Author: Illiman Silve
Subject: Constant writing to WIATRACE.LOG
Posted: 07 December 2017 at 8:11pm
The writing process is System, which isn't very helpful. I've done a lot of digging on this, and the root culprit is the Windows Image Acquisition Service (STISVC), specifically the wiaservc.dll mdule. Stopping the service stops the writes.
Edited by Illiman Silve - 18 hours 32 minutes ago at 8:13pm
Subject: Constant writing to WIATRACE.LOG
Posted: 07 December 2017 at 8:11pm
The writing process is System, which isn't very helpful. I've done a lot of digging on this, and the root culprit is the Windows Image Acquisition Service (STISVC), specifically the wiaservc.dll mdule. Stopping the service stops the writes.
This is what is logged when you start STISVC. It seems to initialize fine, but goes haywire later with thousands of those SchedulerThread WAIT_TIMEOUT errors. Seems to me like a bug in the STISVC/wiaservc.dll module.
**************** Started trace for Module: [wiaservc.dll] in Executable [svchost.exe] ProcessID: [14000] at 2017/12/07 14:46:14:229 ****************
WIA: 14000.10388 0 80000000 0 [wiaservc.dll] SchedulerInitialize, Work item scheduler initialized
WIA: 14000.10388 0 0 0 [wiaservc.dll] SCMControlHandler::SCMControlHandler, Created control thread Id 22480
WIA: 14000.22480 0 0 0 [wiaservc.dll] SCMControlHandler::ControlThread, Requests queue empty, control thread entering sleep...
WIA: 14000.7420 0 0 0 [wiaservc.dll] SCMControlQueue::Push, SERVICE_CONTROL_POWEREVENT (control: 13, event type: 32787): 24 bytes
WIA: 14000.7420 0 0 0 [wiaservc.dll] SCMControlQueue::Push, Adding control request to queue (control: 13, event type: 32787)
WIA: 14000.7420 0 0 0 [wiaservc.dll] SCMControlHandler::ControlFunction, Signaling control thread to resume...
WIA: 14000.7420 0 0 0 [wiaservc.dll] SCMControlHandler::ControlFunction, Control function (control: 13, event type: 32787) returning
WIA: 14000.22480 0 0 0 [wiaservc.dll] SCMControlHandler::ControlThread, Resuming control thread...
WIA: 14000.22480 0 0 0 [wiaservc.dll] SCMControlQueue::Pop, Control request (control: 13, event type: 32787) detached from queue
WIA: 14000.22480 0 0 0 [wiaservc.dll] SCMControlHandler::ControlThread, Processing control request (control: 13, event type: 32787)...
WIA: 14000.22480 0 2 0 [wiaservc.dll] Dispatcher::ProcessEvent, System event received: dwControl 13, dwEventType 32787, lpEventData: 0x000001B5DD507270
WIA: 14000.22480 0 0 0 [wiaservc.dll] DeviceClassEnumeratorHandler::ProcessEvent, Processing system event, control code 13, event type 32787..
WIA: 14000.22480 0 0 0 [wiaservc.dll] DeviceClassEnumeratorHandler::ProcessEvent, Processing system event control code 13, event type 32787, completed with with hr 0x00000000
WIA: 14000.22480 0 2 0 [wiaservc.dll] PowerEventHandler::ProcessEvent, Message from Power Management: PBT_POWERSETTINGCHANGE
WIA: 14000.22480 0 2 0 [wiaservc.dll] PowerEventHandler::ProcessEvent, Leaving Connected Standby...
WIA: 14000.22480 0 0 0 [wiaservc.dll] DeviceListManager::InitializeWSDChallenge, WSD Challenge successfully initiated (thread: 17972)
WIA: 14000.17972 0 80000000 0 [wiaservc.dll] InitializeWSDChallenge, Intializing WSD Challenge for {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}..
WIA: 14000.17972 0 80000000 0 [wiaservc.dll] InitializeWSDChallenge, Intialize WSD Challenge...
WIA: 14000.22480 0 8 0 [wiaservc.dll] RegistryDeviceEnumerator::Refresh, An error occured in RegistryDeviceEnumerator when enumerating the subkeys for (SYSTEM\CurrentControlSet\Control\StillImage\FakeDevices)
WIA: 14000.17972 0 80000000 0 [wiaservc.dll] InitializeWSDChallenge, Load WSD Challenge DLL...
