none
Session "Microsoft Security Essentials OOBE" stopped due to the following error: 0xC000000D using win 7 64bit over and over BSOD

    Question

  • Session "Microsoft Security Essentials OOBE" stopped due to the following error: 0xC000000D    using win 7 64bit over and over BSOD

    My event viewer has been coughing the error line above. It has lead to the feeling of a Carotid Artery leak of memory where my whole

    system slowly stops working till BSOD. Windows Explorer just stops working then Death.

    I HAVE HAD THIS HAPPEN MORE AND MORE, AND IT APPEARS TO BE A PROGRAM PROBLEM, ANYBODY ELSE HAVE THIS.

    IT HAS COST ME 2 DAYS WORK NOW.

    MIKE

    Tuesday, June 08, 2010 5:23 PM

Answers

  • Hi,

     

    When does the issue begin to occur?

     

    Since Windows system uses separated user mode and kernel mode memory space, stop errors are usually caused by kernel portion components, such as a hardware device, third-party drivers, backup software or anti-virus services (buggy services).

     

    Please refer to the following steps to troubleshoot the issue.

     

    1. Boot the computer in Clean Boot for a test.

     

    2. Temporarily disable all unnecessary hardware devices in Device Manager, such as Modem, sound card or external device.

     

    For detail steps, we can refer to the link below:

     

    Device Clean Boot

     

    3. Upgrade the virus definition, run antivirus program and perform a full scanning.

     

    If the issue persists, please upload the minidump file (%systemroot%\minidump) to SkyDrive ( www.skydrive.live.com ), then share the link to me. I will be glad to assist you to analysis the data.

     

    Thanks,

    Novak

    • Marked as answer by Novak Wu Monday, June 21, 2010 1:36 AM
    Wednesday, June 09, 2010 5:06 AM

All replies

  • Hi,

     

    When does the issue begin to occur?

     

    Since Windows system uses separated user mode and kernel mode memory space, stop errors are usually caused by kernel portion components, such as a hardware device, third-party drivers, backup software or anti-virus services (buggy services).

     

    Please refer to the following steps to troubleshoot the issue.

     

    1. Boot the computer in Clean Boot for a test.

     

    2. Temporarily disable all unnecessary hardware devices in Device Manager, such as Modem, sound card or external device.

     

    For detail steps, we can refer to the link below:

     

    Device Clean Boot

     

    3. Upgrade the virus definition, run antivirus program and perform a full scanning.

     

    If the issue persists, please upload the minidump file (%systemroot%\minidump) to SkyDrive ( www.skydrive.live.com ), then share the link to me. I will be glad to assist you to analysis the data.

     

    Thanks,

    Novak

    • Marked as answer by Novak Wu Monday, June 21, 2010 1:36 AM
    Wednesday, June 09, 2010 5:06 AM
  • I'm having the exact problem as the original poster.  If you wouldn't mind analyzing my dump file I would really love to know what's causing my daily BSOD on my Win 7 64 bit os.  The link is: http://cid-f264f5759e0fb183.office.live.com/browse.aspx/.Public

     

    Thanks,

    Bruce

    Wednesday, June 16, 2010 6:26 AM
  • I'm having the exact problem as the original poster.  If you wouldn't mind analyzing my dump file I would really love to know what's causing my daily BSOD on my Win 7 64 bit os.  The link is: http://cid-f264f5759e0fb183.office.live.com/browse.aspx/.Public

     

    Thanks,

    Bruce


    Hey Bruce,

    Looking at your minidump, the faulty module is probably NETw5s64.sys which searching up shows all kinds of nasty BSODs.

    http://www.google.com/search?q=NETw5s64.sys

    Mike, can you provide a minidump?

    Tuesday, June 22, 2010 7:59 AM
  • I am getting the same sets of problems, but I can never find the minidump program.  I look in the windows/minidump folder, but that directory is not there and no .dmp files exists on the computer.  But I am getting BSODs.  I really want to track the culprit.  Hard drive, memory scan, and checkdisks all come out fine. 

