Tracking startup

[tfstom]

I have 2 Win2K machines where one starts up right away and the other takes a while. It also periodically takes a while to do certain things (that other times work real fast). For example, when trying to open my Windows Explorer window, sometimes it takes about 15 seconds to open the window and when drilling down into my C drive to see the folders (from the folders window), it sometimes sits there for about 15-20 seconds before a it displays the folders.

I am trying to see what is getting loaded at startup and also I want to see how long it took to start each program or service up. Is there a way to do this?

Thanks,

Tom.

 

[wolluf]

http://www.mlin.net/StartupCPL.shtml

will let you see (and amend) what's being loaded at startup.

I don't know if using the /bootlog option on the the boot.ini entry will produce the other info or not (I've never used it) -

http://www.microsoft.com/technet/tr...prodtechnol/winxppro/reskit/prmc_str_masc.asp

might be helpful.

http://www.sysinternals.com

do a freeware utility called regmon, which you can configure to record registry access at startup (but again, no idea if this would be useful - can be a bit overwhelming!)

 

[DisIzMe]

Are both machines equal in memory and have you recently defragged your hard drive? CTRL-ALT-DEL and then click on "Task Manager" to see running processes and to see how you're using the memory. Unless you have Norton Utilities, Click "Start", "Programs", "Accessories", "System Tools" and then "Disk Defragmenter" to check disk fragmentation.

Hope this helps. Good Luck!

 

[tfstom]

I had tried defragmenting the disk and the machine has 384MB of memory (I recently added 256MB).

Still does the same thing.

 

[wolluf]

So you've checked startup apps - and disabled them to see if that has any impact? checked task manager when you have a slowdown to see if any resource hogs? Have you possibly any unnecessary services running? Has this machine always been like this? (if not, when did it start/what happened to machine just before that). Looked in event viewer to see if anything untoward happening behind the scenes? Checked device manager for any problems with drivers/conflicts? Is the networking connection ok?

 

[DisIzMe]

Ditto to Wolluf's suggestions.

 

[tfstom]

I did look in the event manager and found 2 questions.

I found:

The Computer Browser service terminated with service-specific error 2550.

Not sure what to do about this or why it is happening.

I also found:

The description for Event ID ( 0 ) in Source ( XtreamLok License Manager ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. The following information is part of the event: Service started.

Not sure what XtreamLok License Manager is or what is expecting it to be there. The event log doesn't tell me, but it seems to have started anyway, according to this message.

I get these errors once a day.

I have had these problems for a long time. One of the differences between the 2 machines is that the one I am having problem with was originally a WinNT 4.0 machine and the other was not. I have been trying to find out if there is any remnants of the old OS that is causing me the problems. They aren't bad problems, more like irritants that I would like to solve.

I found a problem in Device manager with a question mark that says it's a Mass Storage Device:

******************************************************
The drivers for this device are not installed. (Code 28)

To reinstall the drivers for this device, click Reinstall Driver.
********************************************************

Not sure what this is. I assume it has something to do with my Asus A7v 133 board, but can't figure it out.

Thanks,

Tom.

 

[bcastner]

. Computer Browser errror. You can ignore this. Someone has set your computer to NOT become a Master Browser.

The process to disable NT Master Browsing under Windows 2000:

1. In HK_LM\System\CCS\Services\Browser\Parameters: Change the "MaintainServerList" value to "No"
2. Set the "Computer Browser" service to "Manual" or "Disabled" and stop the service. Note: If the service is restarted, it will give an error stating that error 2550 has occured. Error 2550 states that the service
will be disabled because the MaintainServerList parameter was set to No.

. xTremelok is a software protetion scheme to prevent reverse engineering of protect applications. It requires multiple ports to be open so that it can contact a remote license manager. See:

http://www.softwrap.com/faq2.asp

. Your Mass Storage Device is likely an old USB connection, including the possible insertion of a Pen Drive some time ago.

There is no question each of these error states will take time on boot.

 

[tfstom]

My MaintainServerList is already set to no - so I assume that is not what is causing the problem.

The question is what would be using xtremelok, that is getting the error?

Thanks,

Tom.

 

[tfstom]

Sorry, I misread the post. I missed the top line and thought you were telling me to set it to NO. As you sumized and I mentioned - it was set to no. I will turn of the browser service to handle that problem.

Thanks,

Tom.

 

[bcastner]

"The question is what would be using xtremelok, that is getting the error?"

If you post a Hijack This log we can probably make a good guess for you.

http://mjc1.com/mirror/hjt/

Sorry for any confusion on the Computer Browser setting.

 

[tfstom]

No problem, the confusion was all mine. It was very clear, just missed it.

Here is the list I got hijackthis:

Logfile of HijackThis v1.97.7
Scan saved at 3:32:30 PM, on 1/22/2004
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\tcpsvcs.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSAC-FD1\MSSTAT.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\WINNT\System32\xl.exe
C:\downloads\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.firewall.cx/

N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src" (C:\Documents and Settings\tfs\Application Data\Mozilla\Profiles\default\c0nknqr8.slt\prefs.js)
O1 - Hosts: 127.0.0.5 localhost
O1 - Hosts: 65.115.36.13

http://www4.travac.com

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Memory Stick Monitor.lnk = C:\Program Files\MSAC-FD1\MSSTAT.EXE
O12 - Plugin for .bcf: C:\Program Files\Internet Explorer\Plugins\NPBelv32.dll
O16 - DPF: {156731E1-D652-11D1-BE03-00A0C9111212} (ATLSBNCheck Class) -

http://msdn.microsoft.com/downloads/samples/internet/sbncheck.cab

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -

http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

O16 - DPF: {71307BE5-F86A-4B01-9218-A23099754531} (Dollstub Class) -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37853.9419560185

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) -

http://prolifics.webex.com/client/latest/webex/ieatgpc.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{3F64EE2F-2622-4C96-AA42-6E7365547435}: NameServer = 66.51.205.100,66.51.206.100,24.1.160.34
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = irvn1.occa.home
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = irvn1.occa.home
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = irvn1.occa.home


Thanks for the help,

Tom.

 

[tfstom]

Also, as I mentioned earlier I get the following problem from the Device manager:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
I found a problem in Device manager with a question mark that says it's a Mass Storage Device:

******************************************************
The drivers for this device are not installed. (Code 28)

To reinstall the drivers for this device, click Reinstall Driver.
********************************************************

Not sure what this is. I assume it has something to do with my Asus A7v 133 board.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

The location in the properties window is:

PCI bus 0, device 17, function 0

Not sure what this location means as the only thing on my PCI bus is my NIC card and Monitor card - both work fine.

If I try to reload the driver from this screen, it tries to find a driver from windows update, but says it can't find a compatible driver and if I tell it to display a list of known drivers for this device, it just lists every possible type of device. No way to tell what type of device it is talking about.

Bcastner said something about it being a USB device that is no longer there, but the only device I have, or have ever had, is a "Logitech QuickCam Express" and that driver is showing fine in the Device menu.

Thanks,

Tom.