Question Samsung 980 Pro - - - Health Status dropped to 61% in CrystalDiskInfo in just a few days ?

[tomdid]

Hello to you all

I'm new on the forum so please, don't hesitate to tell me if I'm in the right place to talk about this.
Since the update to Windows 11 Professional 24H2 and an ene.sys issue, my PC seems to be under the weather.

First, I saw the space on C: shrink unexpectedly. I tested adjustments to the pagefile.sys file, removal of hibernation storage, and deactivation of the ene.sys file.
But my PC didn't seem to appreciate these various steps, and I encountered errors when checking via chkdsk:

• Examination of files in the \FOUND.000\ directory (183) revealed a failure.
• Examination of files and directories revealed a failure.
• Examination of the volume bitmap revealed a failure.

I've had problems with simple operations, even though my configuration is rather robust (extreme slowness of explorer, inability to copy/paste, untimely disconnection of USB devices, etc.). I then encountered display errors, and reinstalled After Effetcs and updated to the latest drivers for my GPU.

Still, some errors such as {A24E410DE-8E2B-4EB8-B34A-6B1B878A5047} This application prevents you from rebooting, or even more strange : t (yes, just t) This application prevents you from rebooting...

Then, a few days ago, I had an error as soon as I booted up, forcing me to repair Windows in Safe Mode.
I tested my hard drives with CrystalDiskInfo (as I work with 2 external SSDs almost all the time) and everything was OK (all internal and external SSDs were marked “good” with a minimum of 95%).

Finally, this morning I had a blue screen with an error 0xc0000218.
And when I rebooted, I went to the usual process of chkdsk + sfc /scannow. Right after that, I tested all my SSD with CrystalDiskInfo and saw that my system SSD drive (SAMSUNG 980 Pro PCIe 4.0 Nvme M. 2) Health Status had dropped to 61% (Good)...

I saw this :
05 - Spare cells available 0000000000000064
0C - Number of emergency stops 00000000000003B5 (=949)
E7 - Percentage used 0000000000000025 (=37%)
0E - Media / data integrity errors 0000000000000004
0F - Error log entries 000000000000002C (=44)

Which doesn't seem too good (I like understatements).

So I guess I have to be very careful with my SSD and will probably have to replace it as soon as possible.
But before going any further, I'd like to hear what the experts have to say about these phenomena. I understand that 24H2 has been fairly criticized for problems with SSDs, drivers and USB ports, and I'm thinking of redoing a clean installation by installing 23H2.

What do you think? Thank you in advance for any ideas or suggestions. I'm starting to freak out because I've got productions in progress and I'd like to avoid making any mistakes.

 

[USAFRet]

Ow and I was thinking : of course I need a clean install to avoid re-creating the same scenario for my new SSD.

But if the issue I had is only because I did not update my SSD's firmware for at least 2 years, would you say it is reasonable to clone my actual system to the new SSD? Now I'm writing it, I'm really not sure what would be safer 😅

The data on the drive has nothing to do with the firmware or health status.

 

[evermorex76]

But if the issue I had is only because I did not update my SSD's firmware for at least 2 years, would you say it is reasonable to clone my actual system to the new SSD? Now I'm writing it, I'm really not sure what would be safer 😅

It depends on whether the issue actually caused any corruption in the Windows files. Update the firmware, run sfc again, and it SHOULD be no problem to just use it as is and clone it to the new drive when you're ready. For myself I'd call it like 90% sure to be okay, and if it was a client machine I'd do that before billing them for the time to rebuild an OS and apps. (Install the new drive in a secondary slot if you have one, mainboard was never mentioned, and update the firmware on it before you do anything else with it.) Run chkdsk /f as well, but there's really no way to guarantee that absolutely nothing got corrupted since you can't verify every OS and application file, nor any of your data files that reside on that drive. Reinstalling the OS and anything that's on it would ensure that's all totally clean but it's also a pain in the butt. If anything in the OS or apps was damaged, you'll probably know because something will crash again, rather than it causing anything like silent corruption of your production files that you only find after spending weeks working on a project.

