Large variations in startup time 2

[Bocaire]

I have a strange situation, where the boot time varies greatly in my new high end machine, which I completed a month or so ago. There is a large variation in startup time between successive bootups.

The key parts in the machine are

AMD Athlon 64 bit dual core 4400 CPU
Asus A8N-32 Deluxe mobo
Four 400 GB internal SATA hard drives
Two Plextor 716A optical drives 2GB of RAM
Antec P180 case, and 550 watt AntecTP power supply
EVGA nvidia GeForce GT 256 MB
Windows XP Pro - latest SP installed
And of course, all the usual bells and whistles

The startup time varies from slightly over a minute, to as much as three minutes. I never know what to expect on bootup.

Shutwown time is consistently quite fast - no real variations.

There are no anomalies that show. The system runs normally, after any bootup. And it is greased lighting. I can copy files between drives at a rate of about 3 GB per minute.

At first, I thought it might be that the indexing service was running, but I checked, and it was not. I do have lots of USB hardware installed. And there are of course lots of software programs in the startup sequence.

I also do have a fair number of security and spyware programs installed, such that I'd expect some delays due to their activities. But I'd think that the startup times would be consistent.

Anyone have any suggestions to track down this large variation in startup times?

Bocaire

 

[BadBigBen]

actually I got several...

1.) When XP boots it looks for an IP adress for the NICs installed, if they are set to dynamic, actually looking for a Network to connect to and then assigns an IP adress... set IP adress of the NICs to a static adress and booting is faster, as XP does not have to look for a network...

2.) When the option to Search for Network Drives is active, it will do so and try to find these, even if they do not exist... turn this off if you are not on a network...

3.) WIA, Windows Imaging Assistant, Service looks for Digital Cameras, Scanners and the like, to bind them into the OS... Setting the Service to Manual, leaves the functionality of said service intact, but will skip this search...

4.) check what programms are autostarting and eliminate those that are not necessary, ie. QT Tray etc...


Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[Bocaire]

Hi BigBadBen,

Thanks for the info.

What I still don't comprehend is why one boot can take 70 seconds, and the next couple can take 3 minutes, even when done sequentially.

I seem to recall that one could boot up and skip the startup items by holding down the SHIFT key during boot, or something like that.

Is there a procedure to do this without going into MSCONFIG, and unchecking everything? I know SAFE MODE will leave them out, but booting into SAFE mode is not what I want to try.

Bocaire

 

[BadBigBen]

What I still don't comprehend is why one boot can take 70 seconds, and the next couple can take 3 minutes, even when done sequentially.

This depends on the Network Settings and look ups... sometimes they are fast other times it is slow...

I seem to recall that one could boot up and skip the startup items by holding down the SHIFT key during boot, or something like that.

Is there a procedure to do this without going into MSCONFIG, and unchecking everything? I know SAFE MODE will leave them out, but booting into SAFE mode is not what I want to try.

I am not sure, myself, but using MSCONFIG is a start, as you can set it to deactivate various startup progs and at next boot they will not start...

my startup programs, are only what is necessary... ie. AntiVirus, TeaTimer, Nero Filter Check, and certain Services needed... and my startup time is consistently at around a min. or so...

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[linney]

Do you have any scripts, programs, etc. in scheduled tasks that run at various times?

If you can still get a copy of the old bootvis tool (not to optimize the bootup times, XP doesn't need that), but to use the part that provides a graph output of the time it takes drivers and processes to load.

You might find links to it on Google, or here.

http://www.xptuneup.com/xptuneup_bootvis.htm

http://download.microsoft.com/download/whistler/BVT/1.0/WXP/EN-US/BootVis_file.exe

 

[Bocaire]

Hi Linney,

Thaks for the bootvis tip.

I ended up using Google to find bootvis, and have downloaded a copy of it.

I'll give it a whirl, and see what happens.

Bocaire

 

[Bocaire]

Hi BigBadBen,

I have a variety of utilities where I can operate on startup items - the best of them is probably WinPatrol.

I'll continue to do searching in there, and playing around to try and pinpoint the source of things.

There are no scripts that I know of. But it is possible that one or more of my "security" programs does scans or the like, without my knowledge.

Bocaire

 

[BadBigBen]

I could also suggest a HiJackThis LOG and Post it here, that way we can see what starts at boot time, and side benefit, if you are infected with something, we can tell ya what where and how to get rid off it...

http://www.majorgeeks.com/download3155.html

Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[Bocaire]

Hi Ben,

That's a good thought. I already have HiJackThis in my arsenal, and I'll give it a run.

I've already scanned all drives in the system with 5 different spyware/malware programs, including Spyware Doctor, and there were zero items spotted. I also use WinPatrol to keep on eye on things.

