"Microsoft Security Client OOBE" stopped due to error: 0xC000000D

I just joined this forum today, I found it while searching for help to fix the following error as displayed in the Event Log:

When I boot up I do get my desktop, but the mouse is frozen.
I turn the power off, and back on and my system is functional.

However, I get the following error messages in the event log each time:
1. Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
2. The previous system shutdown at 6:07:45 AM on ‎1/‎26/‎2013 was unexpected.
3. The system has rebooted without cleanly shutting down first. This error could be caused if the system stopped responding, crashed, or lost power unexpectedly.
4. Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D
5. Audit events have been dropped by the transport. 0

This has been going on for a while now. In an attempt to fix, using suggestions I found by Googling:
1. I have uninstalled Security Essentials, run a registry cleanup, re-started my system and reinstalled Security Essentials;
2. Removed the EppOobe.etl file and rebooted.
Neither of these worked.

Attached is a zip file created by running the SF_Diagnostic_Tool.exe. Prior to creating this file I followed the instructions from this page Dump Files - Configure Windows to Create on BSOD in order to be able to create a complete dump file.
I have also entered as much information as possible about my system configuration into my profile.

I can do some basic fixes, but this issue has me totally stumped. Please let me know if I did anything incorrectly so far, and if you need additional information.

I would be most appreciative if a forum guru could help me fix this problem.
Thank heaps in advance!

After I formatted my machine I constantly had this problem and error. For a while removing the EppOobe.etl file prior to shutdown and/or rebooting was the only fix. This morning my system BSOD'd mid-game due to this bloody file/program. Not to mention MSE has been the sole cause of every issue with my machine. I've since un-installed it and installed another virus scanner all together. So far so good!

Sorry I don't have a fix for you. But I suggest downloading something else entirely.

Yesterday's BSOD was the first I've had since formatting my machine back in August, which was a total system wipe. Prior to that my only issue was the system freezing. Which was the same as the OPs problem with the mouse and keyboard. Originally I thought it was a driver issue. Until I noticed that the clock wasn't changing. Upon reviewing the Event Viewer log I found that EppOobe.etl was the culprit. When I found out about removing the file my problems were gone. So long as I removed it before each shutdown and restart. And to clarify I had removed and re-installed MSE more than once.

I'm unsure why there are so many issues stemming from this .etl file. But if you google MSE error 0xC000000D you'll find numerous forums with posters experiencing the same issues as myself and the OP. All the fixes I've come across appear to be only temporary. Which is why I'm hoping uninstalling MSE and using something else solves my problem.

However, I've noticed that even with MSE uninstalled (through Control Panel) it's folder remains. After altering the folders permissions, since it wouldn't let me delete it even as an Administrator, I've managed to delete the folder. But whenever I reboot, the folder reappears and only that pesky .etl file is added. Why? How do I permanently remove this program and it's files from my machine? And yes I've run a maleware and virus scan, both of which come back clean.

As for your above post I will definitely look into the bloatware, thank you for that link!

Thanks to both of you for your posts. I will try the completely remove MSE and replace with Avast later today. This is my original factory pre-installed OEM Windows. Gregrocker, thanks for the links, I will definitely see if there is any bloatware. I cleaned that off my system when I received it but more may very well have been added back in since then.

MonkeyFunkR what virus software are you using? I have had the same experience in attempting to find a solution, after a comprehensive search all of the answers appear to only be temporary fixes. I will post the results back here when done, and will definitely check to see if I have the same issue with the .etl file that you are having.

Through all my searching most posters recommend Avast. From what I understand it's small, not intrusive and windows friendly. But I'm unfamiliar with it.

Before using MSE (after a format) I used Comodo and had no problems. That's what I've gone back to. It's free version is anti-virus only and just a heads up when installed it will install Geekbuddy and Dragon browser. Both are extras and can be un-installed easily through control panel.

Good luck!

Thank you, that is helpful, this has definitely been the most frustrating debugging I have had to do in a long time!

Ditto!

I installed a new graphics card a few days ago and when I saw that BSOD my heart sank. Thought I got a bad card...

If you manage to get rid of that folder and its contents let me know. Or if you come across a method to due so, please let me know. I'll do the same.

Nobody here recommends anything Comodo. What I see most is MSE and Avast.

Bloatware is pernicious because it can damage system files merely by its removal. That's why to shed it completely requires the Clean Reinstall - Factory OEM Windows 7.

Here is what I have done, and at the moment the message Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D is not showing in the Event Viewer when I boot up.

1. Removed MSE and did a registry cleanup.

2. Rebooted, message Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D was still in Event Viewer. Plus there was the message that when I shut down the following occurred:
Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.
DETAIL -
5 user registry handles leaked from \Registry\User\S-1-5-21-2599493413-1845634037-364224823-1001:
Process 564 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001
Process 564 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001
Process 564 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\My
Process 564 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\CA
Process 564 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\Disallowed


3. Removed the EppOobe.etl file and rebooted.

4. Got the same dang message in the Event Viewer. But did not get the leak message.

5. I had recently installed and then uninstalled Malwarebytes so in an abundance of caution downloaded and ran their uninstaller tool to make sure the uninstall was totally clean.

6. Rebooted and got the leak message and that same dang message yet again.

7. Loaded Avast, that went fine.

8. Went to How to manually uninstall Microsoft Security Essentials 2.0.1963 if you cannot uninstall it by using the Add or Remove Programs item and first downloaded and ran the FixIt Wizard. No luck on reboot.

9. Went back to How to manually uninstall Microsoft Security Essentials 2.0.1963 if you cannot uninstall it by using the Add or Remove Programs item and went through their step by step process of removing MSE, but found none of the files indicated in the process. Removed the EppOobe.etl file one more time, and upon reboot EUREKA, the Session "Microsoft Security Client OOBE" stopped due to the following error: 0xC000000D did not show up in the Event Viewer. What did show was the Leak message again as follows:

Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

DETAIL -
5 user registry handles leaked from \Registry\User\S-1-5-21-2599493413-1845634037-364224823-1001:
Process 560 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001
Process 560 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001
Process 560 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\My
Process 560 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\CA
Process 560 (\Device\HarddiskVolume3\Windows\System32\lsass.exe) has opened key \REGISTRY\USER\S-1-5-21-2599493413-1845634037-364224823-1001\Software\Microsoft\SystemCertificates\Disallowed

Some websites say ignore this message, other say it should be investigated. I still have the Microsoft Security Client Folder/Support/and multiple files underneath. And DANGIT the wretched EppOobe.etl is back.

I am taking a break, and will be out all day tomorrow. Are these leak messages helpful, is there something else I can try based on this information?

Thank you!