     

    Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
    Source:        Microsoft-Windows-Kernel-EventTracing
    Date:          8/22/2011 3:17:43 AM
    Event ID:      3
    Task Category: Session
    Level:         Error
    Keywords:      Session
    User:          SYSTEM
    Computer:      XavierMorganPC
    Description:
    Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>3</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>2</Task>
        <Opcode>14</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2011-08-22T08:17:43.736814500Z" />
        <EventRecordID>34</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="200" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
        <Computer>XavierMorganPC</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="SessionName">Microsoft Security Client OOBE</Data>
        <Data Name="FileName">C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl</Data>
        <Data Name="ErrorCode">3221225485</Data>
        <Data Name="LoggingMode">5</Data>
      </EventData>
    </Event>

    Monday, August 22, 2011 1:59 PM
  • I'm having the exact problem as the original poster.  If you wouldn't mind analyzing my dump file I would really love to know what's causing my  BSOD on my Win 7 64 bit os.  The link is:

     

    https://skydrive.live.com/?cid=d1aecb809a5fb11b&sc=documents&id=D1AECB809A5FB11B%21227#

     

    Thanks very much

    Monday, September 12, 2011 4:44 AM
  • I also have runned into this problem:

    -----------------------------

    Loggnamn:      Microsoft-Windows-Kernel-EventTracing/Admin
    Källa:         Microsoft-Windows-Kernel-EventTracing
    Datum:         2011-09-12 08:42:23
    Händelse-ID:   3
    Aktivitetskategori:Session
    Nivå:          Fel
    Nyckelord:     Session
    Användare:     SYSTEM
    Dator:         Tomas-PC
    Beskrivning:
    Sessionen "Microsoft Security Client OOBE" stoppade på grund av följande fel: 0xC000000D
    Händelsens XML-data:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" />
        <EventID>3</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>2</Task>
        <Opcode>14</Opcode>
        <Keywords>0x8000000000000010</Keywords>
        <TimeCreated SystemTime="2011-09-12T06:42:23.128030900Z" />
        <EventRecordID>10</EventRecordID>
        <Correlation />
        <Execution ProcessID="4" ThreadID="200" />
        <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>
        <Computer>Tomas-PC</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <EventData>
        <Data Name="SessionName">Microsoft Security Client OOBE</Data>
        <Data Name="FileName">C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl</Data>
        <Data Name="ErrorCode">3221225485</Data>
        <Data Name="LoggingMode">5</Data>
      </EventData>
    </Event>

    --------------------------------------------

    Thanks

    Tomas

     


    By helping others I help myself
    Monday, September 12, 2011 7:20 AM
  • Nudge,,,

    Can someone look at my .dmp file?

    Thursday, September 15, 2011 3:38 AM
  • I'm having the same issue and have tried several fixes that were suggested (uninstalled wireless card, deleted specific files popping up in my error logs) however when I tried to install the debugging tools to check my actual dump files I'd immediately BSOD.  Could you look at them and help me out on this issue?
    Thanks,
    JeC

    https://skydrive.live.com/redir.aspx?cid=22faf5298e2b217e&resid=22FAF5298E2B217E!158&authkey=5HdQPfEIYPc%24 
    Monday, September 19, 2011 4:18 AM
  • please can you check my file

    https://skydrive.live.com/redir.aspx?cid=1f7d587977721379&resid=1F7D587977721379!168

    i got the same problem

    regards,

     

    Thursday, September 22, 2011 12:18 AM
  • Hey, 

    I installed my computer few days ago and i do have few times a day a restart but without a BSOD, minidump file or a notice in the event viewer. In the event viewer i do have the same error as you have but i do not know for sure that this is related to the restarts.

    Because it is a new computer i wanted to now if this is the same problem as you have or maybe i do have a hardware problem...

     

    Thanks,

    Nir

    Friday, September 23, 2011 3:51 PM
  • I am having the same problem...

    I am receiving phone support from Microsoft but the support engineer doesn't have a clue.  I agreed to monitor until next weekend when he wants to have me re-install the O/S (64-bit Win 7 Pro).  I don't believe this will solve the problem based on other posts.

