Sudden slow boot (maybe due to BootSmssInitTime?)

brownbat · 22 Oct 2013

About a week ago, my boot time basically doubled overnight. I've been pouring through the threads, seems like a million different suggestions for a million different causes. I've tried some of the solutions, but may need help with diagnostics here.

I've used the event viewer to isolate the first slow boot, and it seems like a lot of the new time is added under BootSmssInitTime (though there's a healthy chunk post boot as well).

I had three boots on October 15th, at 42", 35", and 66"... pretty normal range for the previous months. For the next three boots (one per day through the 18th), I have 143", 112", 108"... that's my new normal (though I have gotten as low as 86"...) Oddly enough, there's no Boot Degradation recorded on that day.

I didn't install any drivers or programs anywhere near that day. Well, Scribblenauts three days earlier, that's the closest, but several boots since then. All games and even Steam is gone now, I've been uninstalling everything like a fiend, no luck so far.

I ran a system restore back to the 13th, no effect. I've given CCleaner and TempFileCleaner a run, no result.

I stripped out my graphics drivers and reinstalled the latest (Radeon HD 5870). I upgraded my BIOS to the latest firmware (board is an ASUS P7P55D PRO). I boot off of two 80GB X25-Ms in RAID 0. After the slowdown I installed the Intel SSD toolbox to update the firmware and optimize. No improvement. I also have an internal SAMSUNG HD103SJ 1TB drive I use for backups (and also to store large media).

I've made sure everything is unplugged during startup except for the USB wireless keyboard + mouse I've had for almost a year. No luck.

Some have reported that SSDs get slow if not operating in AHCI, but I've always used the BIOS RAID settings, which should have AHCI baked in, and I haven't recently changed anything in storage. I verified the RAID settings were maintained when I flashed the BIOS.

I'm using MSSE for AV.

I'm at a loss. The event log seems to put a big chunk of the slowdown with SmssInit, but the boot trace just has SmssInit as a short blip... (or is that normal?)

If anyone has ideas for other things to try, or if anyone knows how to analyze a boot trace file, you'd be my hero.

boot_events.evtx (68 KB)
https://mega.co.nz/#!WkISCL4I!IqJygn...CUkPTxapUeqNqc

boot_trace.etl (598.0 MB)
https://mega.co.nz/#!aphS1QYI!FhwBCy...HI_QjHfFsQji4I

I can give you a boot degradation log if you like, but I my log weirdly doesn't have any info for the day where all the degradation happened.

Thanks in advance for any suggestions, it's pretty frustrating, I'm ready to try anything.

indianacarnie · 22 Oct 2013

Have you tried running an sfc/scannow? System File Checker checks your system files and (possibly) repairs them. Here's a link on how to do that if you haven't before.

SFC /SCANNOW Command - System File Checker

Maybe restoring your MBR would help also, here's a tutorial on how to do that if you haven't before.

MBR - Restore Windows 7 Master Boot Record

brownbat · 22 Oct 2013

SFC reports all correct, bootsect claimed to "successfully" rewrite the MBR. No real improvements, SmssInit stubbornly near 50 seconds.

brownbat · 22 Oct 2013

Ran a memory diagnostic, just in case, no news.

Found a discussion of using /BOOTLOG to see loaded drivers:
Drivers that Load at Startup - Drivers - Windows XP

Here's my boot log through /BOOTLOG:
ntbtlog.txt (17 KB)
https://mega.co.nz/#!a8oiiCgS!XvBbN0...mcyuWiPuhUnWbo

It looks like I have NDProxy.sys loaded successfully, but then for some reason Windows tries to load it again four more times and fails each time. Later I have a failure on "\SystemRoot\system32\DRIVERS\MpFilter.sys"... which seems to be related to security, hopefully that's a coincidence, I'm dreading this turning out to be a deeply embedded virus or something.

Later I have:
Loaded driver \SystemRoot\System32\DRIVERS\srv2.sys
Loaded driver \SystemRoot\System32\DRIVERS\srv.sys
Did not load driver \SystemRoot\System32\DRIVERS\srv.sys

Checking this out to see if it helps, it covers NDProxy and srv.sys:
Delay on boot due to multiple attempts to install NDProxy.sys, - Microsoft Community

brownbat · 23 Oct 2013

People seem to find an answer here helpful:
Delay on boot due to multiple attempts to install NDProxy.sys, - Microsoft Community

The recommendation was to find the INF files pointing to the misloading Driver Files and correct the paths that did not resolve.

But a) not sure how to dig through INF files, and b) all three of my drivers that fail to load are previously listed in the ntbtlog.txt as loaded successfully, with the same path, and they exist in the correct directories.

Hunches:
Maybe this load error is just a result of multiple people trying to load the driver multiple times, and Windows constantly kicking back a notice that the driver is already loaded?

These seem security related, so maybe I need to scour MSSE off of my disk, then try to reinstall it from scratch. I know pulling an AV off of an OS can be a messy process, not sure if it's something I should just do lightly, I might accidentally end up leaving the commands to load drivers on the system and simply add new ones on top, making the problem worse...

indianacarnie · 23 Oct 2013

Here's how MS says to do it : How to manually uninstall Microsoft Security Essentials 1.0.1963 if you cannot uninstall it by using the Add or Remove Programs item

gregrocker · 23 Oct 2013

Work through all of the Troubleshooting Steps for Windows 7 starting with a Clean Boot with only AV starting with Win7.