 

[tomdid]

It depends on whether the issue actually caused any corruption in the Windows files. Update the firmware, run sfc again, and it SHOULD be no problem to just use it as is and clone it to the new drive when you're ready. For myself I'd call it like 90% sure to be okay, and if it was a client machine I'd do that before billing them for the time to rebuild an OS and apps. (Install the new drive in a secondary slot if you have one, mainboard was never mentioned, and update the firmware on it before you do anything else with it.) Run chkdsk /f as well, but there's really no way to guarantee that absolutely nothing got corrupted since you can't verify every OS and application file, nor any of your data files that reside on that drive. Reinstalling the OS and anything that's on it would ensure that's all totally clean but it's also a pain in the butt. If anything in the OS or apps was damaged, you'll probably know because something will crash again, rather than it causing anything like silent corruption of your production files that you only find after spending weeks working on a project.

Thanks again for the good advices 😉
I would never bill my clients for the time I'd spend to rebuild my OS ; I will do it on my personal time.

But the option of cloning after testing the Windows files seems right to me, even if the 10% risk you mention will probably haunt some of my nights 😉

You're absolutely right on that point too, I forgot to put my config (yes, I have a 2nd NVMe slot even if it's not PCIe 4.0) :

OS :
Windows 11 Professional 24H2 26100.4061

HARDWARE (built at the end of 2022) :
Case : FRACTAL Meshify 2
Power Supply : CORSAIR - RMx Series RM850x - 850W - 80 Plus Gold
Motherboard : MSI Mag B550 Tomahawk
CPU : AMD - Ryzen 9 5950X - 3,4/4,9 GHz - 16 core/32 threads - Socket AM4 - 105W
AIO : ARTIC COOLING - ARCTIC Liquid Freezer II 360 - Watercooling Kit 360mm
Watercooling AIO CPU - Intel Sockets compatible: LGA 2066/2011-V3/115X/1200 and AMD AM4 - Fans: 3x120mm + 1x40mm
GPU : MSI - GeForce RTX 3060 Ti VENTUS 2X 8G OCV1 LHR - 8 Go GDDR6 - HDMI/Tri DisplayPort - PCI Express (NVIDIA GeForce RTX 3060 Ti)
RAM : KINGSTON FURY Renegade 3600MT/s 4x16Go
SSD 1 : SAMSUNG 980 Pro PCIe 4.0 Nvme M. 2 1Tb
SSD 2 : WD SN570 NVMe 1Tb
SSD 3 : Crucial MX500 2Tb
SSD 4 : Crucial MX500 1Tb
SSD 5 : Crucial MX500 1Tb
SSD 6 : Crucial MX500 2Tb

 

[evermorex76]

I would never bill my clients for the time I'd spend to rebuild my OS ; I will do it on my personal time.

Oh no, I meant when I was working as outsourced IT support, if working on a client's machine that had this issue I'd try the easy way first and just clone the drive after fixing the firmware and checking the filesystem and using sfc, if I did think it ought to be replaced for confidence (like it was down to sub-50% health), and only spend the billable time completely rebuilding the OS and apps if the system exhibited signs of the cloned OS having been corrupted. If it was still at 61% on a client machine or a family machine I'd probably let it run that way since that's not really bad and we know there wasn't actually a defect in the flash, knowing that it really was just a firmware glitch. Maybe just schedule a check on it a month or two later to ensure the health was still looking good.

 

[tomdid]

Oh no, I meant when I was working as outsourced IT support, if working on a client's machine that had this issue I'd try the easy way first and just clone the drive after fixing the firmware and checking the filesystem and using sfc, if I did think it ought to be replaced for confidence (like it was down to sub-50% health), and only spend the billable time completely rebuilding the OS and apps if the system exhibited signs of the cloned OS having been corrupted. If it was still at 61% on a client machine or a family machine I'd probably let it run that way since that's not really bad and we know there wasn't actually a defect in the flash, knowing that it really was just a firmware glitch. Maybe just schedule a check on it a month or two later to ensure the health was still looking good.

Oh sorry, I get it now
It seems to me to be a very rigorous method; I try to be too, but my knowledge is limited to the use of certain software.