    Observations:

    I have been manually updating MSE paying particular attention to the release date of the new definitions as they become available via Windows Update.  What I notice is that the Windows Update is release as an "Optional" update which will not occur automatically.  I believe MSE detects the availability of each new update and shuts down Behavior Monitoring.

    It appears that Real-Time Protection is still active but there seems to be a programming logic error with how MSE handles the availability of new virus definition updates which occur one or more times per day.

    I do not experience any other issues like BSOD or explorer hangs.

    The following error occurs along with the error above:

    Microsoft Antimalware Real-Time Protection feature has encountered an error and failed.  Feature: Behavior Monitoring

    Error Code: 0x80004005

    Error description: Unspecified error

    Reason: The filter driver requires an up-to-date engine in order to function. You must install the latest definition updates in order to enable real-time protection.

     

    PLEASE HELP IF YOU CAN!


    Tuesday, September 27, 2011 7:36 AM
  • I was having the same problem on my system a few months ago and it bugged me for weeks until I found a suggestion to remove Microsoft Security Essentials. Sounds counter-intuitive, but that fixed the problem.

    My friend called me the other day and asked if I could help him build a new computer, because his kept freezing and crashing unexpectedly. I checked out the event viewer and he had the exact same problems. Removed Security Essentials and voila, no more crashing.

    It appears that this problem has been ongoing for at least 6 months now and randomly affects different people and Microsoft still isn't addressing the problem.

    Thursday, September 29, 2011 5:02 PM
  • I am also having the same issue.  Daily:

    Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D

    Friday, December 16, 2011 5:32 PM
  • i had the same issue but only when i run a program called advance system care 5 it started when it was reparing the reg then it crashed say system mem crash dump BLUE SCREEN it said to disable the anti virus well my anti virus is micro soft securty essit etc ... but if i didn`t run the advance system care it would not do that so its in the reg micro soft is their a patch or a tool to scan and repare the windows 7 64 bit reg file? if so please help me and others that have the same problem thank you( Doc haze )
    Wednesday, December 21, 2011 4:40 AM
  • I have symptoms similar to the ones described above.

    Sometimes BSOD, sometimes just freeze/crash.

    I have noticed that it happens more often than not when my system changes powerstate (I think) - that is, when I disconnect the AC from my laptop.

    Often, before the freeze, DWM is trying to restart/recover for a while.

    Between 30/12-2011 - 06/01-2012, I have 10 hits in MSE history on "worm:win32/conficker.B!inf"

    I don't know if it is related at all, but I don't remember having this issue before getting infected. 

    Monday, January 16, 2012 2:37 PM
  • The problem 'Event ID 3' had attracted quite a few responses, and most of them were beating about the bush with no sure understanding of the problem. Since the page does not show that it has been solved, here is a 'solution', again without knowing for sure that it is the best:

    Either rename the file EppOobe.etl (in C > ProgramData > Microsoft > Microsoft Security Client > Support) as EppOobe.etl.old, or delete it, and reboot.

    Check the Support folder. If there was no other problem, Windows would have created a new EppOobe.etl file.

    Delete the file that had been renamed 'old'.

    May be, everyone already knows this solution by now, in which case this is an academic exercise.

    Monday, April 02, 2012 12:42 AM
  • i had similar problem...here's the solution that worked for me.

    boot into safe mode if your system freezes after logging in (like mine was).

    open a command line (win+r)

    run 'services.msc' and hit enter (don't type the quotes)

    scroll down to find 'program compatibility assistant service' (PcaSvc)

    right-click and open the 'properties'

    change the 'startup type' from 'automatic' to 'disabled'

    save and reboot

    -----------------------------------

    other thoughts...

