Session "Microsoft Security Essentials OOBE" stopped due to the following error: 0xC000000D using win 7 64bit over and over BSOD
-
Tuesday, June 08, 2010 5:23 PM
Session "Microsoft Security Essentials OOBE" stopped due to the following error: 0xC000000D using win 7 64bit over and over BSOD
My event viewer has been coughing the error line above. It has lead to the feeling of a Carotid Artery leak of memory where my whole
system slowly stops working till BSOD. Windows Explorer just stops working then Death.
I HAVE HAD THIS HAPPEN MORE AND MORE, AND IT APPEARS TO BE A PROGRAM PROBLEM, ANYBODY ELSE HAVE THIS.
IT HAS COST ME 2 DAYS WORK NOW.
MIKE
All Replies
-
Wednesday, June 09, 2010 5:06 AMModerator
Hi,
When does the issue begin to occur?
Since Windows system uses separated user mode and kernel mode memory space, stop errors are usually caused by kernel portion components, such as a hardware device, third-party drivers, backup software or anti-virus services (buggy services).
Please refer to the following steps to troubleshoot the issue.
1. Boot the computer in Clean Boot for a test.
2. Temporarily disable all unnecessary hardware devices in Device Manager, such as Modem, sound card or external device.
For detail steps, we can refer to the link below:
3. Upgrade the virus definition, run antivirus program and perform a full scanning.
If the issue persists, please upload the minidump file (%systemroot%\minidump) to SkyDrive ( www.skydrive.live.com ), then share the link to me. I will be glad to assist you to analysis the data.
Thanks,
Novak
- Marked As Answer by Novak WuModerator Monday, June 21, 2010 1:36 AM
-
Wednesday, June 16, 2010 6:26 AM
I'm having the exact problem as the original poster. If you wouldn't mind analyzing my dump file I would really love to know what's causing my daily BSOD on my Win 7 64 bit os. The link is: http://cid-f264f5759e0fb183.office.live.com/browse.aspx/.Public
Thanks,
Bruce
-
Tuesday, June 22, 2010 7:59 AM
I'm having the exact problem as the original poster. If you wouldn't mind analyzing my dump file I would really love to know what's causing my daily BSOD on my Win 7 64 bit os. The link is: http://cid-f264f5759e0fb183.office.live.com/browse.aspx/.Public
Thanks,
Bruce
Hey Bruce,Looking at your minidump, the faulty module is probably NETw5s64.sys which searching up shows all kinds of nasty BSODs.
http://www.google.com/search?q=NETw5s64.sys
Mike, can you provide a minidump?
-
Monday, August 22, 2011 1:59 PM
I am getting the same sets of problems, but I can never find the minidump program. I look in the windows/minidump folder, but that directory is not there and no .dmp files exists on the computer. But I am getting BSODs. I really want to track the culprit. Hard drive, memory scan, and checkdisks all come out fine.
Log Name: Microsoft-Windows-Kernel-EventTracing/Admin
Source: Microsoft-Windows-Kernel-EventTracing
Date: 8/22/2011 3:17:43 AM
Event ID: 3
Task Category: Session
Level: Error
Keywords: Session
User: SYSTEM
Computer: XavierMorganPC
Description:
Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
<EventID>3</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>14</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime="2011-08-22T08:17:43.736814500Z" />
<EventRecordID>34</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="200" />
<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
<Computer>XavierMorganPC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SessionName">Microsoft Security Client OOBE</Data>
<Data Name="FileName">C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl</Data>
<Data Name="ErrorCode">3221225485</Data>
<Data Name="LoggingMode">5</Data>
</EventData>
</Event> -
Monday, September 12, 2011 4:44 AM
I'm having the exact problem as the original poster. If you wouldn't mind analyzing my dump file I would really love to know what's causing my BSOD on my Win 7 64 bit os. The link is:
https://skydrive.live.com/?cid=d1aecb809a5fb11b&sc=documents&id=D1AECB809A5FB11B%21227#
Thanks very much
-
Monday, September 12, 2011 7:20 AM
I also have runned into this problem:
-----------------------------
Loggnamn: Microsoft-Windows-Kernel-EventTracing/Admin
Källa: Microsoft-Windows-Kernel-EventTracing
Datum: 2011-09-12 08:42:23
Händelse-ID: 3
Aktivitetskategori:Session
Nivå: Fel
Nyckelord: Session
Användare: SYSTEM
Dator: Tomas-PC
Beskrivning:
Sessionen "Microsoft Security Client OOBE" stoppade på grund av följande fel: 0xC000000D
Händelsens XML-data:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
<EventID>3</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>2</Task>
<Opcode>14</Opcode>
<Keywords>0x8000000000000010</Keywords>
<TimeCreated SystemTime="2011-09-12T06:42:23.128030900Z" />
<EventRecordID>10</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="200" />
<Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
<Computer>Tomas-PC</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="SessionName">Microsoft Security Client OOBE</Data>
<Data Name="FileName">C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl</Data>
<Data Name="ErrorCode">3221225485</Data>
<Data Name="LoggingMode">5</Data>
</EventData>
</Event>--------------------------------------------
Thanks
Tomas
By helping others I help myself -
Thursday, September 15, 2011 3:38 AM
Nudge,,,
Can someone look at my .dmp file?