WIA: 14000.10388 0 80000000 0 [wiaservc.dll] StartFactories, StartFactories, Success
WIA: 14000.22480 0 80000000 0 [wiaservc.dll] DeviceListManager::isInList, Device ({6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0000) was not found in the device list
WIA: 14000.22480 0 8 0 [wiaservc.dll] DeviceInfoSet::GetDeviceStatus, DevNode status for device ({6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0000): 0x0180600A, problem number: 0
WIA: 14000.22480 0 8 0 [wiaservc.dll] DeviceInfoSet::MapCMStatusToDeviceState, DN_STARTED (0x00000008)
WIA: 14000.22480 0 80000000 0 [wiaservc.dll] DeviceListManager::Enumerate, The DeviceListManager is done enumerating devices
WIA: 14000.22480 0 8 0 [wiaservc.dll] DeviceListManager::LoadUnloadDrivers, Pending operation on device ({6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0000)
WIA: 14000.10388 0 8 0 [wiaservc.dll] RegistryDeviceEnumerator::Refresh, An error occured in RegistryDeviceEnumerator when enumerating the subkeys for (SYSTEM\CurrentControlSet\Control\StillImage\FakeDevices)
WIA: 14000.10388 0 0 0 [wiaservc.dll] USDWrapper::RefreshSettings, Refreshing USDWrapper settings for (fi-5530C2dj)
WIA: 14000.10388 16 0 0 [wiaservc.dll] USDWrapper::RefreshSettings, Updating the current settings for (fi-5530C2dj) from Registry
WIA: 14000.10388 16 0 0 [wiaservc.dll] USDWrapper::RefreshSettings, (fi-5530C2dj) is a WIA device (internal type: 0x00000031)
WIA: 14000.10388 16 8 0 [wiaservc.dll] DeviceInfoSet::GetDeviceStatus, DevNode status for device ({6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0000): 0x0180600A, problem number: 0
WIA: 14000.10388 16 8 0 [wiaservc.dll] DeviceInfoSet::MapCMStatusToDeviceState, DN_STARTED (0x00000008)
WIA: 14000.10388 16 4 0 [wiaservc.dll] USDWrapper::RefreshSettings, Device state for (fi-5530C2dj) remains 0x00000004
WIA: 14000.10388 16 4 0 [wiaservc.dll] USDWrapper::RefreshSettings, Device state 0x00000001 means 'disabled', 0x00000002 'removed', 0x00000004 'active'
WIA: 14000.10388 16 4 0 [wiaservc.dll] USDWrapper::RefreshSettings, Previous PnP identifier of (fi-5530C2dj): \\?\usb#vid_04c5&pid_114a#5&2511d38f&1&5#{6bdd1fc6-810f-11d0-bec7-08002be2092f}
WIA: 14000.10388 16 4 0 [wiaservc.dll] USDWrapper::RefreshSettings, New PnP identifier for (fi-5530C2dj): \\?\usb#vid_04c5&pid_114a#5&2511d38f&1&5#{6bdd1fc6-810f-11d0-bec7-08002be2092f}
WIA: 14000.10388 16 0 0 [wiaservc.dll] DeviceListManager::GetDevicesFromEnumerator, DEV_MAN_ENUM_FLAG_STARTUP for device ({6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0000) (fi-5530C2dj)
WIA: 14000.10388 16 0 0 [wiaservc.dll] DeviceListManager::GetDevicesFromEnumerator, WRAPPER_FLAGS_THROW_DISCONNECT set for device ({6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0000)
WIA: 14000.10388 16 80000000 0 [wiaservc.dll] DeviceListManager::Enumerate, The DeviceListManager is done enumerating devices
WIA: 14000.10388 16 8 0 [wiaservc.dll] DeviceListManager::DeviceCallback, The device (fi-5530C2dj) seems to be active - its driver can be used
WIA: 14000.22480 16 0 0 [wiaservc.dll] USDWrapper::RefreshSettings, Refreshing USDWrapper settings for (fi-5530C2dj)
