Resolved System Error - Event ID 1003 Category (102)

My computer keeps restart randomly over past 2 weeks.

With the help of the BlueScreenView v1.28, below is one of the scan results that I think best describe my problem.

==================================================
Dump File : Mini101610-02.dmp
Crash Time : 16/10/2010 8:43:56 PM
Bug Check String : BAD_POOL_CALLER
Bug Check Code : 0x000000c2
Parameter 1 : 0x00000007
Parameter 2 : 0x00000cd4
Parameter 3 : 0xe2428000
Parameter 4 : 0xe3437008
Caused By Driver : sysaudio.sys
Caused By Address : sysaudio.sys+3bd
File Description : System Audio WDM Filter
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2108)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini101610-02.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

How does such crash trigger? Is it a hardware-ralated problem or software-related problem?

 

This appears to be due to a driver problem.

Click 'start' and then 'run' type sfc /scannow (note the gap between c /) into the box and press Enter on your keyboard. This will replace any damaged files and may ask you to insert the windows xp disc. Keep an eye on it to see if it finds any problems.

 

Arie, the sysaudio.sys is located at C:\Windows\System32\drivers. I think it is in the right path. Thanks for telling whether I also got other copies of "sysaudio.sys" in other paths that might be a malware.

markmadras, thanks for telling me the remedy of windows corruppted files. I have tried to run the command, and the system asks me to insert the required CD. Does it mean some of the windows system are corrupted?

 

I confirmed this on my Win XP installation and that is the right place. Did you find other copies of the file?

Yes, a large number of files are kept on the system but not all of them, so if the scan is asking for the disc there will be some corrupted files that need replacement.

I guess you don't have the XP disc. Can you borrow one, it has to be the same version of XP as the one you have installed to work correctly.

 

As this error may have been caused by an infection, I would advise you to download Microsoft Security Essentials which is free software. Install it and let it update, then do a full scan on your hard drive, if there is anything nasty in there it should find it.

http://www.microsoft.com/security_essentials/support.aspx?mkt=en-us

 

markmadras, I got a xp sp3 CD and I just replaced those windows system file last 2 days. Last night I can't launch the media player 11, and I re-install it and it is fine now.

I am sure there is no other sysaudio.sys besides the C:\WINDOWS\ServicePackFiles\i386 folder (the source) and the C:\Windows\System32\drivers folder.

I got an AV software - bitdefender internet security 2008 to safeguard the PC, and it seems like it is functional and not finding any malware so far. May be I will switch to Microsoft Security Essentials once my current AV is expired.

Meanwhile, I am still observing whether the Blue Screen will return within a week or two, as I am concerned whether is there any possible causes of hardware devices failures.

 

Replacement of those files may be all that was needed, fingers crossed.

The MSE is free (for ever) so downloading and scanning with it might be worthwhile. No AV is 100% but MSE found a virus on my own PC that two other scanners didn't.

 

BSOD again!

I re-formated and re-install the windows xp home again. Below shows new errors for the pass few days.

==================================================
Dump File : Mini102610-02.dmp
Crash Time : 10/26/2010 2:17:41 PM
Bug Check String : CRITICAL_OBJECT_TERMINATION
Bug Check Code : 0x000000f4
Parameter 1 : 0x00000003
Parameter 2 : 0x8aa845d0
Parameter 3 : 0x8aa84744
Parameter 4 : 0x8060577e
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+606ba
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5973 (xpsp_sp3_gdr.100427-1636)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini102610-02.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

Other Details:
==================================================
Filename : atapi.sys
Address In Stack : atapi.sys+63a8
From Address : 0xf74c0000
To Address : 0xf74d7900
Size : 0x00017900
Time Stamp : 0x4802539d
Time String : 4/14/2008 2:40:29 AM
Product Name : Microsoft® Windows® Operating System
File Description : IDE/ATAPI Port Driver
File Version : 5.1.2600.5512 (xpsp.080413-2108)
Company : Microsoft Corporation
Full Path : C:\WINDOWS\system32\drivers\atapi.sys
==================================================

