XP Slow Boot (recent problem)

Over the last few weeks my XP SP3 system has become really slow to boot (nearly 4 mins). I've tried disabling pretty well everything in the system tray, even Zone Alarm and Avast - no difference. No errors in event logs but some long gaps in timings.

Problem seems to be during what ever's going on soon after power on:

Login screen displays in reasonable time, but then some disc activity continues for a while, stops and starts with long gaps then bursts of activity then quiet. If I wait until it's been quiet for a while then login my home screen appears fairly quicky. If I login as soon as the login screen is displayed I still have to wait while the disk thrashes, sleeps, thrashes as above.

Once I've logged in, if I then just log out (not restart the PC) then log back in, all goes quite quickly.

I've run Bootvis and captured the activity:




You can clearly see a long period where the cpu is 100%, but with not much else going on. On the Driver Delay graph the two drivers to the left of the gap are fltmgr.sys and XMS1563K.sys, and to the right of the gap flrmgr.sys and XMS1653K.sys again, so I'm wondering if there's a problem with one of these, or something else is stopping them loading.

Any ideas what's going on, or how I should proceed with further diagnosis?

Thanks

 

Check this out first, it's a pretty common scenario for XP.

 

Thanks for the reply Satrow.

Had a read through the page you linked to and checked the settings as described in para 5.

On both primary and secondary IDE channels all devices are set to Auto Detection and use DMA if available.

On the primary channel both devices (2 HDDs) are set to Ultra DMA Mode 5.
On the secondary channel device 0 (DVD writer) is set to Ultra DMA Mode 2 and device 1 (old CD writer - not used any more) is set to Multi Word DMA mode 2.

This all seems to be ok, so don't think this is my problem.

So where next, any ideas?

 

Just a thought because of all the disk activity.
When was your last defrag?

 

Ok, next I'd be filtering the System and Application logs in Windows Management, looking for errors logged around the time of each boot.

Actually, CCleaner does a very good job of cleaning the prefetch of all the old and uninstalled software, it doesn't remove anything currently installed and used in recent weeks, ie. the stuff you want prefetched. Even if the Prefetch had been emptied, Windows should be back up to speed within a few days of normal usage.

Careful use of Autoruns should allow you to remove many dregs that are no longer needed. WARNING: improper use of this tool WILL break Windows

 

Thanks for replies.

I have run a defrag before starting this investigation so the C drive is pretty "clean".

I haven't touched the prefetch folder, but not sure if Bootvis does anything with it - I've only run it in scan mode, not fix.

Will try uninstalling ZA and Avast as you suggest.

How safe is CCLeaner to just let it run and fix?

Having read (some) of another thread on this forum I have installed Eusing and run a scan - it's found 3449 "problems" which will take forever to work through and try and validate, but I'm a bit (lot) reluctant just to let Eusing to blast through and fix everything.

Suppose I could always take a disc image to recover from, but it might be weeks or months before problems show up and by that time the image will be pretty out of date in terms of any "data" files (eg email database).

 

Satrow, just seen your post.

I'd already emptied the event logs, then rebooted and checked the logs (after the slow boot). There are no errors in the system or application logs, and just two in the security log - which I've had forever, certainly before this recent problem.

 

I've been using CCleaner on all the PC's I've worked on for about 5 years, maybe more - since it was called Crap Cleaner; I've attached my current settings for my own PC, augmented by CCEnhancer (this requires .NET, if you don't have it already and don't wish to install it, the same functionality can be gained by using the winapp2.ini file downloadable from the CCleaner forum).

Take your time selecting the options that suit your software and usage. Use the 'Analyze' button and check what CCleaner is going to delete before running it, and always study the Registry results carefully before deleting anything - ALWAYS make the backup when prompted.

I wouldn't recommend any other Registry 'cleaner'.

Hmm, no errors/warnings in the logs? Strange. Autoruns is worth looking at, you may spot things there that aren't installed or needed - but be very careful with it.

I'd also try Puran Defrag on the boot/defrag/restart option, it should do a better job than the stock XP defragger.

 

Have now run sfc /scannow and (from safe mode) chkdsk /f - no problems reported.

Have also checked Autoruns, there's a few entries unticked (done by me ages ago), but they are for applications no longer installed, or not wanted (eg Google Updater).

Have now downloaded Puran Defrag and will run that and see what happens.

"Use the 'Analyze' button and check what CCleaner is going to delete before running it, and always study the Registry results carefully before deleting anything - ALWAYS make the backup when prompted."

- while I'm quite happy making changes to the registry given directions, I'm not conversant enough with it to really understand what's safe to delete and what's not. If I use CCleaner to delete something I shouldn't (having backed the registry up first of course), if the system won't then boot at all, how do I recover?

 

Here is a tool that may help you..
http://www.soluto.com/
"Our patent-pending low level driver technology detects when you’re frustrated by your PC and tells you which application is causing it. "
It does a very good job of telling you whats going on.

 

Based on my own use of CCleaner hundreds of times on many scores of PC's, I've only seen a problem possibly attributable to CC twice; both W98SE machines years ago and they lost the sound somehow. I've never seen a verified case of CCleaner usage alone causing Windows boot failure.

CCleaner is created to be as safe as possible, most users just blindly run it with default options, my settings are perhaps a little safer.

How would you recover from a failed boot anyway? Do you have the Recovery Console installed, an XP CD, a verified image?



Foogoo's suggestion of Soluto may be a help in diagnosing this, too.

How much free space do you have? Is your Pagefile contiguous?

Bootvis can be set to modify the Prefetch entries by changing the order that they're loaded in the .ini file, I don't think it adds/removes any entries or files though.

 

Update - some progress!