I'll run HiJackThis, and post the report. It's always possible that something is still lurking in the background.

Bocaire

 

[Bocaire]

Hi Ben,

I have the HijackThis log file. It is pasted in below. I hope I'm not chastised for a long message. But I'd assume that attachments are not allowed, or probably not possible.

Please let me know if you spot anything.

Ron

+++++++++++++++++++++++++++++++++

Logfile of HijackThis v1.99.1
Scan saved at 9:19:40 AM, on 4/24/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe
C:\Program Files\WordWeb\wweb32.exe
C:\Program Files\VCOM\PowerDesk\pddlghlp.exe
C:\Program Files\Scansoft\PaperPort\SmartUI\SmartUI.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HJT\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Adobe Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRA~1\BILLPS~1\WINPAT~1\winpatrol.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmflp03\BrStDvPt.exe
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Startup: Dialog Helper.lnk = C:\Program Files\VCOM\PowerDesk\pddlghlp.exe
O4 - Startup: SmartUI.lnk = ?
O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\espmain.exe
O4 - Global Startup: PhotoCAL Startup.lnk = C:\Program Files\PANTONE COLORVISION\PhotoCAL\PhotoCAL.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

 

[linney]

Your logs seems pretty clear, but like you said, you do have a lot of processes starting at Startup.

 

[Bocaire]

Hi Linney,

Yes, there are a lot of startup processes. So I wouldn't expect a great boot time. But, it does bug me that the extra 2 minutes show up so often. And, the log I presented here was after the "long" bootup time. So, the "culprit had to be in there.

The extra time occurs between the Windows screen with the progress bar, and the "welcome" screen.

Am I correct in assuming that I can uncheck everything in the msconfig window, since all those items appear to be discretionary, and not critical to Windows itself?

If I can determine that the "problem" is in there, it would make it an easy matter to find it.

Bocaire

 

[linney]

Look at MsConfig. Windows will not allow you to disable anything that is "Essential" so you should be OK, but I would only concentrate on the tabs, Startup, and Services (and then only non-Microsoft Services), in MsConfig.

310353 - How to Perform a Clean Boot in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310353&FR=1&PA=1&SD=HSCH

316434 - HOW TO: Perform Advanced Clean-Boot Troubleshooting in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;316434&FR=1&PA=1&SD=HSCH

310560 - How to Troubleshoot By Using the Msconfig Utility in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;310560&FR=1&PA=1&SD=HSCH

 

[Bocaire]

Thanks once again Linney. I've filed all the info on the three links, and will go over it all carefully.

Bocaire

 

[BadBigBen]

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

I agree with Linney, that your LOG is clean, but I may suggest that you disable/kill the following anyway as they are not NECESSARY:

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" (Disable/delete if you rarely use this function...)

O4 - HKLM\..\Run: [InstantAccess] C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h (do you use TEXT Bridge Often? if not or not at all, KILL this)

O4 - Startup: Dialog Helper.lnk = C:\Program Files\VCOM\PowerDesk\pddlghlp.exe (unnecessary)

O4 - Startup: SmartUI.lnk = ? (Unnecessary!!)

And the rest of Linney's suggestions are very sound... although I would kinda disagree on the Services part, as there are some services that MS starts that are unnecessary for a Workstation and some that are also a security threat aswell...





Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."

 

[Bocaire]

Hi Ben,

Thanks for all the info. Several of the itesm you suggested disabling were previously disabled, but I enabled them before running the test, just to show them in the report.

The first two items, which preceded your suggestion to disable stuff are of course two items related to my nVidia based video card. It wan't clear whether you were suggesting they be disabled also?

By the way, one of my "security" software programs, SPYWARE DOCTOR, seems like a good addition to my arsenal. Since I added it in, all my scans for malware et al, using any of my security programs come up clean.

And, WINPATROL PLUS is an excellent program for giving users detailed ino on exactly what all the items in MSCONFIG are.

Thanks again for your help.

Bocaire

 

[BadBigBen]

Yes, I know that those two items listed are for the nVidia GFX card, they where supposed to follow the the first instruction... (Teach me to not proof read... LOL)...

and they are not necessary for operation of the said card, one is the TRAY ICON (second one) and the first just ignore it, and leave that one...

I use several other programs aswell, when it comes to the Registry and Autostart Programms, ie. RegCleaner 4.3 (OLD, but on a quick view I can see what has installed itself since last view), for cleaning the registry I use RegHealer...

Antispyware wise: Ewido, SpyBot S&D, AdAware, and to back it up with SpySweeper... AntiVirus I use either AntiVir or BitDefender (at Present) both good freeware versions... I do a once in awhile sweep for RootKits... and do have Kerio Firewall installed...



Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."