==================================================
Filename : ntoskrnl.exe
Address In Stack : ntoskrnl.exe+606ba
From Address : 0x804d7000
To Address : 0x8073e000
Size : 0x00267000
Time Stamp : 0x4bd6eda6
Time String : 4/27/2010 9:59:02 PM
Product Name : Microsoft® Windows® Operating System
File Description : NT Kernel & System
File Version : 5.1.2600.5973 (xpsp_sp3_gdr.100427-1636)
Company : Microsoft Corporation
Full Path : C:\WINDOWS\system32\ntoskrnl.exe
==================================================

Other Dump Files:
==================================================
Dump File : Mini102610-01.dmp
Crash Time : 10/26/2010 2:12:55 PM
Bug Check String : PFN_LIST_CORRUPT
Bug Check Code : 0x0000004e
Parameter 1 : 0x00000099
Parameter 2 : 0x0007d2da
Parameter 3 : 0x00000000
Parameter 4 : 0x00000000
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+606ba
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5973 (xpsp_sp3_gdr.100427-1636)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini102610-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

I wonder what is going wrong? Device drivers crash or hardware failure? Could it be the DVD drive?

 

This could be driver or memory related.

Did you reinstall all your drivers after the clean install of windows, including the motherboard chipset, are there any devices showing a yellow triangle in Device Manager.

Pull out your memory sticks and clean the contacts with a pencil eraser then replace them.

You can download this free diagnostic tool to test your memory.

http://www.memtest.org/

 

Thanks for all the advices.

I can see the proposed actions is to check the (i)drivers, (ii)memory sticks and (iii)harddisk.

As for (i), I have checked the device manager and it shows no yellow triangle or any errors with regards to the device drivers.

As for (ii), I have tested with MemTest 4.0 in windows safe mode and it doesn't show any errors. May be I should tried to boot up from the CD and run the memory test later.

Using pencil eraser to rub the memory stick and replace them? Markmadras, do you mean to swap the memory sticks to difference memory banks?

As for (iii), Arie, where can I get the disk diagnostics tool for WD SATA Harddisk?

Hmmm.....

Before I go any further, here comes the most recent error that I am not so sure whether it is relevent to the main problem.

Please advise.

==================================================
Dump File : Mini102610-04.dmp
Crash Time : 10/26/2010 10:49:44 PM
Bug Check String : BAD_POOL_HEADER
Bug Check Code : 0x00000019
Parameter 1 : 0x00000020
Parameter 2 : 0xe2ea8570
Parameter 3 : 0xe2ea8580
Parameter 4 : 0x1c020401
Caused By Driver : ntoskrnl.exe
Caused By Address : ntoskrnl.exe+606ba
File Description : NT Kernel & System
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5973 (xpsp_sp3_gdr.100427-1636)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini102610-04.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

Details:
==================================================
Filename : ntoskrnl.exe
Address In Stack : ntoskrnl.exe+bef8
From Address : 0x804d7000
To Address : 0x8073e000
Size : 0x00267000
Time Stamp : 0x4bd6eda6
Time String : 4/27/2010 9:59:02 PM
Product Name : Microsoft® Windows® Operating System
File Description : NT Kernel & System
File Version : 5.1.2600.5973 (xpsp_sp3_gdr.100427-1636)
Company : Microsoft Corporation
Full Path : C:\WINDOWS\system32\ntoskrnl.exe
==================================================

 

http://www.memtest.org/ This is one of the most advanced mem tests which will run from a floppy or CD.

From your device manager it may appear that all drivers are installed but did you reinstall the motherboard chipset drivers?

My suggestion with the memory sticks was to be quite sure they have a good contact, there is no need at present to swap them around.

The disk diagnostics are from the Western Digital (WD) link that Arie listed above.

It may help if you can fill in your system specs in your user profile so we can see what you have in your PC.