    deleting the suspect file that everyone suggested (C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl) was pretty ineffective; the problem seemed to persist intermittently. uninstalling ms security essentials also didn't solve the problem. i did plenty of registry cleaning using ccleaner but to no avail. so i decided to do some digging...i noticed that it never occurred in safe mode, so i opened msconfig and proceeded to disable services systematically on a hunch that one might be the problem child. since my problem was (mostly) reproducible, i was able to enable and disable services to narrow in on this one service. i confirmed it several times by turning on/off the problem by enabling/disabling the PcaSvc. side note: apparently disabling this service will also turn off some nagging pop-ups about windows checking into programs that crash.

    worked for me, hope this helps you.

    j


    • Edited by grogramon Saturday, July 28, 2012 4:46 PM
    • Proposed as answer by grogramon Saturday, July 28, 2012 4:46 PM
    Saturday, July 28, 2012 4:44 PM
  • Grogamon,

    Pffuhh than you had much work to do to look into the "services" files.

    But you didn`t it for nothing because this solution helps.

    Yes really i was also pestered by the kernel id 3 error.

    I have now a blanc logbook. Totally no errors.

    Thank you thank you thank you etc...etc...


    • Edited by De Redder Tuesday, October 16, 2012 6:04 AM
    Tuesday, October 16, 2012 6:04 AM
  • You will find support for Microsoft Security Essentials in these forums => http://answers.microsoft.com/en-us/protect/forum/mse

    ~Robear Dyer (PA Bear) ~ MS MVP (IE, Mail, Security, Windows & Update Services) since 2002 ~ Disclaimer: MS MVPs neither represent nor work for Microsoft

    Sunday, December 23, 2012 8:04 PM
  • Just wanted to add, me too.

    Random daily crashes starting yesterday for the first time after a stable system for almost a year. Win 7 x64.

    No minidump directory, even though settings say to create one.

    Black screen, all of a sudden, while I'm working, with "Please select proper boot device".

    Security Essentials error as above, even though months ago SE was properly uninstalled using control panel Programs uninstall.

    --

    I've just now gone into Manage, Services and have disabled program compatibility assistant service  but I have to do some research what it is and what it does.  About to reboot....

    @&@&!!!!!!!!!!!!!

    EDIT: After disabling program compatibility assistant service, I was unable to see Services any longer in the Management console! Management Console stopped respponding.  Also, IE9 froze up when I opened it to search for that problem. Had to reboot in Safe Mode and turn it back on.


    • Edited by lloydmalvern Wednesday, February 13, 2013 1:30 PM
    Wednesday, February 13, 2013 1:01 PM
  • Let me chime in here.

    1. I have the I have the Program Comparibility Assistant disabled. Has slowed down the crashes but still happening.

    2. Have reinstalled Win 7 64bit Pro after format of harddrive and still #1.

    3. Mine seems to have started about the same time as some "Critical Update" about ten days ago.

    4. It eploobe.etl, Error Code 3221225485, Logging Mode 5, and can be replicated.

    Now, how about a fix in the next batch of "Important Updates"? This is very annoying at best and not a "Good Experience" moment of this product.

    Friday, May 03, 2013 6:43 PM
  • Let me slip on this thread also some of my pain....

    I totally agree with Ron Shepherd. Before late April, early May critical updates never experienced BSODs on this laptop.

    The only thing I'm sure of, is that disabling the wireless network problems disappear.

    Re-installing the Wi-Fi board driver solves the issue temporarily.

    Disabling IPv6 helps to prolong the session before the next BSOD.

    Along with the error in subject, is everytime present the 30005 "The ICS_IPV6 was unable to allocate  bytes of memory. This may indicate that the system is low on virtual memory, or that the memory manager has encountered an internal error".

    It seems that media streaming flows, with an intense net packets exchange, catalyze BSODs.

    I'll try what's suggested by Suzarin and I keep my finger crossed that it may work 4 me.

    But, like Ron, I think there's the "Critical Updates" hand on it....

    Stefania


    Saturday, May 18, 2013 8:52 AM
  • I also am having the same problem, but system just freezes.  I seem to be able to replicate the problem by going to certain websites in Google chrome.  For instance http://www.stitchlabs.com/ is one that causes a freeze.  The problem seems less frequent when using IE or Firefox.  Any ideas why a website would trigger a system freeze?