-
Monday, September 19, 2011 4:18 AMI'm having the same issue and have tried several fixes that were suggested (uninstalled wireless card, deleted specific files popping up in my error logs) however when I tried to install the debugging tools to check my actual dump files I'd immediately BSOD. Could you look at them and help me out on this issue?
Thanks,
JeC
https://skydrive.live.com/redir.aspx?cid=22faf5298e2b217e&resid=22FAF5298E2B217E!158&authkey=5HdQPfEIYPc%24 -
Thursday, September 22, 2011 12:18 AM
please can you check my file
https://skydrive.live.com/redir.aspx?cid=1f7d587977721379&resid=1F7D587977721379!168
i got the same problemregards,
-
Friday, September 23, 2011 3:51 PM
Hey,
I installed my computer few days ago and i do have few times a day a restart but without a BSOD, minidump file or a notice in the event viewer. In the event viewer i do have the same error as you have but i do not know for sure that this is related to the restarts.
Because it is a new computer i wanted to now if this is the same problem as you have or maybe i do have a hardware problem...
Thanks,
Nir
-
Tuesday, September 27, 2011 7:36 AM
I am having the same problem...
I am receiving phone support from Microsoft but the support engineer doesn't have a clue. I agreed to monitor until next weekend when he wants to have me re-install the O/S (64-bit Win 7 Pro). I don't believe this will solve the problem based on other posts.
Observations:
I have been manually updating MSE paying particular attention to the release date of the new definitions as they become available via Windows Update. What I notice is that the Windows Update is release as an "Optional" update which will not occur automatically. I believe MSE detects the availability of each new update and shuts down Behavior Monitoring.
It appears that Real-Time Protection is still active but there seems to be a programming logic error with how MSE handles the availability of new virus definition updates which occur one or more times per day.
I do not experience any other issues like BSOD or explorer hangs.
The following error occurs along with the error above:
Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Behavior Monitoring
Error Code: 0x80004005
Error description: Unspecified error
Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.
PLEASE HELP IF YOU CAN!
- Edited by I am he is you are me and ... _ Tuesday, September 27, 2011 7:40 AM
-
Thursday, September 29, 2011 5:02 PM
I was having the same problem on my system a few months ago and it bugged me for weeks until I found a suggestion to remove Microsoft Security Essentials. Sounds counter-intuitive, but that fixed the problem.
My friend called me the other day and asked if I could help him build a new computer, because his kept freezing and crashing unexpectedly. I checked out the event viewer and he had the exact same problems. Removed Security Essentials and voila, no more crashing.
It appears that this problem has been ongoing for at least 6 months now and randomly affects different people and Microsoft still isn't addressing the problem.
-
Friday, December 16, 2011 5:32 PM
I am also having the same issue. Daily:
Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
-
Wednesday, December 21, 2011 4:40 AMi had the same issue but only when i run a program called advance system care 5 it started when it was reparing the reg then it crashed say system mem crash dump BLUE SCREEN it said to disable the anti virus well my anti virus is micro soft securty essit etc ... but if i didn`t run the advance system care it would not do that so its in the reg micro soft is their a patch or a tool to scan and repare the windows 7 64 bit reg file? if so please help me and others that have the same problem thank you( Doc haze )
-
Monday, January 16, 2012 2:37 PM
I have symptoms similar to the ones described above.
Sometimes BSOD, sometimes just freeze/crash.
I have noticed that it happens more often than not when my system changes powerstate (I think) - that is, when I disconnect the AC from my laptop.
Often, before the freeze, DWM is trying to restart/recover for a while.
Between 30/12-2011 - 06/01-2012, I have 10 hits in MSE history on "worm:win32/conficker.B!inf"
I don't know if it is related at all, but I don't remember having this issue before getting infected.
-
Monday, April 02, 2012 12:42 AM
The problem 'Event ID 3' had attracted quite a few responses, and most of them were beating about the bush with no sure understanding of the problem. Since the page does not show that it has been solved, here is a 'solution', again without knowing for sure that it is the best:
Either rename the file EppOobe.etl (in C > ProgramData > Microsoft > Microsoft Security Client > Support) as EppOobe.etl.old, or delete it, and reboot.
Check the Support folder. If there was no other problem, Windows would have created a new EppOobe.etl file.
Delete the file that had been renamed 'old'.
May be, everyone already knows this solution by now, in which case this is an academic exercise.