I'd also compare your install to the perfect install compiled in Clean Reinstall - Factory OEM Windows 7 which is the same for retail. It might be easier to invest in a perfect install now.

carwiz · 23 Oct 2013

Smss Initiation time is Session 0 & 1 setup time (Drivers, Services, Paging, etc.). This is before any user session activities. Additional time can be caused by a number of things including adding new drivers or devices that require kernel drivers.

brownbat · 24 Oct 2013

MSSE removal didn't have any effect, reinstallation didn't matter either.

I'm working through the troubleshooting tips, nothing so far. Not too surprising, I've covered most of this ground already above.

Bare bones safe mode seems to hang for about 50 seconds to boot too. Malwarebytes didn't have anything.

Maybe it is time for a reinstall. That's sad, it feels like giving up.

And with the list of drivers the system's trying to load multiple times, NDProxy and srv.sys, seemed like I was so close...

carwiz · 24 Oct 2013

Post a snip or the xml event log record of your last boot. It will be an event ID 100. If you paste the xml data, select it and click on the hash (#) symbol in the message header. This wraps CODE tags around the text and disables any characters that may cause a problem in the posted message.

It will look something like this:

Code:

 
Log Name:      Microsoft-Windows-Diagnostics-Performance/Operational
Source:        Microsoft-Windows-Diagnostics-Performance
Date:          2/12/2011 1:48:33 PM
Event ID:      100
Task Category: Boot Performance Monitoring
Level:         Warning
Keywords:      Event Log
User:          LOCAL SERVICE
Computer:      CCW3-PC
Description:
Windows has started up: 
     Boot Duration  : 19082ms
     IsDegradation  : false
     Incident Time (UTC) : ?2011?-?02?-?12T19:46:55.640400300Z
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Diagnostics-Performance" Guid="{CFC18EC0-96B1-4EBA-961B-622CAEE05B0A}" />
    <EventID>100</EventID>
    <Version>2</Version>
    <Level>3</Level>
    <Task>4002</Task>
    <Opcode>34</Opcode>
    <Keywords>0x8000000000010000</Keywords>
    <TimeCreated SystemTime="2011-02-12T19:48:33.285370500Z" />
    <EventRecordID>38</EventRecordID>
    <Correlation ActivityID="{00000100-0000-0001-2A99-629AEDCACB01}" />
    <Execution ProcessID="1388" ThreadID="2740" />
    <Channel>Microsoft-Windows-Diagnostics-Performance/Operational</Channel>
    <Computer>CCW3-PC</Computer>
    <Security UserID="S-1-5-19" />
  </System>
  <EventData>
    <Data Name="BootTsVersion">2</Data>
    <Data Name="BootStartTime">2011-02-12T19:46:55.640400300Z</Data>
    <Data Name="BootEndTime">2011-02-12T19:48:31.740967800Z</Data>
    <Data Name="SystemBootInstance">19</Data>
    <Data Name="UserBootInstance">17</Data>
    <Data Name="BootTime">19082</Data>
    <Data Name="MainPathBootTime">6182</Data>
    <Data Name="BootKernelInitTime">16</Data>
    <Data Name="BootDriverInitTime">241</Data>
    <Data Name="BootDevicesInitTime">1445</Data>
    <Data Name="BootPrefetchInitTime">2639</Data>
    <Data Name="BootPrefetchBytes">383528960</Data>
    <Data Name="BootAutoChkTime">0</Data>
    <Data Name="BootSmssInitTime">3071</Data>
    <Data Name="BootCriticalServicesInitTime">189</Data>
    <Data Name="BootUserProfileProcessingTime">370</Data>
    <Data Name="BootMachineProfileProcessingTime">1</Data>
    <Data Name="BootExplorerInitTime">335</Data>
    <Data Name="BootNumStartupApps">13</Data>
    <Data Name="BootPostBootTime">12900</Data>
    <Data Name="BootIsRebootAfterInstall">false</Data>
    <Data Name="BootRootCauseStepImprovementBits">0</Data>
    <Data Name="BootRootCauseGradualImprovementBits">0</Data>
    <Data Name="BootRootCauseStepDegradationBits">0</Data>
    <Data Name="BootRootCauseGradualDegradationBits">0</Data>
    <Data Name="BootIsDegradation">false</Data>
    <Data Name="BootIsStepDegradation">false</Data>
    <Data Name="BootIsGradualDegradation">false</Data>
    <Data Name="BootImprovementDelta">0</Data>
    <Data Name="BootDegradationDelta">0</Data>
    <Data Name="BootIsRootCauseIdentified">false</Data>
    <Data Name="OSLoaderDuration">541</Data>
    <Data Name="BootPNPInitStartTimeMS">16</Data>
    <Data Name="BootPNPInitDuration">1468</Data>
    <Data Name="OtherKernelInitDuration">294</Data>
    <Data Name="SystemPNPInitStartTimeMS">1760</Data>
    <Data Name="SystemPNPInitDuration">218</Data>
    <Data Name="SessionInitStartTimeMS">1981</Data>
    <Data Name="Session0InitDuration">1209</Data>
    <Data Name="Session1InitDuration">252</Data>
    <Data Name="SessionInitOtherDuration">1609</Data>
    <Data Name="WinLogonStartTimeMS">5053</Data>
    <Data Name="OtherLogonInitActivityDuration">422</Data>
    <Data Name="UserLogonWaitDuration">155</Data>
  </EventData>
</Event>