Networks

Ask something
Question Locked

Slow XP Home start-up

0 helpful
29 replies

by sc tom

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm running XP Home SP2 with all the current updates on a Presario w/AMD 3000+, 1GB RAM, and 150GB SATA drive. Lately (the last week or so), it has been taking a long time for XP to start up. From the Welcome screen to my desktop displaying is 30 seconds, which is more or less acceptable. But from the time my desktop shows to the time I can actually do anything is 2 minutes! To me, that is less than acceptable. I'm not on a business network, just a local user with internet through my cable company, so it's not like I'm running a server login script.
During the time after the desktop is showing, I can bring up task manager and see that very few processes are running, but also that there is no one listed under the Users tab. It just seems to take that long for me to log in. I've tried clearing my prefetch folder, increasing/decreasing virtual memory, and a few other things, but no joy. I've run Zone Alarm (latest updates installed on it, too), SpyBot, and AdAware, but they find nothing. Under system properties, I see my user profile is 1.6GB. Is that inordinately large, and if so, how do I pare it down?
I tried doing a system restore to 2 weeks ago, but that didn't help either.

Thanks for any advice or help you can give. Sorry for the long-ish post.

Tom

29 replies

by rob miners

Open explorer
goto Tools, Folder Options, View. Select Show hidden files and folders. Untick Hide extensions for known file types. Untick Hide protected operating system files.

Take note of free space on C: Drive.

Navigate to these Folders and Delete the contents. Delete the Contents Not the Folders.

C:\Documents and Settings\"UserAccount"\Local Settings\Temp

C:\Documents and Settings\"UserAccount"\Local Settings\Temporary Internet Files

C:\WINDOWS\Temp

Take note of free space on C: Drive.

Check size of profile!

Check the contents of c: Drive. There should be only about 10 files. Is there a lot of files with the same extension. EG:"filename.smp"?

Download ClamWin Portable, Install it to a folder. Run it and update it. Restart the PC in Safe Mode and run ClamWin.

Let us know how you get on.
Rob

by sc tom

I cleared all the files as suggested, and check the file status in the root C:. That got the profile size reduced from 1.6GB to 1.58GB. I had a corresponding amount of savings on the C: drive.
ClamWin is still running (4 hours now) and hasn't found anything, or at least hasn't shown anything in the window as far as viruses go. I ran ZoneAlarm virus scan Friday with no results, either, so I'm not expecting ClamWin to find anything.
I'll keep you updated.
Thanks,
Tom

by sc tom

. . .finally!!
It found no problems, and my problem remains the same.
Just for grins 'n' giggle, I tried booting up with my cable modem unplugged from my PC, but that didn't help either. Boot times remain painfully slow. I've cleared all unnecessary start-up files, including my firewall and virus protection, using MSCONFIG, but that had no effect either. I'm really stumped on this one!
Thanks,
Tom

by rob miners

Defragment the HD.
Run dskchk c: /r
Download and run these progs.

CCleaner
Hijackthis and save a log file
CWShredder
I use RegMechanic which unfortunatly isnt free but there are free ones out there.
Try and find a RootKit revealer. The one i got from Sysinternals dosen't appear to be there anymore.

Keep us posted

by sc tom

I ran defrag and chkdsk the other day after all this started.
I ran CCleaner and cleaned everything it found.
CWShredder found nothing.
RootkitRevealer found nothing untoward.
Here's the log from HijackThis:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 8:52:30 PM, on 4/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\windows\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\windows\system32\spoolsv.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\windows\system32\nvsvc32.exe
C:\windows\System32\svchost.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\windows\system32\rundll32.exe
C:\windows\system32\ctfmon.exe
C:\windows\system32\taskmgr.exe
C:\Tempo\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Exploder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1092946061500
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\System32\browseui.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\windows\system32\CTsvcCDA.EXE (file missing)
O23 - Service: GUMXM - Sysinternals - www.sysinternals.com - c:\filetemp\GUMXM.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NsEngine - Unknown owner - C:\Program Files\NovaStor\NovaBACKUP\NSENGINE.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 8052 bytes

I use Norton Windoctor for the registry, and it hasn't found anything, either.

Thanks,
Tom

by rob miners

like you've got that bloody winfixer.
Symantec have a removal tool called fixvundo.exe

Download and follow the instructions.

Rob

by mickspring

How many antivirus & spyware programs are you running? Stick with 1 reputable antivirus prog and 1 spyware prog. Too many WILL slow your PC + you can always do an online scan if you don't trust your current one. While you are in 'add/remove programs' check out any dodgy looking programs and remove.