This most recent dump file is again most likely to be driver related but could be memory or hard drive errors.

Run all the tests you can.

 

I haved rubbed the memory sticks and put them back to the motherboard.
Below shows the latest BSOD

==================================================
Dump File : Mini102710-01.dmp
Crash Time : 10/27/2010 12:38:39 PM
Bug Check String : NTFS_FILE_SYSTEM
Bug Check Code : 0x00000024
Parameter 1 : 0x001902fe
Parameter 2 : 0xb331d570
Parameter 3 : 0xb331d26c
Parameter 4 : 0xf7b7a647
Caused By Driver : Ntfs.sys
Caused By Address : Ntfs.sys+28647
File Description : NT File System Driver
Product Name : Microsoft® Windows® Operating System
Company : Microsoft Corporation
File Version : 5.1.2600.5512 (xpsp.080413-2111)
Processor : 32-bit
Computer Name :
Full Path : C:\WINDOWS\Minidump\Mini102710-01.dmp
Processors Count : 2
Major Version : 15
Minor Version : 2600
==================================================

Details:
==================================================
Filename : Ntfs.sys
Address In Stack : Ntfs.sys+28647
From Address : 0xf7b52000
To Address : 0xf7bde600
Size : 0x0008c600
Time Stamp : 0x48025be5
Time String : 4/14/2008 3:15:49 AM
Product Name : Microsoft® Windows® Operating System
File Description : NT File System Driver
File Version : 5.1.2600.5512 (xpsp.080413-2111)
Company : Microsoft Corporation
Full Path : C:\WINDOWS\system32\drivers\Ntfs.sys
==================================================
==================================================
Filename : ntoskrnl.exe
Address In Stack : ntoskrnl.exe+95260
From Address : 0x804d7000
To Address : 0x8073e000
Size : 0x00267000
Time Stamp : 0x4bd6eda6
Time String : 4/27/2010 9:59:02 PM
Product Name : Microsoft® Windows® Operating System
File Description : NT Kernel & System
File Version : 5.1.2600.5973 (xpsp_sp3_gdr.100427-1636)
Company : Microsoft Corporation
Full Path : C:\WINDOWS\system32\ntoskrnl.exe
==================================================

Why the errors related to the NTFS.sys?

 

My system details

===========================================================
Motherboard:
American Megatrends Inc. ver 080013 662/1066T-M2
Processors:
1 Physical Processors / 2 Cores / 2 Logical Processors / 64 bits
Memory:
DIMM0 Synchronous SDRAM 2048 MBytes DIMM1 Synchronous SDRAM 1024 MBytes
Video Card:
SiS Mirage Graphics 64 MBytes
Hard Disk:
80.0 GB WDC WD800JD-22MSA1
Optical Drive:
DVD Writer 0 TSSTcorp CDDVDW SH-S223C
Power Supply Unit:
Power Logic ATRIX 500T 230V/5A/50Hz Max DC Output 500watts
Audio Card:
Realtek AC'97 Audio Realtek
Monitor:
ViewSonic VA1912wb
Operating System:
Windows XP Personal Service Pack 3
=========================================================

 

Thanks for the system details but that should have gone in your user profile for easier reference. Please include the PC's manufacturer, name and model number.

The last mini dump as before is more than likely a driver issue.

I have asked before, but did you reinstall the motherboard chip set drivers?

Is there any device in Device Manager that is showing a yellow triangle?

You need to start running the tests as suggested previously.

This would be a good test to see what is happening on your hard drive. This should repair any file system error and will indicate if there are any bad sectors on the drives surface.

Let us know what happens.

 

I know that is also a possible cause. Most results I found pointed to file corruption but obviously this could be caused by a faulty hard drive. As system errors are being reported so soon after the OS was reinstalled it does seem quite likley that the hard drive is the problem, this is why I have suggested the use of CHKDSK as a quick way to evaluate the condition of the file system and the drive surface.