoskrnl.exe+72a40                                          C:\Windows\Minidump\060715-40185-01.dmp 8       15      7601              302.047       07/06/2015 19:55
050915-56113-01.dmp 08/05/2015 23:43    MEMORY_MANAGEMENT   0x0000001a  00000000`00061940   00000000`06e00000   00000000`00000000   00000000`00000000   ntoskrnl.exe        ntoskrnl.exe+72a40  NT Kernel & System      Microsoft® Windows® Operating System    Microsoft Corporation   6.1.7601.18869 (win7sp1_gdr.150525-0603)    x64     ntoskrnl.exe+72a40                                              C:\Windows\Minidump\050915-56113-01.dmp 8           15      7601              302.047       09/05/2015 00:10

I've ran lots of malware scanners, all of them come clean.

When I run sfc /scannow, no integrity violations are found.

But when I run chkdsk /f or /r (which I need to use /x, otherwise no repairs are made, even in reboot) some strange things appear:

1- I always have "4 KB in bad sectors."

2- This is almost constant:"Cleaning up 152[*or a different number, but the next two unused things are the same number] unused index entries from index $SII of file 0x9. Cleaning up 152 unused index entries from index $SDH of file 0x9. Cleaning up 152 unused security descriptors."

I ran some tests on the HDD and it gets a pass. I ran HCI MemTest and the RAM seems to be fine, but when it gets to the page file recorded on the HDD some errors start to appear. Windows Memory Diagnostic also found no problems with my RAM.

So, this got me wondering: could my BSOD be caused by some corrupt files from the old HDD image (like the ntoskrnl.exe)? If so, how can I repair these files? Would it be safe or a good idea to delete ntoskrnl.exe and install it again (assuming I can copy this out of another Windows machine)? And is it possible to build a new MFT file record?

As you can see I'm not very savvy, so thank you very much for any help!

My setup is a Windows 7 Ultimate x64, Core i7, 12GB RAM, Nvidia GeForce GTX260, OS HDD is a WD5000AVCS, plus 4 other HDDs (3 are external USB drives)

PS: I've just updated my GPU driver, but I don't think this will help

PS2: I never did any overclocking and my RAM settings are correct according to the motherboard manufacturer (Intel ran some tests with my RAM Kingstone setup), 2 x 2GB 1333, 2x 4GB 1333

EDIT: one thing I just realised is that I was running a lot of programs at the time of the last crashes... Could it be a conflict problem? I'll try to run some of them at the same time and see if a BSOD happens

windows-7
hard-drive
bsod
disk-image
asked on Super User Jun 14, 2015 by flen • edited Jun 14, 2015 by flen

1 Answer

1

Superuser tells me this old question still receives a lot of views. I think what ultimately worked for me was running this in a prompt with administrator priviledges: chkdsk /x /b (note the /b argument instead of /r). I think /b is important to remap the bad sectors.

My HDD is still alive and kicking, 4 years later.

answered on Super User Apr 24, 2018 by flen

User contributions licensed under CC BY-SA 3.0