Goodluck

by langlier

In addition to the above it looks like you may be running Norton and Zone Alarm. If you are running the Norton Antivirus alone (not the full internet security suite) and the Zone Alarm firewall alone (again not the suite) then this should be no big deal. But if you are running either suite this can cause a major slowdown on top of internet issues.

there is a program called hitman pro 2 (www.hitmanpro2.nl) that I highly recommend for spyware/malware issues. It downloads the popular antispyware freeware programs (spybot, adaware, etc) as well as thier updates then cleans. This will get pretty much any of the nastier spyware out there. I didnt see too many problems with your log other then that.

To help speed up the boot time you may be interested in turning off some unneeded services. I'm not a big fan of the guys practices but www.blackviper.com has a decent guide to telling you what services are and why they may not be necessary. I don't recommend using MSConfig to turn off anything permanently but it can help you find offending sludge programs.

by sc tom

I only run one normally (Zone Alarm Security Suite), and have had great success with it. Since it didn't seem to find anything on the last couple of scans I did since this problem started, I thought I'd try Spybot and AdAware again- I've had good success with them in the past. As soon as I get this all figured out, I'll be removing them again and sticking with ZA.
I go through my add/remove programs fairly regularly just to clear off stuff I haven't used in a while, and to look for stuff I don't recognize. The only things there now are programs I recognize.
As soon as I get off from work, I'll run the FixVundo tool and see what kind of success I have with that.
Thanks,
Tom

by langlier

since you are only running zone alarm security suite and have norton remnants around I recommend running the norton removal tool (symnrt.exe). You can download this from a number of sites as well as symantec.com.

by bdeye51

Just in case - Remove yahoo messenger from your start-up

by sc tom

Well, I ran FixVundo and it found nothing. I did a search at work and found the reg keys that WinFixer writes, and I have none of them either. I changed out my NIC with another one that I had (hey, I'll try anything at this point!) and that had no effect. I have no viruses, trojans, spyware, or anything else I shouldn't have according to all the programs I've run. I don't know where to go from here- I certainly don't want to re-install XP and all that's involved with that, and I'm not ready to upgrade to Vista. I'm afraid I'd have the same problems with it if I can't figure out what's going on now.
Thanks for everyone's ideas and help. If you think of anything else, please post.
Thanks again,
Tom

by mickspring

Have you recently installed hardware? Are their any exclamations in device manager? Is Windows trying to load hardware?

by sc tom

That's the real puzzler. I have installed no new hardware, software, or any updates (other than MS auto-update) in at least a month. DM is clean, and I receive no notice of any hardware or device drivers being loaded.

Thanks,
SC Tom

by langlier

If you are still having issues could I get you to download Hijack This! and post a log of its findings here?

I may have other suggestions based on its findings.

by sc tom

Here's the HJT log:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 4:49:49 PM, on 5/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\windows\Explorer.EXE
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\windows\system32\spoolsv.exe
C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
C:\windows\system32\nvsvc32.exe
C:\windows\System32\svchost.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\windows\system32\ctfmon.exe
C:\windows\system32\rundll32.exe
C:\Tempo\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Exploder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Spybot\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://files.ea.com/downloads/rtpatch/v2/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1092946061500
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\windows\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\windows\System32\browseui.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\windows\system32\CTsvcCDA.EXE (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NsEngine - Unknown owner - C:\Program Files\NovaStor\NovaBACKUP\NSENGINE.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 7879 bytes

(I deleted the bootlog file- it's way too big and not near as easy to read as the graph)

This really makes for a long reply! Sorry!

Thanks for all the help,
Tom

by langlier

ok well heres a quick list of things to do

fix these

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

in hijack this

uninstall java in add/remove programs then go to www.java.com and reinstall 5u11

From the looks you have norton systemworks? if so I recommend you uninstall Norton Goback if it is installed. If you find that you dont use anything from the symantec systemworks package then i recommend first uninstalling everything (including liveupdate) and if you get any errors then run symnrt.exe (you can get it from symantec.com i'll direct link you if need be because its kind of a pain to find).

Novastar backup... is this a wanted/needed service? if not i recommend removing the program because its kind of a resource hog.

by rob miners

you disabled system restore? If you havent any Malaware or Virus could still be lurking.
Download this script and run it. Post it back here remembering to remove anything that might disclose your identity.

http://www.silentrunners.org/

Rob

by sc tom

I ran HJT and fixed the items you listed, uninstalled all Java and installed 6.1 (the latest).
The only Norton product that is still installed is Windoctor- it's a good registry fixer (or has been for me). GoBack hasn't ever been installed on this HDD. Live Update is gone, also.
I uninstalled NovaStor even though the service never ran unless I manually started it. Hadn't used it in a while, so I got rid of it. I used Windows Backup last (too long ago. . .my bust).
My start time has lessened by about 20-30 seconds- still no where near as fast as it was 2 weeks ago.

