Blues Screen and sysaudio driver

Usually, but not always, on booting, I have been getting increasingly frequent Blue Screen crashes on my XP Professional. The issue is quite interesting, and seems to relate to the driver sysaudio.sys

The Stop messages are as follows:

STOP: 0x0000007E (0xC0000005, 0xF11CEF33, 0xF7A65968, 0xF7A65664)

sysaudio.sys – Address F11CEF33 base at F11C6000, DateStamp 41107f1a

Error Signature
BCCode: 1000007e BCP1: C0000005 BCP2: F11CEF33 BCP3: F7A65968
BCP4: F7A65664 OSver: 5_1_2600 SP: 2_0 Product: 256_1


I’m fairly experienced, so yesterday I did the following:

I used System File Checker to ensure I had all correct Windows files.
I looked for, and failed to find, sysaudio.sys as a MS download. It seems to be part of System Audio WDM Filter – (which I don’t understand)

I searched for all occurences of sysaudio.sys on Drive C: and found three identical instances in the following directories:

C:\i386
C:\windows\system32\dllcache
C:\windows\system32\drivers

(There is no such file seen in the Task Manager, and it isn’t referenced in msconfig)

I renamed each of these as old_sysaudio.sys so as to remove them from the equation (or so I thought). On re-boot everything seemed normal (including my computer sound, for which I use a Gina Digital Sound Card).

The today I got another Blue screen with almost identical stop messages. On re-checking for sysaudio.sys I found it had been re-instated in both \system32 folders, and had a date-time stamp which co-incided with when I switched off the computer yesterday. (Where did they come from . . .?)

I ran PitStop full test, which seemed to tell me my computer was in very good health. Test result available at:
http://www.pcpitstop.com/techexpress.asp?id=DDSPSW8M13GSRF0G

I’d be grateful for any help.

Many thanks

Philip

Hi Phillip,

I suggest you google those error messages as you say you are experienced with your system.

Also to discover the type of Errors the machine has encountered recently, use Event Viewer.

• Go to Start - Run, type eventvwr.msc, then Press Enter.
• When the Event Viewer opens, there will be two panes.
• The left pane is for event categories (Application, Security, and System).
• The right pane is for event messages (Information, Warning, and Error).We want to find errors.
• Left-click the Application category in the left pane and check for any error messages in the rightpane.
• You want to find the one(s) that occurred at the same time your system encountered the problem you have posted about.
• Repeat the previous step for each category, or until you find an appropriate error to investigate.
• Double-click the error message to bring up the information.
• Click the third button on the right side of the information window (copies information)
  Paste the information here.

I read you PCPitstop test and I would advise you to follow all the Customized Tune Up Tips by clicking on each and following the advice given. Do not Update Device Drivers, unless you are having driver problems.

You are showing in your software installations, 5 out of date Java Runtime installations, so please go to Add and Remove and uninstall them and download and install the latest Java version 6 update 4.

Run this link to update your Java, and also to see if all your software is up to date, and not vulnerable.
Here is another link that may help you with software updates.

You are running both Windows Media Player 11 and RealPlayer, do you need them both? Real is a resouce hogger, so if you don't use it, I suggest you uninstall.

If you do not use the Speech Option in start > settings >control panel > Regional and Language > language tab > details > put a tick in advanced text services > apply > okay. This is mostly an unnecessary startup item that is not needed.

Have you done a chkdsk scan?

Please post back and let us know how you are progressing.

kind regards,

Hi Tallin You've introduced me to a whole new world - the Event Viewer. I've had a brief play around with that and its filters, and - as I'd kept a narrative log of some of my Blue Screens - I'm pretty sure I'll be able to match up various error events with the day they happened. (What I actually do when I have time is digitally photograph my blue screens, then when I'm back in business copy them into a special folder: this is particularly satisfying, as I feel like a triumphant parent forcing my child to eat the dinner I'd cooked and it didn't like) I'd already done most of the PitStop advice - but will complete before I proceed. You're brilliant (so far…) Thanks Philip

Thanks for the feedback.

Post back with further results please when they are to hand.

Re your Java Update, after you have uninstalled all the out of date from Add and Remove. HERE is the very latest released this morning my time for you to install. (first one on the list)

kind regards,

ChkDsk was interesting - I was well versed in that from DOS days, and thought it didn't work in XP. After playing around with it, finally got it to run silently on a re-boot - so I couldn't trap the progress messages. However, I suspect it fixed some errors in MBT and Volume BitMap.

I think I've identified the error events associated with my blue screen - certainly two that co-incide with dates and approx times that I'd recorded. Here is extract of all data that I think is relevant:

Events Log – selected events

04 March 2008

11.17am Information Event:
The computer has rebooted from a bugcheck. The bugcheck was: 0x1000007e (0xc0000005, 0xf118ef33, 0xf7a31968, 0xf7a31664).
A dump was saved in: C:\WINDOWS\Minidump\Mini030408-01.dmp.


11.19am Error Event
Error code 1000007e, parameter1 c0000005, parameter2 f118ef33, parameter3 f7a31968, parameter4 f7a31664.



Details from Microsoft Link:

Product Windows Operating System
ID: 1003
Source System Error
Version 5.2
Symbolic Name ER_KRNLCRASH_LOG
Message Error code %1, parameter1 %2,
parameter2 %3, parameter3 %4,
parameter4 %5.