Uninstalled Zone Alarm, Avast and Genie Timeline Pro.
Used CCleaner to clean up files, and to remove some fairly obvious "old" entries from registry (left overs from above progs, plus other similar things).
Then ran Puran defrag, but esc'd from it whie it was 50% through the "filling gaps" stage.

Reboot and login, all now takes about 72 seconds (cw nearly 4 mins previously). Of course at the moment I don't have a firewall or virus checker!

Have posted the new Bootvis screen captures below if anyone's interested.

Now just need to get firewall and AV back in place and check boot time, then Genie Timeline (have a bad feeling about that one!).

I'd still like to clean up all the other registry errors found by CCleaner, may just take a disc image (to another drive, I have an Acronis boot CD) and go for broke with CCleaner, unless someone can point me in the direction where I can find out a bit more about what some of the "faulty" registry entries do eg:

ActiveX/COM issue
Application Paths Issue
Help File Issue
Installer Reference Issue
Invalid Default Icon
Invalid or Empty File Class
Missing MUI Reference
Old Start Key Menu
Open With Application Issue
Uninstaller Reference Issue

Many thanks to all you guys for your help!!!!

 

Good to see some progress

Just a quickie that you should investigate - Bootvis is reporting that disk write caching is disabled, if the PC is stable you might want to enable it, it may speed things up a little more.

 

Most of the Registry 'problems' are not - they're just like broken links, pointers to dead ends, broken/non-exsistant file associations etc. and safe to delete because they are redundant anyway.

I hope you ran the boot defrag option from Puran, it'll defrag most of the files that cannot be defragged within Windows because they're in use. Run PageDefrag once at boot time too, it should fix up a fragmented Pagefile.

ZA and Avast! both have uninstallers available from the authors, they should ensure that nothing remains of them. Then have another look through Autoruns to ensure that all 3 programs you've uninstalled are completely removed, uncheck any entries that may remain, note down the locations of any files and remove the files (or folders if they're exclusively related to the program in question) after a reboot. I think

 

Oh well - it was too good to last. :cry

Reinstalled ZA and boot up went out to over 2 1/2 minutes. Then went to reinstall Avast AV to see what difference that made and the install went belly up and just left the system completely unbootable.

Rebuilt C: from the disk image a made last night, so back to square one. At least I've learnt a few things today

Re comment on disk write caching - it's only disabled for an external USB connected drive (G), the two internal HDDs (C and D) have disk write caching enabled (I've checked). Bootvis must have got confused. Yes I did do a boot defrag with Puran, though not a page defrag, will remember that for next time around.

Is it worth letting Bootvis do a repair (duh - just realised, will have to redownload everything I downloaded today - poo!).

Will have to have a trawl through the ZA forums and see if there's anything there about slow boot. If not it might be time to find a better firewall.

plodr - thought I'd read somewhere that MS Security Essentials had be withdrawn?

I will report back if I find anything, otherwise I might be back here with more daft questions.

Thanks again for eveyones help!

 

Grr, one of those days, eh?

ZA is something of a hog and has been implicated in many network-related problems, I'd prefer Comodo or PrivateFirewall, less likely to have problems with it further down the line, I think.

MSE is fine and still being developed as far as I know, best installed on a fresh system; in your case, try to clean out any dregs of security software as per my previous post before installing your security apps.

 

Further update.

Now got to a more reasonable boot time of 65 seconds!

In case it's of use to anyone else this is what I did -

Restored C from old image, where boot time was nearly 4 minutes.
Uninstalled Zone Alarm (plus ran their clean up program cpes_clean.exe), Avast and Genie Timeline.
Check in Autoruns for any residual entries (none), removed a couple of entries related to programs no longer installed.
Run CCleaner to clean out "temp" files etc and clean registry (used CC settings described by Satrow earlier in this thread).
Run Sysinternals pagedefrag.
Run Bootvis repair.
Run Puran Defrag (boot defrag).
Run Bootvis - boot time now reported as 52 seconds.
Created new disk image of C in case I need to go back to it.
Installed Comodo free firewall (in place of Zone Alarm).
Installed Avast.
Run Bootvis - boot time now reported as 65 seconds.

Haven't yet reinstalled Genie Timeline, will let the system settle down for a few days before doing this.

Seems pretty good to me - well pleased :dood

Incidentally, Bootvis graph is still showing "Warning! Disk write caching is disabled". Checked in device manager on all disk drives - it's not. Any ideas?

 

65 seconds with security apps loaded seems pretty good for SP3.

Bootvis is an old App now, was always unsupported by MS anyway so bugs like that are expected, I reckon. Ignore it; looking at the HDD activity (the blues cloumns are HDD writes) logged by Bootvis, even if caching was currently disabled, enabling it wouldn't cut your boot time by more than a few milli-seconds .

 

I should have kept my big mouth shut!!!!

After posting my last thread I shut the PC down. Went back to it a few hours later - slow to boot. Ran Bootvis and it's now showing 124 seconds, and nothing has been changed in the meantime.

Starting to feel a complete rebuild coming on, but a pain in ar.. getting all the applications reinstalled and configured.

I have run an AV and Spybot scan, but is it possible that there's something nasty in there that they're not finding?

 

Yes, it's possible, if you suspect there may be malware involved, then you really should give the PC a thorough checkup, follow the steps carefully, noting any errors or warnings and, if the problem hasn't cleared up after running the cleanup scans, post the necessary logs as attachments in a new topic in the Malware forum.

 

I've run the clean up as suggested, and the boot time has gone back to about 68 seconds (with Comodo and Avast), which isn't bad, so something(s) has been fixed. It remains to be seen if it stays that way.

I've posted all the logs on the Malware group, and requested that someone has a quick look at them, just in cased I missed something in the logs.