- Proposed As Answer by Joe Regenstein Sunday, May 20, 2012 11:59 AM
-
Saturday, July 28, 2012 4:44 PM
i had similar problem...here's the solution that worked for me.
boot into safe mode if your system freezes after logging in (like mine was).
open a command line (win+r)
run 'services.msc' and hit enter (don't type the quotes)
scroll down to find 'program compatibility assistant service' (PcaSvc)
right-click and open the 'properties'
change the 'startup type' from 'automatic' to 'disabled'
save and reboot
-----------------------------------
other thoughts...
deleting the suspect file that everyone suggested (C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl) was pretty ineffective; the problem seemed to persist intermittently. uninstalling ms security essentials also didn't solve the problem. i did plenty of registry cleaning using ccleaner but to no avail. so i decided to do some digging...i noticed that it never occurred in safe mode, so i opened msconfig and proceeded to disable services systematically on a hunch that one might be the problem child. since my problem was (mostly) reproducible, i was able to enable and disable services to narrow in on this one service. i confirmed it several times by turning on/off the problem by enabling/disabling the PcaSvc. side note: apparently disabling this service will also turn off some nagging pop-ups about windows checking into programs that crash.
worked for me, hope this helps you.
j
-
Tuesday, October 16, 2012 6:04 AM
Grogamon,
Pffuhh than you had much work to do to look into the "services" files.
But you didn`t it for nothing because this solution helps.
Yes really i was also pestered by the kernel id 3 error.
I have now a blanc logbook. Totally no errors.
Thank you thank you thank you etc...etc...
- Edited by De Redder Tuesday, October 16, 2012 6:04 AM
-
Sunday, December 23, 2012 8:04 PMYou will find support for Microsoft Security Essentials in these forums => http://answers.microsoft.com/en-us/protect/forum/mse
~Robear Dyer (PA Bear) ~ MS MVP (IE, Mail, Security, Windows & Update Services) since 2002 ~ Disclaimer: MS MVPs neither represent nor work for Microsoft
-
Wednesday, February 13, 2013 1:01 PM
Just wanted to add, me too.
Random daily crashes starting yesterday for the first time after a stable system for almost a year. Win 7 x64.
No minidump directory, even though settings say to create one.
Black screen, all of a sudden, while I'm working, with "Please select proper boot device".
Security Essentials error as above, even though months ago SE was properly uninstalled using control panel Programs uninstall.
--
I've just now gone into Manage, Services and have disabled program compatibility assistant service but I have to do some research what it is and what it does. About to reboot....
@&@&!!!!!!!!!!!!!
EDIT: After disabling program compatibility assistant service, I was unable to see Services any longer in the Management console! Management Console stopped respponding. Also, IE9 froze up when I opened it to search for that problem. Had to reboot in Safe Mode and turn it back on.
- Edited by lloydmalvern Wednesday, February 13, 2013 1:30 PM
-
Friday, May 03, 2013 6:43 PM
Let me chime in here.
1. I have the I have the Program Comparibility Assistant disabled. Has slowed down the crashes but still happening.
2. Have reinstalled Win 7 64bit Pro after format of harddrive and still #1.
3. Mine seems to have started about the same time as some "Critical Update" about ten days ago.
4. It eploobe.etl, Error Code 3221225485, Logging Mode 5, and can be replicated.
Now, how about a fix in the next batch of "Important Updates"? This is very annoying at best and not a "Good Experience" moment of this product.
-
Saturday, May 04, 2013 4:55 PM
Ron Shepherd :
I'm having the same problem as you on my Win 7 laptop. I've been having BSOD errors associated when the error appears in the event log. Do you have random BSOD problems too?
...Wishing I was an MVP :/
- Edited by zephyr87 Saturday, May 04, 2013 4:56 PM
-
Saturday, May 18, 2013 8:52 AM
Let me slip on this thread also some of my pain....
I totally agree with Ron Shepherd. Before late April, early May critical updates never experienced BSODs on this laptop.
The only thing I'm sure of, is that disabling the wireless network problems disappear.
Re-installing the Wi-Fi board driver solves the issue temporarily.
Disabling IPv6 helps to prolong the session before the next BSOD.
Along with the error in subject, is everytime present the 30005 "The ICS_IPV6 was unable to allocate bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error".
It seems that media streaming flows, with an intense net packets exchange, catalyze BSODs.
I'll try what's suggested by Suzarin and I keep my finger crossed that it may work 4 me.
But, like Ron, I think there's the "Critical Updates" hand on it....
Stefania
- Edited by Stefania Castelli Saturday, May 18, 2013 8:54 AM
-
Tuesday, May 21, 2013 9:59 AM
run 'services.msc' and hit enter (don't type the quotes)
scroll down to find 'program compatibility assistant service' (PcaSvc)
right-click and open the 'properties'
change the 'startup type' from 'automatic' to 'disabled'
save and reboot
Twoja metoda nie naprawia błędu. Dopisanie rozszerzenia *.old do nazwy pliku pomaga do pierwszego "Twardego Resetu" lub braku energii elektrycznej z powodu awarii elektrowni.
A.S.
PS. The above text written in Polish.
.png)
