Question about Start Menu - Taking forever to load! -

I know quite a bit about computers, and I am baffled why all of a sudden, when I attempt to login to Windows under ANY user account, it takes FOREVER for the start menu to be displayed. Sometimes it can take up to 4-5 minutes for it to come up, and it happened all of a sudden out of nowhere. I've tried using System Restore to restore back and it has changed nothing. To the best of my knowledge, I don't know what setting I changed to cause my computer to act up like this. Normally it takes 1-3 minutes for the computer to completely load up to my desktop. I am using the classic login method (username & password) but for some reason after entering in the information, my computer doesn't do anything for like 5 minutes, then loads my desktop and start menu.
I normally don't look to sign up for forums for support, but it seems I can't google any other article relating to my issue. Recently I have edited one registry setting, (removed some Windows Live Application Data / UnreadMail registry entry) but even a backup didn't fix it (System Restore).

Does anybody know what could be causing my Start Menu to load up so slowly? (explorer.exe it seems).

If you can help I would really appreciate it

Thanks, ~Eric.

 

Nope... my computer was working fine. After I restarted it, it's been taking forever to startup since then. however once I'm logged in and explorer.exe has loaded, everything seems to be working just fine and my laptop is going lightning-fast as usual... it's just the big startup problem.

If you feel you can fix my laptop, I have a VNC Server and also MSN Messenger. I really need to get this fixed before school starts.
~Eric.

Email address removed - staff

 

Please, this is a Forum and suggestions that the volunteers here use email, VNC, or IM is not appropriate.

Your description matches perfectly a workstation on a local area network were most if not all have serious malware infections.

Take the worst of the problem computers, and do steps #1 -- #6, disconnecting from the internet and your LAN during Step #4 as outlined here:
http://aumha.org/a/quickfix.htm

Then post here your HijackThis log.

 

My computer is not virus'd, spyware'd, or anything. I run AVG7, and ZoneAlarm Pro which both turned up negative. This is something else relating to the registry perhaps? My guess is as good as yours... I just redid my computer a few weeks ago so there shouldn't be any problems. As for the networking comment, I run all the computers on our network which all have ZoneAlarm Pro and AVG on it. Everything on this network is clean, and even the router is firewalled and secure.

~Eric.

 

Hello Eric and welcome to the Board,

Boot up timing tool from MS - BootVis.exe Tool - It is a performance trace visualization tool for use with Windows XP systems.

Heed the warnings and only use to analyze the startup process, don't use it to "fix" the startup.

http://www.helpwithwindows.com/WindowsXP/tune-19.html

Happy New Year - Charles

 

Don't be so sure that you aren't infected. Head over to Malware and follow instructions - its to your own benefit.

You could also run sfc/scannow, provided you have an XP CD.

 

I ran the Bootvis tool, and all results showed a massive lag period of zero cpu usage zero disk activity, and zero process initialization. I will post pictures of the results below.
http://img143.imageshack.us/img143/9559/diskutilizationsn0.png
http://img484.imageshack.us/img484/5056/processcreatesbg3.png

 

You do not get meaningful results from Bootvis for any processor later than the PIII.

The log results are meaningless.

Please return to the Forum a HijackThis log:

Click here to download HJTsetup.exe

• Save HJTsetup.exe to your desktop.
• Open Notepad > Click on Format > Uncheck Word wrap, if checked.
• Double-click on the desktop icon for HJTsetup.exe.
• By default it will install to C:\Program Files\HijackThis.
• Continue to click Run/Next in the setup dialogue boxes until you get to the Select Additional Tasks dialogue.
• Put a check by Create a desktop icon then click Next again.
• Continue to follow the rest of the prompts from there.
• At the final dialogue box click Finish and HijackThis (HT) will launch.
• Close any/all browser, messenger, mediaplayer, Office and mail client windows and applications.
• Click on the Do a system scan and save a logfile button; HT will then scan and a log showing the results should open in notepad.
• Click on Edit > Select All (or CTRL+A) then click on Edit > Copy (or CTRL+C) to copy the contents of the log to your clipboard.
• Open a reply to this thread and paste (CTRL+V) the log into your reply.
• Make certain you post the entire log, please.

 

The Results are as Follows:


Logfile of HijackThis v1.99.1
Scan saved at 11:23:18 AM, on 12/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SECURITY\AVGANT~1\avgamsvr.exe
C:\PROGRA~1\SECURITY\AVGANT~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\bin\ssv.dll
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\SECURITY\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\SECURITY\AVGANT~1\avgcc.exe /STARTUP
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1165653044328
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165705477218
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\SECURITY\AVGANT~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\SECURITY\AVGANT~1\avgupsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

 

It looks like you have log truncation, so lets check.

Rename this file: C:\Program Files\Hijackthis\HijackThis.exe
to "NailVundo.exe "

Double click to run NailVundo.exe and submit a second log.

 

New Results are as Follows:

Logfile of HijackThis v1.99.1
Scan saved at 11:43:00 AM, on 12/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SECURITY\AVGANT~1\avgamsvr.exe
C:\PROGRA~1\SECURITY\AVGANT~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\SECURITY\ZoneAlarm\zlclient.exe
C:\PROGRA~1\SECURITY\AVGANT~1\avgcc.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Hijackthis\NailVundo.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\bin\ssv.dll
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\SECURITY\ZoneAlarm\zlclient.exe "
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\SECURITY\AVGANT~1\avgcc.exe /STARTUP
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1165653044328
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1165705477218
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\SECURITY\AVGANT~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\SECURITY\AVGANT~1\avgupsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

 

You are running nearly nothing -- really only Zone Alarm and AVG antivirus.

If this is a restricted run set by MSCONFIG it makes it a little hard to see deeper. But based on these results I do not see any malware.

Since you can boot the machine, do a chkdsk /r on the drive.
Afterwards do the Bootvis optomization without using Bootvis advice I provided earlier.

Please also turn off all or any unused network adapters. Use Device Manager to disable, not uninstall, these adapters. This is particularly true if you have both wired and wireless adapters. Disable the one not used.

Boot again and observe your startup times.
Are they any different after the chkdsk and after disabling unused adapters?

 

I ran a full checkdisk which activated after I restarted. Windows said it fixed some things, but it didn't increase my startup speed at all. I also disabled unused network adapters which also had no affect.

~Eric.
I am baffled!! ><

Currently I'm going to attempt to run the boot program to hopefully help with this issue!

 

I just attempted to increase my startup speed with BootVis and I recieved the following error messages.
"Failed to defrag, please do it manually before starting tracing? "
"Failed to start service "


These weren't the exact errors, but very similar to it. I received both of these errors from BootVis when it was attempting to move files around to speed up boot time.
Any ideas?
~Eric.

 

Please, do not use Bootvis.

I explained above how to use its optomization without the program.

Although given those errors:

. Run chkdsk /r
. Defrag

 

Do you mean

Do that? I did but I don't see any results (as noted in the origional post). After running this what do I do?

~Eric.

 

sexybeast, I would try disabling ZoneAlarm just for a test. It has been known to have obscure problems similar to this.

 

just tried it. No effect

~Eric.

 

Then disable all Networking. Systems often stall while searching for some Network Share that no longer exists.