Windows 7: BSOD 0x00000101 when coldbooted, stable after reboot...

cybercore · 14 Oct 2010

Welcome. : )

This is how to uninstall sptd.sys, the easy and the right way:

DuplexSecure - FAQ

Later when your system is stable over a few weeks, you can install it back BUT make sure it's latest 2010.

Quote:

EventID 11, Custom DLL (dynamic link libraries) are loaded for each program. The system administrator should check that the libraries in the list are related to trusted applications.

EventID 1530, Windows detected your registry file is still used by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

These are warnings, does it state what files for the eventid 11?

CarlTR6 · 14 Oct 2010

Obviously the log errors tell you something went wrong. Often this is a one time or random occurrence. It is when you see repeats of the same error that you need to find the problem.

Quote:

EventID 11, Custom DLL (dynamic link libraries) are loaded for each program. The system administrator should check that the libraries in the list are related to trusted applications.

This is a security issue and not a system problem. Most likely some program you installed does not have a security certificate.

Quote:

EventID 1530, Windows detected your registry file is still used by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

This could have been triggered during the uninstall of a program that used the same registry key or even closing a program that uses a shared key. The event is telling you that unloading that key may adversely affect the other program.

Quote:

Just for still my sense for learning and understanding; can anyone explain why my pc was stable after a reboot, what could differ in the system??

There are differences in a cold boot and a warm boot. Something is going wrong during the cold boot and a warm reboot solves that problem. I know this is not much help. My guess is that it is driver related.

PsychoCheF · 14 Oct 2010

Quote: Originally Posted by cybercore

These are warnings, does it state what files for the eventid 11?

So, now is sptd gone and i installed MagicDisc instead.

I have had this "Event ID 11" for a very long time, but never thought about it.
In older logmessages it mentions "avgrssta.dll" but that file is gone now since i replaced AVG with MSE.
Now Event ID 11 only says this:

Code:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
   - <System>
     <Provider Name="Microsoft-Windows-Wininit" Guid="{206F6DEA-D3C5-4D10-BC72-989F03C8B84B}" /> 

    <EventID>11</EventID> 

    <Version>0</Version> 

    <Level>3</Level> 

    <Task>0</Task> 

    <Opcode>0</Opcode> 

    <Keywords>0x4000000000000000</Keywords> 

    <TimeCreated SystemTime="2010-10-14T16:53:26.850044500Z" /> 

    <EventRecordID>74028</EventRecordID> 

    <Correlation />  

    <Execution ProcessID="496" ThreadID="516" />  

    <Channel>System</Channel> 

    <Computer>Djupatanken</Computer> 

    <Security UserID="S-1-5-18" /> 

   </System>


  + <EventData>
     <Data Name="StringCount">0</Data> 

    <Data Name="String" />  

   </EventData>


   </Event>

Event ID 1530 is gone today, so i guess some of all uninstalls fixed this.

Then i have EventID 3, wich also have been there for a loong time.
The session "Microsoft-Windows-Setup" stopped due to the following error: 0xC000000D

Code:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
   - <System>
     <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" /> 

    <EventID>3</EventID> 

    <Version>0</Version> 

    <Level>2</Level> 

    <Task>2</Task> 

    <Opcode>14</Opcode> 

    <Keywords>0x8000000000000010</Keywords> 

    <TimeCreated SystemTime="2010-10-09T23:09:21.044020200Z" /> 

    <EventRecordID>603</EventRecordID> 

    <Correlation />  

    <Execution ProcessID="4" ThreadID="164" />  

    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>  

    <Computer>Djupatanken</Computer> 

    <Security UserID="S-1-5-18" /> 

   </System>


  - <EventData>
     <Data Name="SessionName">Microsoft-Windows-Setup</Data>  

    <Data Name="FileName">C:\Windows\Panther\setup.etl</Data>  

    <Data Name="ErrorCode">3221225485</Data>  

    <Data Name="LoggingMode">5</Data> 

   </EventData>


   </Event>

I found some info here, wich i really dont understand much of: Windows Setup Log Files
I understand that its some kind of logfile (at 45MB size

), and i opened it in eventviewer, but then i dont understand more, all logs in that file are more than 6months old.
In the "phanter" folder every file and folder been untuched since windows install (january) except for this "setup.etl" that is changed with every reboot.
(With "changed" I mean that i look at the "last change" column i explorer.

PsychoCheF · 14 Oct 2010

Now it crashed again! Was playing Civilization 5 and
same thing as I first posted, laggy, wierd noise, a couple of minutes later: BSOD 0x00000101

It didnt produced any minidump this time, just a memory.dmp (450MB) was created.
I copied that to desktop, just in case.

The first thing I can se in eventviewer is Event ID 27:
Intel(R) 82567V-2 Gigabit Network Connection Link has been disconnected.
This is when the crash "starts" and i first hear the wierd noise.
From this point it toke 5-6min to BSOD.

Attached a Perfmon report and log files.
Shall i upload the memory.dmp file? (140MB when zipped)

CarlTR6 · 14 Oct 2010

The memory dump dumps is too big to upload. You can upload it to a file share site. Some of the members on the BSOD can work with the memory dumps. Check your computer to make sure it is still configured to save mini dumps. The bottom of the first post in this tutorial will show you how.

http://www.sevenforums.com/tutorials...en-forums.html

PsychoCheF · 14 Oct 2010

Already uploading it, a link will come soon. (slow upload)
And, yepp, my dumpsettings was changed to complete dump instead of mini.

PsychoCheF · 14 Oct 2010

memory dump: 2shared - download psychochef MEMORYdmp 20101014.rar

CarlTR6 · 14 Oct 2010

Read these threads on Error code 101:

http://www.sevenforums.com/crash-loc...tml#post567135

http://www.sevenforums.com/crashes-debugging/35427-win-7-clock-interrupt-bsod-101-error.html#post356791

PsychoCheF · 14 Oct 2010

hmmm...

Maybe I'm slow thinking, but i'm not really sure what i shall get from thoose threads.
If I understand correct the "Translation Lookaside Buffer" (TLB) mentioned is for AMD only??

Sure, I could run memtest for 24hours, if you guys think it could help, but i've already changed all ram, and tested the new ones with memtest for 8,5h.

About malware scans, i presume MSE is reliable enough?

I just started the "sfc" scan, i report later.

I will try a harddrive scan also.

My own guesses is for now this:

Some driver related to my nVidiaGTX280 is in conflict with some driver realted to my motherboard Asus Rampage 3 Gene.
This because my system seems stable when i borrowed an ATi gpu, and my own gpu have been stable for almost 2 years, and it also runs fine on a friends pc (wich have a Gigabyte x58 MB)
BIOS bug. Reasonable since i had exact same issue with the asus rampage 2 Gene MB. These MB are to my knowledge the same, except USB3/Sata3.
Some BIOS setting. This "hi-tech" boards have millions of settings, most of the is really poor explaind in the MB manual, so even if all settings is on default i can guess that its easy that something sets wrong.
Worst scenario - Hardware Failure

--------
I guess the sfc scan i complete, the command window just closed. Is that good? logs somewhere?

CarlTR6 · 14 Oct 2010

Download and install Malwarebytes. Use it as an on demand scanner. Update it and run a quick scan.

Based on what you posted above, I would get another graphics card. Also there is a possibility of a bad or failing PSU. Do you have access to another PSU you can try?

Windows 7: BSOD 0x00000101 when coldbooted, stable after reboot...

BSOD 0x00000101 when coldbooted, stable after reboot... problems?