Windows 7: 70 second startup on Aunt's Clean Reinstall

gregrocker · 02 Dec 2013

Is it apparent to any analysts from the collection tool output (without BSOD) what is causing this?

She's coming to pick it up soon so I'd like to fix it if possible. Resume is only 12 secs.

Am updating Display driver now to latest from HP site.

x BlueRobot · 02 Dec 2013

Something's wrong with the file link -

70 second startup on Aunt's Clean Reinstall-error.jpg

x BlueRobot · 02 Dec 2013

It works in IE11, but not Firefox 25.1

gregrocker · 02 Dec 2013

Now 63 seconds after Intel GPU driver updated to 8.15.10.2476. You want another collection?

Had already resolved eeobe.etl and Error 10 repeat errors. Display was delaying in Perf log which showed 90 sec delay.

gregrocker · 02 Dec 2013

Latest after GPU driver update:

x BlueRobot · 02 Dec 2013

There seems to be a couple of Application errors with Malwarebytes.

Code:

Event[1066]:
  Log Name: Application
  Source: Application Error
  Date: 2013-12-02T00:14:27.000
  Event ID: 1000
  Task: Application Crashing Events
  Level: Error
  Opcode: Info
  Keyword: Classic
  User: N/A
  User Name: N/A
  Computer: Rosey-HP
  Description: 
Faulting application name: mbamscheduler.exe, version: 1.70.0.0, time stamp: 0x512fc058
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x73986cdc
Faulting process id: 0x598
Faulting application start time: 0x01ceef207d335c29
Faulting application path: C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
Faulting module path: unknown
Report Id: fec01c80-5b18-11e3-8b35-8f24bca1bffe

It appears to have caused a access violation for some reason, could you please download and then run Process Monitor when loading MBAM. Save the output as a .PML file, and then upload the file as a zipped folder.

gregrocker · 02 Dec 2013

She has the MBAM Real Time Protection so how would you want me to collect ProcMon output since it starts with Windows?

gregrocker · 02 Dec 2013

53 seconds with MBAM Real Time disabled. Uninstalling it now.

46 seconds after MBAM uninstalled.

She gets infected by malware a lot so should I try reinstalling it since she bought a license for life.

YoYo155 · 02 Dec 2013

Hi Greg :).
Did you consider dumping a trace of the startup?

Gathering a Startup, Shutdown, Sleep, Hibernate, or Reboot Trace

gregrocker · 02 Dec 2013

I've got a little over an hour before she picks it up and it goes back to the farm with the dial-up. So I wouldn't have a way to follow up - and Carl isn't on messenger now to ask about reading trace which is above my pay grade. You do that?

Do you think MBAM RT Protection module is scanning startups in real time? After re-enabling Real Time protection it goes back up to 73 sec startup.