   
Explanation
A blue screen (Stop error) was reported. The message contains details about the error. A matching event with Event ID 1001 might also appear in the event log. This matching event displays information about the specific error that occurred.
   
User Action
No user action is required.




03 March 2008

11.25 am Information Event
The computer has rebooted from a bugcheck. The bugcheck was: 0x1000007e (0xc0000005, 0xf078df33, 0xf7a25968, 0xf7a25664).
A dump was saved in: C:\WINDOWS\Minidump\Mini030308-01.dmp.


11.26 Error Event

Error code 1000007e, parameter1 c0000005, parameter2 f078df33, parameter3 f7a25968, parameter4 f7a25664.


Details from Microsoft Link:

Product Windows Operating System
ID: 1003
Source System Error
Version 5.2
Symbolic Name ER_KRNLCRASH_LOG
Message Error code %1, parameter1 %2,
parameter2 %3, parameter3 %4,
parameter4 %5.

   
Explanation
A blue screen (Stop error) was reported. The message contains details about the error. A matching event with Event ID 1001 might also appear in the event log. This matching event displays information about the specific error that occurred.
   
User Action
No user action is required.


I wonder if this gives the information you need.

Thanks for your continued advice

Philip

Hi docramage

As Sysaudio.sys is obviously a system file, it may be repaired / replaced with the SFC command

Some malware have been known to hide in the sysaudio.sys file….. just for considerations.

A system-restore may be an solution. To bring the PC back where the problem wasn't there.

Regards Abydos

Abydos Thanks - but I had already done that. And all three copies of the file on my system all had exactly the same length and certificates from Microsoft - and I scanned them all with AVG and AVG Spyware. I know that's not all totally foolproof, and of course I may yet discover a rat in the system. Thanks for your interest. Philip

Roxio is a common cause of Stop7e errors, and does tie into the audio - you might try removing Roxio.

I would also test your RAM - you can do this by removing all but one stick and trying the PC out, then swap in stick and through process of elimination, see if any are bad.

You can test also your RAM using one of the following programs. Both require you to create and boot to a bootable floppy disk or CD to run the diagnostics. Using the floppy method is generally easier and yet another reason I still include floppy drives in all my new PC builds. However, the CD method is just as effective at detecting RAM problems. Allow the diagnostics to run for several passes or even overnight. You should have no reported errors.

Windows Memory Diagnostic - see the easy to follow instructions under Quick Start Information.
or
MemTest86+ (for more advanced users) - an excellent how-to guide is available here.

oops sorry Digerati, we posted about the same time. Greetings docramage What kind of sound card are you using? On board? Separate card? There are a handful of possibilities for the error you are gettings. Have a look in device manager and see if there are any exclamation marks or Red X in the Sound-Video-Game controlers. A possible fix is to download and reinstall the latest audio drivers for your computer. How is your hard drive space? Do you have a full up disk? It is not out of the realm of possibilities that you have a bad stick of RAM. These Ram errors may be constant, or intermittant in nature. Do you have any utilities to test your Ram? Memtest86 is popular, if you can burn a ISO file here is a link to it —->http://www.memtest86.com/ It is a bootable image and you start your computer with it. Give this a go and see how you do Regards Kaz

Kazzoo and Digerati Thanks for your ideas. I don't have Roxio on-board, and have plenty of free disc space (3 x 160Gb). My sound card is a Gina 3g digital card in PCI with outboard hardware interface. It doesn't use the sysaudio driver - which is from Microsoft. My suspicion is that sysaudio itself is taking the blame for something else . . . No driver problems nor IRQ conflicts on all my tests Have done the Memtest86 and passed - but will repeat it for a few hours just to see if I can annoy Dell or Intel. An interesting program - using Linnux. It was all so much easier with my Apple ][, 64k memory and 140k floppies. No blue screens then, but it did catch fire a few times. Regards, Philip

I didn't express myself very sensibly on my first post: when I said "Usually, but not always, on booting, I have been getting increasingly frequent Blue Screen crashes"

What I really meant to say was:

Perhaps a few times per week I get the same old Blue Screen error - and these are usually on booting.

Just so you know I'm not plagued by the issue - just irritated.

Thanks


Philip

Greetings docramage Just got a signal from outerspace and from underneath my tin foil hat I have another idea. Your comment about it has been increasing over time has me thinking about how much dust or debris there maybe collecting inside the computer. Cant tell you why or how I am thinking this, but I do know you can get crazy errors because of it. (Darn alien messages always in riddles) Besides it cant hurt to clean out the computer and eliminate it as a factor. Compressed air would be the tool of choice. Regards Kaz.

Hi, – The reason your getting the conflict is relatively simple, the driver your using for your sound card was designed for pre XP. Windows uses the sysaudio.sys file to integrate the card manufacturers driver with the kernel. (To prove this you can rename the registry keys that load this file and in the device manager will be a comment telling you that the system sound kernel driver needs changed). As XP uses a different sysaudio.sys file, all you have to do is replace the sysaudio file with an old windows 98 sysaudio.sys file in windows\system32\drivers. you can get an old Microsoft manufactured sysaudio.sys file from driverguide.com, make sure and take the microsoft manufactured file as the ones manufactured by the card manufactures rarely work. Eddie Crozier