Delay in booting Windows XP [into desktop]

[W@lly]

Hi there,

I have been to a client where he complained that it took forever to boot into windows. He had Windows Xp pro on an AMD Athlon 1.67Ghz with 1Gb RAM, so XP it should run fine.

I have done the malware/spyware removal procedure such as booting into safe mode and installed ccleaner, malwarebytes [which fixed 7 infected objects], ran smitfraud fix and uninstalled non-used software as told by client using Revo uninstaller.

Despite of all above, Windows XP boot logo [the screen with the blue progress bar] took so long to boot into windows. How would I know what is that long delay in booting up to desktop? I mean the progress bar lines passed about 23 times until there was the hd activity and 3 more mins when the desktop is actually accessible!

Mind you that I have also disable many startup-entries using msconfig, even using ccleaner's startup. I have also found in msconfig that many entries were already disabled prior to what I have disabled..

One more thing I have noticed is that in the boot.ini file there were 2 entries for windows Xp, but I have edited it to be only one entry [set as default ovbiously].

Thanks for your help...

 

[Cambridge PC Support]

Have you checked the HDD health?

 

[Tekguy]

Does it boot fairly fast into safe mode?

 

[W@lly]

Nope I haven't checked HDD health. I do remember though that booting into safe mode took some time as well. While scanning into malwarebytes in quick mode took like 1 hour too!

 

[Cambridge PC Support]

Nope I haven't checked HDD health.

Always do that first, especially on a slow machine.

 

[W@lly]

...will update you when chkdsk /r is performed, thanks.

 

[B Trevathan]

After you've checked the hard drive to make sure its ok you could also:
Run a AV live CD like Avira Rescue Disk or Dr. Web Live CD
Check the RAM one stick at a time with a live CD
Run system file checker
Defrag the hard drive
Run Process Monitor to see if the system is looking for a missing file

What AV is running? any scheduled tasks? anything load in the startup folder?

 

[OldSchoolPC]

Event Viewer is your friend.

 

[Cambridge PC Support]

...will update you when chkdsk /r is performed, thanks.

Yeah, very funnny

 

[W@lly]

After you've checked the hard drive to make sure its ok you could also:
Run a AV live CD like Avira Rescue Disk or Dr. Web Live CD; Did Boot time scan with Avast AV-OK nothing risky was found.

Check the RAM one stick at a time with a live CD; Will run MemTest86+and swap if needed.

Run system file checker= run sfc /scannow, even if system boots up properly? no missing system files are reported.

Defrag the hard drive; DEFINITELY will run this after chkdsk/r but I don't believe in Defrag could make a miracle, but anyway will give it a shot!

Run Process Monitor to see if the system is looking for a missing file.
What I need to do for this one please?

What AV is running? any scheduled tasks? anything load in the startup folder?
Avast AV free edition is being used. No scheduled tasks, and edited startup items in msconfig, although as already mentioned many items were already disabled from running during startup.

Thanks for the above suggestions.

 

[B Trevathan]

What have you done to check that the hard drive is OK? If the hard drive is starting to go bad its not a good idea to put it under stress with a lot of reads and writes to it. Have you ever used CrystalDiskInfo? Have you backed up any important data?

Did Boot time scan with Avast AV-OK nothing risky was found.

Thats great I would also go ahead and scan with a live CD still, you can set them to just report if they find any thing.

Will run MemTest86+and swap if needed

Sometimes checking the RAM with more than one stick installed will hide errors from a memory test.
While you've got the hood open look around for any swelled caps and anything that doesn't look right, is it dusty?

run sfc /scannow, even if system boots up properly? no missing system files are reported.

Yes, no missing system files found that is good.

Run Process Monitor to see if the system is looking for a missing file.

What I need to do for this one please?

http://technet.microsoft.com/en-us/sysinternals/bb896645
You will probably have to filter out some of the information, so much information can be kind of overwhelming.
I find it amazing how one little dll file could be missing and cause so many different problems and not crash a system or a very least show an error that names the file as missing.

 

[FoolishTech]

I see this chkdsk thing... that is for file system errors...

You need to run a DOS based factory hard drive diagnostic app on it, like WDDiag/Seatools/etc. Sometimes they still fail to catch a failing drive, though, but it's rare.

If those tests pass, then the most reliable way to tell in this situation would be to clone the drive to a new one and see if that makes a difference.

If not, then software-wise beyond what has already been suggested, you may also get some mileage with running Bootvis.exe to see what is delaying startup. You never know what quirky hardware driver or software could be delaying the load. Microsoft has long since removed their Bootvis.exe download but you can get it still at Majorgeeks and probably other places.

 

[d3v]

I always use crystaldiskinfo portable on my USB flash drive within windows/safe mode to check for bad HDD's. It saves a lot of time booting to a live CD and running a lengthy diagnostic tool.

 

[Xander]

Not to jump on anyone but why do a virus check (before doing anything else) and then stop there? Why even start with a virus check at all? There are so many other regular, legitimate reasons that a system would boot slow that have nothing to do with viruses. A slow bootup is, for that matter, a rare symptom of infection.

As above, before you waste time looking at viruses, your most likely cause will be the drive so do a SMART test. Before running a long disk check, as above, check the Event Viewer. What about networked drives reconnecting? So many things that are worth checking before flushing away time scanning for viruses.


I'm not picking on you W@lly. I've just been spotting this over the last few months where someone has some symptom like this that have much more likely causes and the first thing the tech says they've done is scan for viruses.

 

[B Trevathan]

If not, then software-wise beyond what has already been suggested, you may also get some mileage with running Bootvis.exe to see what is delaying startup. You never know what quirky hardware driver or software could be delaying the load. Microsoft has long since removed their Bootvis.exe download but you can get it still at Majorgeeks and probably other places.

Have you ever tried the boot logger in Process Monitor?
If so what do you think of it, would you rather use Bootvis?

How To Enable System Boot Time Logging using Process Monitor Tool:
http://www.msigeek.com/6231/how-to-enable-system-boot-time-logging-using-process-monitor-tool
or
http://www.symantec.com/business/support/index?page=content&id=TECH176422​

 

[FoolishTech]

Have you ever tried the boot logger in Process Monitor?
If so what do you think of it, would you rather use Bootvis?

How To Enable System Boot Time Logging using Process Monitor Tool:
http://www.msigeek.com/6231/how-to-enable-system-boot-time-logging-using-process-monitor-tool
or
http://www.symantec.com/business/support/index?page=content&id=TECH176422​

Actually, I didn't know that feature existed! Thanks for pointing that out!

 

[W@lly]

Thanks for all your suggestions, when I work on this PC I will keep you posted for any progress.

And you're right ehousecalls.ca about doing virus removals first before checking HD status, but I have done this since client already told me that he had spyware and in fact malwarebytes did find 7 malicious infections from a quick scan [which lasted for an hour!] and the full scan had found 4 more...

Anyway you guys posted new tips and tools in which I had never used before such as bootvis.exe and processmonitor. Gonna dig in to use them effectively

 

[ComputerRepairTech]

Aren't you guys missing an easy step you should do before getting into all those things? Hint, will also make it extremely obvious if its a dma/pio issue.

 

[W@lly]

Aren't you guys missing an easy step you should do before getting into all those things? Hint, will also make it extremely obvious if its a dma/pio issue.

DMA/PIO = checked BIOS settings and it was ok, I have only enabled S.M.A.R.T cause it was capable and disabled.

Is there any other settings I should check?

 

[FoolishTech]

Aren't you guys missing an easy step you should do before getting into all those things? Hint, will also make it extremely obvious if its a dma/pio issue.

HEHE I'm so used to letting D7 tell me if that is a problem or not I never check anymore so it didn't even occur to me to suggest it.

DMA/PIO = checked BIOS settings and it was ok, I have only enabled S.M.A.R.T cause it was capable and disabled.

Is there any other settings I should check?

Not just in the BIOS, but you want to check Device Manager > IDE Controllers > Channel > Properties > Advanced and see if the hard drive is running in PIO mode.

Of course, if DMA is enabled in the BIOS but in Windows it's PIO mode, then you're back to probably having a bad drive. Windows tends to reduce DMA modes and even go all the way back to PIO mode automatically when it encounters drive/controller errors. The more errors over time, the further the DMA mode reduction until it gets all the way back to PIO mode. It does this to increase stability as the drive starts to fail. Usually you can reset the performance counters in the registry and put the drive back into DMA mode, but again this only usually occurs due to a failing HDD.

Off topic, it's worthy of note that the same can happen on the optical drives as well, and this is usually due to the drive reading scratched / damaged disks.