Jump to content
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble
Strawberry Orange Banana Lime Leaf Slate Sky Blueberry Grape Watermelon Chocolate Marble

MSFN is made available via donations, subscriptions and advertising revenue. The use of ad-blocking software hurts the site. Please disable ad-blocking software or set an exception for MSFN. Alternatively, register and become a site sponsor/subscriber and ads will be disabled automatically. 



MagicAndre1981

Trace Windows 7 boot/shutdown/hibernate/standby/resume issues

Recommended Posts

look at the process lifetime graph and you see the Autochk.exe runs. So it checks the disk for errors. run chkdsk for all HDD and check the SMART values.

Share this post


Link to post
Share on other sites

gotthimself    0

chkdsk didn't find any errors on all drives and smart didn't either. I run the boot trace a second time and the autochk.exe disappeared, but the fltmgr.sys was still running the exact same time.

Share this post


Link to post
Share on other sites

Run xperf -i boot_BASE+CSWITCH+DRIVERS+POWER_1.etl -o Driverdelay.txt -a drvdelay to dump all driver delays into a txt file. Look what fltmgr.sys does.

Share this post


Link to post
Share on other sites

Update the firmware of your OCZ AGILITY3 from 2.13 to 2.15 and try again.

If it doesn't fix it run a new trace which captures more (IO related) data:

xbootmgr -trace boot -traceFlags BASE+CSWITCH+DRIVERS+POWER+DISK_IO_INIT+FILE_IO+FILE_IO_INIT -stackwalk profile -resultPath C:\temp

zip and upload the new trace.

Share this post


Link to post
Share on other sites
gotthimself    0

I updated the firmware, but no change.

Then I started the new trace, but while booting, it shows me everytime a blue screen o.O.

Right now the error is "SYSTEM_SERVICE_EXCEPTION", sometimes it's a blue screen without a name.

Share this post


Link to post
Share on other sites
gotthimself    0

ok, new error, happend about 2 seconds after the login screen appeared: no name, but the technical information says "msrpc.sys - Address "someHEXnumber" base at "HEX"; DateStamp "HEX" "

dumps

Now the System restore..

Share this post


Link to post
Share on other sites

update the network card drivers and check the IPv6 settings and if you don't use IPv6 disable it.


ATTEMPTED_WRITE_TO_READONLY_MEMORY (be) - An attempt was made to write to readonly memory.

Child-SP RetAddr Call Site
fffff880`09967038 fffff800`02e86f57 nt!KeBugCheckEx
fffff880`09967040 fffff800`02edad6e nt! ?? ::FNODOBFM::`string'+0x442cb
fffff880`099671a0 fffff800`02ebdc25 nt!KiPageFault+0x16e
fffff880`09967338 fffff880`0185dc8a nt!RtlEnumerateEntryHashTable+0xbf
fffff880`09967340 fffff880`01603aab tcpip!Ipv6EnumerateAllPaths+0x17a
fffff880`099673f0 fffff880`06a53e29 NETIO!NsiEnumerateObjectsAllParametersEx+0x24f

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.

Child-SP RetAddr Call Site
fffff800`00b9bfe8 fffff800`02e821e9 nt!KeBugCheckEx
fffff800`00b9bff0 fffff800`02e80e60 nt!KiBugCheckDispatch+0x69
fffff800`00b9c130 fffff800`02e8f0fc nt!KiPageFault+0x260
fffff800`00b9c2c0 fffff880`018b4ae9 nt!RtlContractHashTable+0x10c
fffff800`00b9c2f0 fffff880`018b492c tcpip!IppRestructureHashTableUnderLock+0x39
fffff800`00b9c320 fffff880`018b5173 tcpip!IppPathSetTimeout+0x7d
fffff800`00b9c390 fffff880`018b5869 tcpip!IppCompartmentSetTimeout+0x63
fffff800`00b9c400 fffff800`02e8e5fc tcpip!IppTimeout+0x89
fffff800`00b9c430 fffff800`02e8e496 nt!KiProcessTimerDpcTable+0x6c

Share this post


Link to post
Share on other sites

Here is the 1minute delay:

10:34:52,0059162 System 00:00:01.1314581 0.0000013 4 RegQueryValue HKLM\System\CurrentControlSet\Control\SESSION MANAGER\MEMORY MANAGEMENT\ExistingPageFiles SUCCESS Type: REG_MULTI_SZ, Length: 42, Data: \??\D:\pagefile.sys

10:35:51,7529699 System 00:01:00.8785118 0.0000000 4 Thread Create SUCCESS Thread ID: 320

So looking for the pagefile on drive D: (WESTERN DIGITAL WD30EZRX-00MMMB0) takes 1minute and causes the fltmgr activity. It is better place the pagefile again on drive C:. Use MoveAndLink to move other files from C: to D:

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Recently Browsing   0 members

    No registered users viewing this page.

×