Trace Windows 7 boot/shutdown/hibernate/standby/resume issues

[MagicAndre1981]

look at the process lifetime graph and you see the Autochk.exe runs. So it checks the disk for errors. run chkdsk for all HDD and check the SMART values.

[gotthimself]

chkdsk didn't find any errors on all drives and smart didn't either. I run the boot trace a second time and the autochk.exe disappeared, but the fltmgr.sys was still running the exact same time.

[MagicAndre1981]

Run xperf -i boot_BASE+CSWITCH+DRIVERS+POWER_1.etl -o Driverdelay.txt -a drvdelay to dump all driver delays into a txt file. Look what fltmgr.sys does.

[gotthimself]

It looks like fltmgr.sys scans my whole c-drive, I can't tell.

I extracted every line with fltmgr.sys, maybe it make sense to you.

link

[MagicAndre1981]

Can you please zip the ETL and upload it?

[gotthimself]

ETL file

[MagicAndre1981]

Update the firmware of your OCZ AGILITY3 from 2.13 to 2.15 and try again.

If it doesn't fix it run a new trace which captures more (IO related) data:

xbootmgr -trace boot -traceFlags BASE+CSWITCH+DRIVERS+POWER+DISK_IO_INIT+FILE_IO+FILE_IO_INIT -stackwalk profile -resultPath C:\temp

zip and upload the new trace.

[gotthimself]

I updated the firmware, but no change.

Then I started the new trace, but while booting, it shows me everytime a blue screen o.O.

Right now the error is "SYSTEM_SERVICE_EXCEPTION", sometimes it's a blue screen without a name.

[MagicAndre1981]

can you get the dumps and share them? Have you tried to restore Windows with the System restore?

[gotthimself]

ok, new error, happend about 2 seconds after the login screen appeared: no name, but the technical information says "msrpc.sys - Address "someHEXnumber" base at "HEX"; DateStamp "HEX" "

dumps

Now the System restore..

[MagicAndre1981]

update the network card drivers and check the IPv6 settings and if you don't use IPv6 disable it.

ATTEMPTED_WRITE_TO_READONLY_MEMORY (be) - An attempt was made to write to readonly memory.

Child-SP          RetAddr           Call Site
fffff880`09967038 fffff800`02e86f57 nt!KeBugCheckEx
fffff880`09967040 fffff800`02edad6e nt! ?? ::FNODOBFM::`string'+0x442cb
fffff880`099671a0 fffff800`02ebdc25 nt!KiPageFault+0x16e
fffff880`09967338 fffff880`0185dc8a nt!RtlEnumerateEntryHashTable+0xbf
fffff880`09967340 fffff880`01603aab tcpip!Ipv6EnumerateAllPaths+0x17a
fffff880`099673f0 fffff880`06a53e29 NETIO!NsiEnumerateObjectsAllParametersEx+0x24f

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.

Child-SP          RetAddr           Call Site
fffff800`00b9bfe8 fffff800`02e821e9 nt!KeBugCheckEx
fffff800`00b9bff0 fffff800`02e80e60 nt!KiBugCheckDispatch+0x69
fffff800`00b9c130 fffff800`02e8f0fc nt!KiPageFault+0x260
fffff800`00b9c2c0 fffff880`018b4ae9 nt!RtlContractHashTable+0x10c
fffff800`00b9c2f0 fffff880`018b492c tcpip!IppRestructureHashTableUnderLock+0x39
fffff800`00b9c320 fffff880`018b5173 tcpip!IppPathSetTimeout+0x7d
fffff800`00b9c390 fffff880`018b5869 tcpip!IppCompartmentSetTimeout+0x63
fffff800`00b9c400 fffff800`02e8e5fc tcpip!IppTimeout+0x89
fffff800`00b9c430 fffff800`02e8e496 nt!KiProcessTimerDpcTable+0x6c

[gotthimself]

I could only boot in safe mode without network drivers, everything else started the bluescreen. After restarting normally, it worked again and the boot trace save option popped up. IPv& is now deactivated.

new trace

[MagicAndre1981]

this also shows me the cause

Run Process Monitor and activate boot logging. reboot and run ProcMon again, save the log, zip it and upload it.

[gotthimself]

log

[MagicAndre1981]

Here is the 1minute delay:

10:34:52,0059162 System 00:00:01.1314581 0.0000013 4 RegQueryValue HKLM\System\CurrentControlSet\Control\SESSION MANAGER\MEMORY MANAGEMENT\ExistingPageFiles SUCCESS Type: REG_MULTI_SZ, Length: 42, Data: \??\D:\pagefile.sys

10:35:51,7529699 System 00:01:00.8785118 0.0000000 4 Thread Create SUCCESS Thread ID: 320

So looking for the pagefile on drive D: (WESTERN DIGITAL WD30EZRX-00MMMB0) takes 1minute and causes the fltmgr activity. It is better place the pagefile again on drive C:. Use MoveAndLink to move other files from C: to D: