Super fast boot has become painfully slow

[Charlietbh]

Hi all,

First post, looked around here first, got Speccy and filled in my specs - if you need more please say.

PC built and supplied by Quiet PC 18 months ago, always super fast and always started up super fast. Few days ago I thought I noticed it slow to boot up, but as I usually turn it on and then do something else I didn't think about it again. Last few days I've paid attention to the boot and it's taken way longer. Only changed I can remember recently were changing from Chrome to Firefox and there was a Windows Update - but I'm pretty sure it started before then.

Steps I've tried so far:

1. Deleted anything installed recently
2. Removed any programs causing errors in Event Viewer or fixed the problem (some of those removed: CCleaner, Firefox, all recent Adobe updates)
3. Disk Clean up, Defrag, Disk Check (the thing where you right click the HD and Check now...)

Appreciate any advice. Rest of the machine seems to be running ok, but I'm worried this is the start of something.
-Edit-

In case it helps I've just restarted and noted what happens.

What used to happen was Power button > brief Quiet PC screen > brief Windows logo > Desktop

What happens now is Power button > brief Quiet PC screen > brief Windows logo > black screen with the mouse pointer for about 60 seconds > Desktop

 

[richc46]

I would do the following.
Run a full anti virus scan
Download and run a scan with malwarebytes
Run a scan with eset online
A negative from all 3 would be a good indication that it is not malware.

Run in safe mode. If you boot up satisfactorily.
Follow the clean boot procedure to solve your problem
http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

 

[Charlietbh]

Thanks for the reply. I tried all those steps and no change, so I ran a clean boot again and checked the event log - lots of errors to do with not being able to register my PC on the IP address of my modem. Thought this may be to do with my PC and laptop having similar names so looked at users and credentials and found a Generic Credential I didn't recognise: viretualapp/didlogical. Anyone know what that is and if it could be causing the problem? Says "Modified today"

-Edit-

Never mind, deleted the credential and no difference to boot speed.

 

[Layback Bear]

Google is your friend. This is what I found.

What is Virtualapp/Didlogical?

So, who creates the entry Virtualapp/Didlogical?

Virtualapp/Didlogical is a credential that is stored when you use any of the Windows Live products, this can include Windows Live Messenger, Windows Live Mail, Windows Live Sign-In Assisstant, Windows XP Mode and other Microsoft services.

 

[Charlietbh]

Google is your friend. This is what I found.

What is Virtualapp/Didlogical?

So, who creates the entry Virtualapp/Didlogical?

Virtualapp/Didlogical is a credential that is stored when you use any of the Windows Live products, this can include Windows Live Messenger, Windows Live Mail, Windows Live Sign-In Assisstant, Windows XP Mode and other Microsoft services.

Found that too, but don't have any technical knowledge to know if it could have been causing the problem.

 

[Charlietbh]

Anyone have any ideas? Have spent I'd say 10 solid hours trying every fix I can find online, uninstalling pretty much everything and re-installing drivers. Currently just have Chrome, Office and Windows on the machine

 

[maxseven]

Do a System Restore to before the problem started.

 

[carwiz]

It's probably not good to start deleting things you don't understand. For us to help you, we need your help. Reading through your statements leads me into a state of confusion since there's no detail of what you have or what you did.

To start, perform this diagnostic procedure: http://www.sevenforums.com/tutorials/92394-sf-diagnostic-tool-using-troubleshooting.html

Take your time and follow it step by step. Be sure to "Run as Administrator" and use the "Grab All" button. Allow for all the steps to complete. This can take five or more minutes. Upload the zip file here so we can see what you have and what's running. This will give us the current state of your system.

 

[Charlietbh]

Thanks so much man, I was starting to lose my mind (I think I've spent about 18 hours over the last few days trying different things recommended all over the web).

System restore points removed as a step someone else suggested I'm afraid.

btw, noticed this red error in event log:

Event 3299, Apache Service
The Apache service named reported the following error:
>>> httpd.exe: Could not reliably determine the server's fully qualified domain name, using 169.254.205.176 for ServerName .