Thanks,
Tom

Note to rrjmin0: System restore has been turned off since I first started troubleshooting this. Thanks.

by rob miners

looks like fixvundo achieved something.

Comparing files HJT1.txt and HJT2.TXT
***** HJT1.txt
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 8:52:30 PM, on 4/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
***** HJT2.TXT
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 4:49:49 PM, on 5/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
*****

***** HJT1.txt
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\windows\system32\rundll32.exe
C:\windows\system32\ctfmon.exe
C:\windows\system32\taskmgr.exe
C:\Tempo\HiJackThis_v2.exe
***** HJT2.TXT
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\windows\system32\ctfmon.exe
C:\windows\system32\rundll32.exe
C:\Tempo\HiJackThis_v2.exe
*****

***** HJT1.txt
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\windows\system32\CTsvcCDA.EXE (file missing)
O23 - Service: GUMXM - Sysinternals - www.sysinternals.com - c:\filetemp\GUMXM.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\D
***** HJT2.TXT
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\windows\system32\CTsvcCDA.EXE (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\D
*****

How is that other log going?

by sc tom

I did everything in the first part this morning before work, and have rebooted twice with no change. I'll try the Dial-a-fix now and see what happens.

Here's the logfile from XP Bootlog. I don't know if any of you have used it, but it gives a good graph of startup times for different services, etc. I don't think I can get a BMP in this, so I saevd the short log, which is just the times. As you'll see, my start time is 190 seconds. I tried it on a similar machine at work and my start time was 66 seconds. Quite a difference. Here's the log:

Started at: 02.05.2007 16:54:27.312
C:\windows\system32\ntoskrnl.exe Start: 02.05.2007 16:54:27.312 Duration: 0 sec
System Start: 02.05.2007 16:54:30.350 Duration: 44.698 sec
D:\WINDOWS\system32\smss.exe Start: 02.05.2007 16:54:33.028 Duration: 7.057 sec
D:\WINDOWS\system32\autochk.exe Start: 02.05.2007 16:54:33.430 Duration: 0 sec
D:\WINDOWS\system32\csrss.exe Start: 02.05.2007 16:54:40.414 Duration: 3.279 sec
D:\WINDOWS\system32\winlogon.exe Start: 02.05.2007 16:54:42.606 Duration: 29.517 sec
D:\WINDOWS\system32\services.exe Start: 02.05.2007 16:54:44.466 Duration: 115.471 sec
D:\WINDOWS\system32\lsass.exe Start: 02.05.2007 16:54:44.544 Duration: 109.546 sec
D:\WINDOWS\system32\svchost.exe Start: 02.05.2007 16:54:47.388 Duration: 113.301 sec
D:\WINDOWS\system32\svchost.exe Start: 02.05.2007 16:54:48.316 Duration: 5.904 sec
D:\WINDOWS\system32\logonui.exe Start: 02.05.2007 16:54:48.624 Duration: 1.148 sec
D:\WINDOWS\system32\svchost.exe Start: 02.05.2007 16:54:48.208 Duration: 126.331 sec
D:\WINDOWS\system32\svchost.exe Start: 02.05.2007 16:54:48.652 Duration: 28.061 sec
D:\WINDOWS\system32\svchost.exe Start: 02.05.2007 16:54:49.202 Duration: 20.469 sec
D:\WINDOWS\system32\ZoneLabs\vsmon.exe Start: 02.05.2007 16:54:49.484 Duration: 117.94 sec
D:\WINDOWS\system32\userinit.exe Start: 02.05.2007 16:54:52.608 Duration: 0.14 sec
D:\WINDOWS\explorer.exe Start: 02.05.2007 16:54:52.870 Duration: 135.599 sec
D:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe Start: 02.05.2007 16:55:02.872 Duration: 6.002 sec
D:\WINDOWS\system32\spoolsv.exe Start: 02.05.2007 16:55:03.226 Duration: 5.677 sec
D:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe Start: 02.05.2007 16:55:07.268 Duration: 8.199 sec
D:\WINDOWS\system32\ZoneLabs\avsys\Monitor.exe Start: 02.05.2007 16:55:07.608 Duration: 114.19 sec
D:\WINDOWS\system32\nvsvc32.exe Start: 02.05.2007 16:55:10.556 Duration: 89.934 sec
D:\WINDOWS\system32\svchost.exe Start: 02.05.2007 16:55:11.318 Duration: 91.814 sec
D:\WINDOWS\system32\wdfmgr.exe Start: 02.05.2007 16:55:12.020 Duration: 0.07 sec
D:\WINDOWS\system32\rundll32.exe Start: 02.05.2007 16:55:16.562 Duration: 0.096 sec
D:\WINDOWS\system32\wuauclt.exe Start: 02.05.2007 16:56:02.254 Duration: 1.295 sec
D:\WINDOWS\system32\wbem\wmiprvse.exe Start: 02.05.2007 16:56:03.158 Duration: 60.337 sec
D:\WINDOWS\system32\rundll32.exe Start: 02.05.2007 16:56:40.518 Duration: 0.068 sec
D:\WINDOWS\system32\alg.exe Start: 02.05.2007 16:56:41.518 Duration: 0.147 sec
D:\hp\KBD\kbd.exe Start: 02.05.2007 16:56:49.036 Duration: 11.704 sec
D:\WINDOWS\system32\dumprep.exe Start: 02.05.2007 16:56:52.288 Duration: 0.172 sec
D:\WINDOWS\system32\imapi.exe Start: 02.05.2007 16:56:52.846 Duration: 0.354 sec
D:\WINDOWS\system32\dumprep.exe Start: 02.05.2007 16:56:52.488 Duration: 0.353 sec
D:\Program Files\Microsoft IntelliPoint\ipoint.exe Start: 02.05.2007 16:56:53.110 Duration: 8.389 sec
D:\WINDOWS\system32\rundll32.exe Start: 02.05.2007 16:56:53.306 Duration: 0.283 sec
D:\WINDOWS\system32\nwiz.exe Start: 02.05.2007 16:56:54.470 Duration: 2.925 sec
D:\WINDOWS\system32\rundll32.exe Start: 02.05.2007 16:56:54.640 Duration: 2.535 sec
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe Start: 02.05.2007 16:56:56.670 Duration: 13.898 sec
D:\WINDOWS\system32\rundll32.exe Start: 02.05.2007 16:56:58.552 Duration: 8.644 sec
D:\Program Files\Java\jre1.6.0_01\bin\jusched.exe Start: 02.05.2007 16:56:58.556 Duration: 1.16 sec
D:\WINDOWS\system32\ctfmon.exe Start: 02.05.2007 16:56:58.708 Duration: 1.716 sec
D:\WINDOWS\system32\WgaTray.exe Start: 02.05.2007 16:56:59.940 Duration: 6.157 sec
D:\BootLog XP\BootLogXP.exe Start: 02.05.2007 16:57:05.912 Duration: 32.016 sec
D:\BootLog XP\TraceLog.exe Start: 02.05.2007 16:57:37.684 Duration: 0.411 sec
Monitoring stopped at: 02.05.2007 16:57:37.508
Duration: 190.195 sec

Thanks again for your help,
Tom

by sc tom

Looks like Dial-a-Fix did it! Don't know what caused it, but I know now how to fix it! My boot time is now 87 seconds according to BootLog XP. Much, much better!

Thanks to everyone for all your help and suggestions. I'd probably still be Google'ing it if it wasn't for you all!

Thanks again,
Tom

by rob miners

your OS is split over two drives?

A copy of a clean ntbtlog.txt would help more than your last post.

What happened to the log from silent runners?

by sc tom

My OS isn't split, it's only on the C: drive. My 2nd drive is mainly for utility files and my Creative Zen music backups.

I got so tied up in the other solutions that I never got the chance to run silent runners. Sorry.

But everything's working fine now!
Thanks,
Tom

by master tech

Cleaning the Prefetch folder will actually REDUCE performance!

http://mywebpages.comcast.net/SupportCD/XPMyths.html
http://blogs.msdn.com/ryanmy/archive/2005/05/25/421882.aspx
http://www.edbott.com/weblog/archives/000743.html

Instead make sure Prefetching is working properly. Set the Task Scheduler to Automatic then:

Reboot Windows XP two times, each time wait one full minute after the desktop appears to allow Windows time to fully write to the NTOSBOOT-B00DFAAD.PF file before proceeding, then go to "Start", "Run", Type:

Rundll32.exe advapi32.dll,ProcessIdleTasks

This can take 10-15 minutes to run but no notification will be given when it is finished. You will notice increased Harddrive activity while it is running wait until this stops. When this is finished in the "Run" box Type:

defrag c: -b

and wait until the command prompt window disappears.

This discussion is closed to new replies.