WIA: 14000.22480 16 0 0 [wiaservc.dll] USDWrapper::RefreshSettings, Updating the current settings for (fi-5530C2dj) from Registry
WIA: 14000.22480 16 0 0 [wiaservc.dll] USDWrapper::RefreshSettings, (fi-5530C2dj) is a WIA device (internal type: 0x00000031)
WIA: 14000.22480 16 8 0 [wiaservc.dll] DeviceInfoSet::GetDeviceStatus, DevNode status for device ({6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0000): 0x0180600A, problem number: 0
WIA: 14000.22480 16 8 0 [wiaservc.dll] DeviceInfoSet::MapCMStatusToDeviceState, DN_STARTED (0x00000008)
WIA: 14000.22480 16 4 0 [wiaservc.dll] USDWrapper::RefreshSettings, Device state for (fi-5530C2dj) remains 0x00000004
WIA: 14000.22480 16 4 0 [wiaservc.dll] USDWrapper::RefreshSettings, Device state 0x00000001 means 'disabled', 0x00000002 'removed', 0x00000004 'active'
WIA: 14000.22480 16 4 0 [wiaservc.dll] USDWrapper::RefreshSettings, Previous PnP identifier of (fi-5530C2dj): \\?\usb#vid_04c5&pid_114a#5&2511d38f&1&5#{6bdd1fc6-810f-11d0-bec7-08002be2092f}
WIA: 14000.22480 16 4 0 [wiaservc.dll] USDWrapper::RefreshSettings, New PnP identifier for (fi-5530C2dj): \\?\usb#vid_04c5&pid_114a#5&2511d38f&1&5#{6bdd1fc6-810f-11d0-bec7-08002be2092f}
WIA: 14000.22480 16 8 0 [wiaservc.dll] DeviceListManager::ProcessDeviceArrival, Device (fi-5530C2dj) state is currently marked 0x00000004
WIA: 14000.22480 16 8 0 [wiaservc.dll] DeviceListManager::ProcessDeviceArrival, Device (fi-5530C2dj) (re)signaled as arrived..
WIA: 14000.22480 16 8 0 [wiaservc.dll] DeviceListManager::ProcessDeviceArrival, Attempting to (re)load the driver for device (fi-5530C2dj)..
WIA: 14000.22480 16 8 0 [wiaservc.dll] DeviceListManager::ProcessDeviceArrival, PnP Id: \\?\usb#vid_04c5&pid_114a#5&2511d38f&1&5#{6bdd1fc6-810f-11d0-bec7-08002be2092f}
WIA: 14000.10388 16 0 0 [wiaservc.dll] USDWrapper::STI_Initialize, (fi-5530C2dj) completed IStiUSD::Initialize returning hr 0x00000000
WIA: 14000.10388 16 0 0 [wiaservc.dll] USDWrapper::STI_GetCapabilities, (fi-5530C2dj) completed IStiUSD::GetCapabilities returning hr 0x00000000
WIA: 14000.10388 16 0 0 [wiaservc.dll] USDWrapper::StartDeviceNotifications, The device (fi-5530C2dj) appears to support device notifications
WIA: 14000.10388 16 0 0 [wiaservc.dll] StiLockMgr::CreateLockInfo, StiLockMgr::CreateLockInfo, Lock holding time set to 0 for device {6BDD1FC6-810F-11D0-BEC7-08002BE2092F}\0000
WIA: 14000.10388 16 0 0 [wiaservc.dll] USDWrapper::StartDeviceNotifications, DeviceEvent [0x0] for (fi-5530C2dj) reset to be scheduled
WIA: 14000.10388 16 0 0 [wiaservc.dll] USDWrapper::StartDeviceNotifications, Started receiving notifications for device (fi-5530C2dj)
WIA: 14000.23936 16 0 0 [wiaservc.dll] SchedulerThread, SchedulerThread after calling WaitForMultipleObjects deErr = 0x00000000
WIA: 14000.22480 16 4 0 [wiaservc.dll] USDWrapper::LoadDriver, Unloading driver for (fi-5530C2dj) to reload
WIA: 14000.22480 16 0 0 [wiaservc.dll] USDWrapper::UnloadDriver, The WIA service is preparing to unload the driver for (fi-5530C2dj)
[continued]
Edited by Illiman Silve - 18 hours 32 minutes ago at 8:13pm