BSOD 0x00000101 when coldbooted, stable after reboot...

Welcome. : )

This is how to uninstall sptd.sys, the easy and the right way:

DuplexSecure - FAQ

Later when your system is stable over a few weeks, you can install it back BUT make sure it's latest 2010.

EventID 11, Custom DLL (dynamic link libraries) are loaded for each program. The system administrator should check that the libraries in the list are related to trusted applications.



EventID 1530, Windows detected your registry file is still used by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

These are warnings, does it state what files for the eventid 11?

cybercore said:

These are warnings, does it state what files for the eventid 11?

So, now is sptd gone and i installed MagicDisc instead.

I have had this "Event ID 11" for a very long time, but never thought about it.
In older logmessages it mentions "avgrssta.dll" but that file is gone now since i replaced AVG with MSE.
Now Event ID 11 only says this:

Code:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
   - <System>
     <Provider Name="Microsoft-Windows-Wininit" Guid="{206F6DEA-D3C5-4D10-BC72-989F03C8B84B}" /> 

    <EventID>11</EventID> 

    <Version>0</Version> 

    <Level>3</Level> 

    <Task>0</Task> 

    <Opcode>0</Opcode> 

    <Keywords>0x4000000000000000</Keywords> 

    <TimeCreated SystemTime="2010-10-14T16:53:26.850044500Z" /> 

    <EventRecordID>74028</EventRecordID> 

    <Correlation />  

    <Execution ProcessID="496" ThreadID="516" />  

    <Channel>System</Channel> 

    <Computer>Djupatanken</Computer> 

    <Security UserID="S-1-5-18" /> 

   </System>


  + <EventData>
     <Data Name="StringCount">0</Data> 

    <Data Name="String" />  

   </EventData>


   </Event>

Event ID 1530 is gone today, so i guess some of all uninstalls fixed this.:)

Then i have EventID 3, wich also have been there for a loong time.
The session "Microsoft-Windows-Setup" stopped due to the following error: 0xC000000D

Code:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
   - <System>
     <Provider Name="Microsoft-Windows-Kernel-EventTracing" Guid="{B675EC37-BDB6-4648-BC92-F3FDC74D3CA2}" /> 

    <EventID>3</EventID> 

    <Version>0</Version> 

    <Level>2</Level> 

    <Task>2</Task> 

    <Opcode>14</Opcode> 

    <Keywords>0x8000000000000010</Keywords> 

    <TimeCreated SystemTime="2010-10-09T23:09:21.044020200Z" /> 

    <EventRecordID>603</EventRecordID> 

    <Correlation />  

    <Execution ProcessID="4" ThreadID="164" />  

    <Channel>Microsoft-Windows-Kernel-EventTracing/Admin</Channel>  

    <Computer>Djupatanken</Computer> 

    <Security UserID="S-1-5-18" /> 

   </System>


  - <EventData>
     <Data Name="SessionName">Microsoft-Windows-Setup</Data>  

    <Data Name="FileName">C:\Windows\Panther\setup.etl</Data>  

    <Data Name="ErrorCode">3221225485</Data>  

    <Data Name="LoggingMode">5</Data> 

   </EventData>


   </Event>

I found some info here, wich i really dont understand much of: Windows Setup Log Files
I understand that its some kind of logfile (at 45MB size), and i opened it in eventviewer, but then i dont understand more, all logs in that file are more than 6months old.
In the "phanter" folder every file and folder been untuched since windows install (january) except for this "setup.etl" that is changed with every reboot.
(With "changed" I mean that i look at the "last change" column i explorer.

Now it crashed again! Was playing Civilization 5 and
same thing as I first posted, laggy, wierd noise, a couple of minutes later: BSOD 0x00000101

It didnt produced any minidump this time, just a memory.dmp (450MB) was created.
I copied that to desktop, just in case.

The first thing I can se in eventviewer is Event ID 27:
Intel(R) 82567V-2 Gigabit Network Connection Link has been disconnected.
This is when the crash "starts" and i first hear the wierd noise.
From this point it toke 5-6min to BSOD.

Attached a Perfmon report and log files.
Shall i upload the memory.dmp file? (140MB when zipped)

Already uploading it, a link will come soon. (slow upload)
And, yepp, my dumpsettings was changed to complete dump instead of mini.

memory dump: 2shared - download psychochef MEMORYdmp 20101014.rar