No idea what that is

 

[carwiz]

169.254.205.176 shows up as a private network near Los Angeles, California. That's not a good sign. You may have software "phoning home" or you're running a Torrent in which case, you're on your own. I would be sure to run a good AV scan.

After looking at what's running, your problem may be tied to the Symantec AV running along side MSE. For test purposes, uninstall the Symantec software and turn-on Windows Firewall.

http://www.sevenforums.com/tutorials/343888-norton-symantec-uninstall-completely.html

Open CCleaner and turn-off the monitor options. This can cause a startup delay and be a processor hog. Just check for an update manually about once a month.

That's all I had time to check for now.

 

[Charlietbh]

169.254.205.176 shows up as a private network near Los Angeles, California. That's not a good sign. You may have software "phoning home" or you're running a Torrent in which case, you're on your own. I would be sure to run a good AV scan.

After looking at what's running, your problem may be tied to the Symantec AV running along side MSE. For test purposes, uninstall the Symantec software and turn-on Windows Firewall.

http://www.sevenforums.com/tutorials/343888-norton-symantec-uninstall-completely.html

Open CCleaner and turn-off the monitor options. This can cause a startup delay and be a processor hog. Just check for an update manually about once a month.

That's all I had time to check for now.

That's the one that worries me, but neither Symantec nor Malwarebytes picked anything up in Safe Mode...

-Edit-

Was just some Marvell thing, un-installed it and the message is gone now. Only message left in Event Viewer > Custom Views > Administrative Events is Event 4001, WLAN-AutoConfig

Can anyone tell me if I'm barking up the wrong tree? In the below the difference between the highlighted process and the one above it is, I would say, when and how long the black screen lag during boot happens; does this mean it is the cause?

 

[carwiz]

Many of the AV products cannot be run concurrently. They interfere with each other and can cause problems. Some will even BSOD the system. Choose ONE but I would suggest dumping Symantec. It's a resource hog with 8-10 drivers with a huge overhead.

I was looking at a number Kernel Power events in the system log you supplied but it (the log) ended 2/24/2015 so nothing was current. Kernel Power events indicate one or more of the processors is resetting. Either because of power failures or component failure. I didn't see any "Throttling" which indicates overheating so they are all power events. Will your battery accept a full charge? Check with the laptop OEM and see if there's a more recent BIOS update. Yours it currently: BIOS Version/Date American Megatrends Inc. F14, 22/08/2012


Also check this:
Click the Orb and type msconfig. Click on msconfig.exe. Click on the Boot tab then Advanced Options... Post an image of that window if any of the boxes are checked. (None should be)

While you're there, click on the Startup tab and post images all the entries.

 

[Charlietbh]

Thanks carwiz.

It's a PC rather than a laptop, and I checked the BIOS and it's the latest as far as I can see (Gigabyte Z77X-UD5H)

Nothing ticked in Advanced Boot tab, and startup is below. I've also tried Safe Boot and Diagnostic Start-up in there with no difference.

I removed Norton and just have MS Security Essentials at the moment.

 

[carwiz]

Sorry, don't know why I was thinking laptop. Too many threads going at once.

Lets see if it's a BIOS boot delay or a Windows boot delay.

Open the Event Viewer.
Navigate to: Application and Services Logs > Microsoft > Windows > Diagnostics-Performance > Operational

Click on the last (latest) Event 100 in the upper pane.
In the lower pane, click on the Details tab and select Friendly (view).
Right click anywhere in the lower pane and click on Select All.
Right click again in the lower pane and click on Copy.
Paste the details into your next message.

 

[Charlietbh]

Thanks, results below. I've finally cleared on of the events (event 4001) but turning WLAN off, but it's made no difference.

- System

- Provider

[ Name] Microsoft-Windows-Diagnostics-Performance
[ Guid] {CFC18EC0-96B1-4EBA-961B-622CAEE05B0A}

EventID 100

Version 2

Level 3

Task 4002

Opcode 34

Keywords 0x8000000000010000

- TimeCreated

[ SystemTime] 2015-03-20T10:00:09.045620800Z

EventRecordID 2460

- Correlation

[ ActivityID] {03508C48-F800-0001-A53E-E152F462D001}

- Execution

[ ProcessID] 1432
[ ThreadID] 1444

Channel Microsoft-Windows-Diagnostics-Performance/Operational

Computer CLS-PC

- Security

[ UserID] S-1-5-19


- EventData

BootTsVersion 2
BootStartTime 2015-03-20T09:57:49.578000100Z
BootEndTime 2015-03-20T10:00:06.835617700Z
SystemBootInstance 689
UserBootInstance 688
BootTime 63706
MainPathBootTime 46906
BootKernelInitTime 11
BootDriverInitTime 283
BootDevicesInitTime 908
BootPrefetchInitTime 0
BootPrefetchBytes 0
BootAutoChkTime 0
BootSmssInitTime 3041
BootCriticalServicesInitTime 40427
BootUserProfileProcessingTime 458
BootMachineProfileProcessingTime 0
BootExplorerInitTime 566
BootNumStartupApps 9
BootPostBootTime 16800
BootIsRebootAfterInstall false
BootRootCauseStepImprovementBits 0
BootRootCauseGradualImprovementBits 0
BootRootCauseStepDegradationBits 0
BootRootCauseGradualDegradationBits 0
BootIsDegradation false
BootIsStepDegradation false
BootIsGradualDegradation false
BootImprovementDelta 0
BootDegradationDelta 0
BootIsRootCauseIdentified false
OSLoaderDuration 1896
BootPNPInitStartTimeMS 11
BootPNPInitDuration 924
OtherKernelInitDuration 234
SystemPNPInitStartTimeMS 1150
SystemPNPInitDuration 268
SessionInitStartTimeMS 1427
Session0InitDuration 2142
Session1InitDuration 112
SessionInitOtherDuration 785
WinLogonStartTimeMS 4468
OtherLogonInitActivityDuration 41413
UserLogonWaitDuration 175

 

[carwiz]

I suspect you may have some malware running as a service or there's a service taking an unusually long time to initialize. In the image below, the green arrow indicates the Session 0 & 1 start up time that includes normal drivers, services and paging. The red arrow is Services Initialization time and is way out of line. Normally this is a few seconds at most but usually less than one second. Yours is over 40 seconds and consuming most of the boot time.

Go back to the same area of the Event Log and look for any other events in the 100 series such as 101, 103 etc. If there are any, copy and post those. Ignore the 200s, these are Shut-Down entries.

In the mean time, I'll go back through your zipped files and see if something stands out. You do have a few programs that are considered PUPs (Potentially Unwanted Programs) by most AV companies. One, or more, of these may have installed a service and is performing data gathering or unusual functions. One such program is Dropbox but you have it checked in your Start Up group so I assume you know what it does.

 

[Charlietbh]

I'm out at the moment so I'll check in a bit, but wouldn't that be picked up by the various scans I've run? Have run Norton, Malwarebytes and Comodo all in safe mode recently and they didn't find anything.

 

[carwiz]

Not necessarily. These have been marked as "Critical Services" and you probably "Ok"ed the install from some other download. That is, if it is malware. There could just be a problem with a piece of hardware or corrupt file. I'll be back around lunch time (my time) to finish looking.

 

[carwiz]

Is your PC behind a server or used as a home server, file server? There's a couple of services I don't normally see running on a home PC. One is TrkWks. It could be used by Dropbox, Norton, Sage or QuickBooks (or any number of backdoor programs). I need to see if it's still running after you removed Norton. Please run a new SF Diagnostics as before and upload a new zip file.

The Distributed Link Tracking Client (TrkWks) is responsible for tracking links to files saved on a file server. For example; if you save a file on a file server and put a link to it on your desktop and the file is moved on the file server. The link on your desktop will change accordingly to the new location of the file on the file server.

 

[Charlietbh]

Got someone from 247techies on the machine at the moment so I can't check. They've been logged on for 15 hours now, so not holding out much hope...

Had a quick look and the only one I could see was 109