    There are other sites (all e-commerce stuff) that also seem to trigger freeze.  The error message is the aforementioned OOBE error.   HELP!!!

    Tuesday, August 20, 2013 11:53 AM
  • Hi,

    Show off what have been doing (fix / solution / method).
    Regards,



    WodzuAS

    Saturday, September 21, 2013 2:09 PM
  • C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl

    change

    C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.old  


    WodzuAS

    • Proposed as answer by WodzuAS Saturday, September 21, 2013 10:08 PM
    Saturday, September 21, 2013 10:08 PM
  • SOLVED

    1. uninstall MSE by- control panel> program and features.

    2. Down load Fix it tool from Microsoft called Microsoft Fix It 50692. This removes register values.

    3. click on computer> C drive > program data (remember this folder is hidden). You will need to click on organize and click on folder and search options> view > click on show all files- to see the Program Data folder.

    Double click on program data > microsoft> Microsoft Security Client> support > Delete very thing in this folder.

    4. Reactive the Window Defender. This is done by Control Panel > Administrative Tools > Services > windows defender > start up type- Auto > click on recovery tab > change all the failure steps to restart the service> change restart service after from 1 minute to 2 minutes. > click apply.

    5. Then go to  control panel > Administrative tools > system configuration > services > scroll down and click on Window Defender> when asked- reboot.

    6. your window defender should be running- if not start it up manually by Control Panel> Window Defender> click on start now. Reboot. If not on now after reboot- check the above steps to ensure it's on when you reboot the computer not manually by you. It must start Automatically after reboot.

    7. Down load MSE from Microsoft and install- remember the computer has had the program removed and also it register entries. This must be done before reinstalling MSE. Or fix will not work.

    8. You will notice that during loading of MSE- it will ask you to turn off any other anti-virus programs including Windows Defender> turn it off again by turning off real-time protection. Open the windows defender through the Control Panel and unclick the real-time.

    9. then finish loading MSE.

    10 After reboot check that the Windows defender is turned off. If not just turn it off again, as described above.

    11. If you check the Microsoft Security Client folder you will see all the files you deleted have been replaced.

    12 . You will notice strange things happening to your computer like short cuts etc not showing up etc. Try not to be distracted. Very thing will be normal when you reinstall the MSE. But of course there will not be any errors of OOBE.

    13. GOOD LUCK.

    Friday, December 27, 2013 1:47 PM
  • VINCE1561981816's and others' suggestions above seem viable; I've had two good days without freeze-ups. I will report back on how the changes affect my lappy's stability when more time elapses.
    Tuesday, January 14, 2014 6:28 AM
  • Just follow the steps in this form and you'll be free (like me!) of the lockups!  The solutions, in combination, worked for me. 
    Monday, January 20, 2014 11:17 PM
  • Still having the problem with Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D .....none of the solution's' heirin fixed it.   I guess that deafening silence from M$ means we have to live with daily BSOD........sad realy...
    Wednesday, March 12, 2014 9:56 PM
  • You will find Consumer support for Microsoft Security Essentials (MSE) in these forums: http://answers.microsoft.com/en-us/protect/forum/mse

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


    Related references may include:


    ~Robear Dyer (PA Bear) MS MVP-Windows Client since 2002 Disclaimer: MS MVPs neither represent nor work for Microsoft

    Sunday, March 16, 2014 4:20 PM
  • Hi, I could stop the error  "Microsoft Security Essentials OOBE" stopped due to the following error: 0xC000000D"

    by deteting a file "C:\ProgramData\Microsoft\Microsoft Security Client\Support\EppOobe.etl"

    Be carefull side eddect deleting this file because this log file has dependencies with some sysytem objects.

    In my case. Gatherer task warning 3036 appears as a side effect, but I think I can ignore this warning.

    BSOD doesn't happen by the error "Microsoft Security Essentials OOBE: 0xC000000D "

    on my Windows7 x64 Ultimate.

    Sunday, March 23, 2014 2:09 AM