For my part, this morning I had a BSOD with error 0xc0000218.
Searching for the MEMORY.DMP file, I found several hidden files here:
C: Windows:
1b5cf1b1tmyqh4i
1b5cf1s1tmyqh4i
1b5cf1w5btrcsvr
1b5cf2jcbtrcsvr
1b5cf8t1tmyqh4i
1b5cfslstmyqh4i
...
2a8ffyrpxxn5e1f
5w8ff2askdisjmi
5w8ff2b4q8ufv8m
...
7uvvf1cpp7vneok
...
8tnaf1g2s1a1ady
all dated 2004...
I thought of a rootkit or malware, but virustotal returned no positive results, and Windows Defender offline analysis found nothing.
I'm gradually resigning myself to preparing a clean reinstallation of Windows 24H2, but I don't know what these files are... Are they by any chance also present on your system disk?

 

[fzabkar]

Examine the files with a hex editor.

https://mh-nexus.de/en/hxd/ (freeware)

 

[tomdid]

Examine the files with a hex editor.

https://mh-nexus.de/en/hxd/ (freeware)

Thanks a lot!I opened it with Sublime Text and I saw this :
6400 0100 0000 6c84 ddbc eb64 055f 5367
0000 0000 7851 0000 0000 b66e

I asked Chat GPT and Perplexity to analyze it : they both indicate there seems to be no trace of threats.
Would I see anything different with the one you mentioned or is it the same thing?

I'm starting to feel a little better but I'm probably going to make some more tests with ProcMon.

In the meantime, if anyone has seen such files in C: WIndows, I'd be happy to know

 

[fzabkar]

I have no idea what those hex values mean. My understanding is that Sublime Text is a text editor, so it would not be the most useful tool in this case.

 

[shaester_123]

Oww 🙁

That's what I thought... But I didn't find anything with Windows Defender, AdwCleaner, ESET, nor Malwarebytes.

Would you have any suggestion to help me please ?

Anti-Virus programs don't work . They always miss the biggest one - Windows itself .

On a serious note : Most anti-Virus programs won't find active viruses on your system . Fact .

 

[tomdid]

Anti-Virus programs don't work . They always miss the biggest one - Windows itself .

On a serious note : Most anti-Virus programs won't find active viruses on your system . Fact .

Well I guess there's no solution then

Virustotal looks like a nice solution to me, but it didn't find anything either.
And neither Chat GPT nor Perplexity have found anything suspicious in the numbers posted :
6400 0100 0000 6c84 ddbc eb64 055f 5367
0000 0000 7851 0000 0000 b66e

I tried my best to find the process that was launching and creating the mystery files and folders but I can't go further because I had 3 BSOD in the last 2 weeks and I have to move on.

Initially, I was asking about my SSD dying but it looks like there could me many reasons why it's happening.
So now, I'm ready to install a new SSD and reinstall Windows for the next days (because I have tons of apps and plugins..).

Please, don't hesitate to tell me if you have any other idea 😉

Tom

 

[shaester_123]

Well I guess there's no solution then

Virustotal looks like a nice solution to me, but it didn't find anything either.
And neither Chat GPT nor Perplexity have found anything suspicious in the numbers posted :
6400 0100 0000 6c84 ddbc eb64 055f 5367
0000 0000 7851 0000 0000 b66e

I tried my best to find the process that was launching and creating the mystery files and folders but I can't go further because I had 3 BSOD in the last 2 weeks and I have to move on.

Initially, I was asking about my SSD dying but it looks like there could me many reasons why it's happening.
So now, I'm ready to install a new SSD and reinstall Windows for the next days (because I have tons of apps and plugins..).

Please, don't hesitate to tell me if you have any other idea 😉

Tom

You don't understand what I am talking about good sir . I'm not going too pretend like I do though . Watch this video by one of my favorite YouTubers and you will get why you are FUNDAMENTALLY, thinking about it wrong .

View: https://m.youtube.com/watch?v=G4lyxl0nm60

View: https://m.youtube.com/watch?v=jBIcu3jgpMo

 

[evermorex76]

Please, nobody egg this one on.