System unusably sluggish + lost restore points

Difficult to know how to tiltle this. In normal startup mode, my system has become unusable. Takes forever for everything to initialise at startup (c 15 mins?) and any attempt to open a folder or a program may take just as long again. I find I have lost all but the last system restore point (not through any deliberate action on my part). System Volume Information (eventually) reports 'Can't Access Windows Management Instrumentation Software. Windows Management Files May Be Moved or Missing).

I'm running Win XP Pro SP2 - up to date. I gig RAM. Half full 40 gig hard drive (not particualrly fragmented) Currently I'm writing this using IE7, in Safe Mode with Networking and ZoneAlarm Pro running.

This behaviour started - albeit possibly quite coincidentally - after I attempted to uninstall IE7 Beta 2 - and recovered from the resulting mess by reinstalling IE7 (which I had apparently along with Beta 2) and copying and pasting Normaliz.dll and iertutil.dll from the long-string Windows folder into System32... all working fine (I think)!!

I believe I restarted successfully after that... though can't absolutely guarantee I restarted. Subsequently I downloaded and attempted to install VirtualBox 1.4.0 (msi file) from VirtualBox.Org. But it hung on install - and I got a message that my Windows Installer software might be corrupt or out of date. Thus I downloaded the latest file for my system (its a 2005 file - so unlikely I was out of date: 3.1 KB 893803) and installed it. But VirtualBox still wouldn't install - so I gave up. Problems started after the next restart. That's all I know. Except Lavasoft Adaware, Spybot S&D 1.4 and F-Prot Win 6.x (all latest defs, etc) show no malware. Event Viewer shows lots of DCOM errors and the occasional 'possibly no virtual memory' error while this is going on.

This is very very boring indeed. Anyone got any helpful suggestions?

 

Update - No physical problems evident; getting desperate

Running chkdsk /r revealed no problems; sfc /scannow doesn't help; running extensive physical memory testing using HP Compaq's Diagnostics for Windows indicates physical memory is fine.

I've got a Retrospect iso image/disaster recovery CD I made recently - but there seems to be an .rdb file missing, so I can't use it; likewise my SP2 slipstreamed XP Pro CD is missing something needed for the Repair function to work. Fortunately I have my data backed up (actually 'duplicated') on an external HD. But this is extremely tedious... The problem seems to be that explorer.exe requires a very extensive refractory (waiting) period between one action and another. I can't even run Start, Programs without waiting 5 minutes before hitting the actual program I want to run - though, internally, programs like (this) Firefox run fine. (I suspect this is the case with IE7 too - though not with Microsoft Update via IE7 but I'll double-check IE7 - Edit - Yup IE7 working fine).

Still nobody willing or able to help?

 

Just the normal system idle process - but that usually shows 80-97 under cpu. It seems to be the case that anything that requires a change or refresh in explorer (ie - the desktop), opening or closing a new program or process, takes forever. But no problems in Safe mode. And no problem (apparently) within a program. No error messages, either (apart from the enigmatic stuff in Event Viewer). I've set virtual memory manually to 1536, rather than let Windows manage it - but that doesn't seem to help either - so I'm going to set it back to System managed... Thanks for your concern, anyway!

 

Hello David,

If you want to look into the Services that are running on your system:

XP "bundles" services under SVCHOST.EXE. To see exactly what is running in each instance of svchost:

Open a cmd box: start > run > type cmd > ok and type:
tasklist /svc > c:\tasklist.txt

Open tasklist.text with Notepad.

To relate the Task Manager entries and the tasklist.txt entries: they are tied together thru the PID number. Make sure that in TM the PID is showing. If not, click on view > Select Columns.

tasklist.exe is only on XP-pro, so if running Home you'll need to download it along with the instuctions from here:

http://www.computerhope.com/download/winxp.htm

Move it to the System32 folder before executing it.

Regards - Charles

 

Apologies for delay Charles. Unfortunately after entering the commands, I get ERROR: Server execution failed.

I'm doing this with task manager closed, and I'm assuming the spaces in tasklist /svc > c:\tasklist.txt are all intentional? I tried from the default c:\documents and settings\David and also after having cd'd back to C:\

I am running Windows XP Pro SP2

 

Oh dear Pete - that is exactly what I did, and just to be sure, I did it again and again - including with Task Manager open and Task Manager closed. But I still get the same error message. Meanwhile, in C:\, tasklist.txt (and the other names I gave it, just to be sure that overwriting wasn't causing problems) turns out to be an empty file, with zero bytes. I'm afraid tasklist.exe appears to be afflicted by the same generic problem. It does, by the way, appear in Task Manager - so it is definitely on my system

 

Hi david,

Any more info in the Event Viewer?

Have you checked for System errors in the Event Viewer at any time for any consistent errors?

Regards - Charles

 

Thanks Charles - the consistent errors since starup this morning were all DCOM errors. Specifically:

The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM within the required timeout.

This pretty well alternates with the same message but a different string {9BF122C-2892-4E91-AA8B-E071D54F2A4D}... until finally all the errors are with the second string.

Prior to these DCOM errors - the very first error was:

Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance (CLSID_UPnPDeviceFinder) encountered an error '0x80040154'. Verify UPnPHost is running and that the UPnPHost component of Windows is installed correctly.

I do, however, have a recollection of deliberately disabling Universal Plug n Play for security reasons quite some time ago - though I thought I had re-enabled it for convenience reasons... perhaps I didn't. But then, I haven't done anything with it recently, anyway...

There are also a couple of errors - one relating to Windows Media Player Network Sharing Service - which I believe I deliberately disabled via msconfig. and one relating to 'hotcore' a 'boot or system startup driver' which belonged to a program I de-installed a long time ago, I forget which. I think these are irrelevant.

Regarding SVHost - I appear to have 8 instances running, none taking up much CPU, with Mem usage varying from 27,088K at the top end (peaking at 106,884K) and the others very much smaller (5,892K is the next one, with peak of 5,920K - the remainder being in the 4500-3500K range)

What is interesting is that not only do programs seem to run fine once I have managed to start them - but they will stop and start perfectly well within themselves - thus nightly updating Firefox requires it to stop and start itself after prompts, which it does without apparent delay. Likewise Mozilla Thunderbird, my email client. Similarly, once I can get Mailwasher Pro started, Mailwasher itself has no difficulty invoking either Firefox (via a link) or Thunderbird, to actually download the mail Mailwasher Pro and I deem not to be spam. I haven't checked how well other programs behave...

 

Sorry Pete - won't edit again.

Currently I'm scanning for malware again, using Avast from a U3 drive. Will try using Startup Control Panel (provided I can work out how) when this has finished.

 

In the meantime - it occurs to me that I have a full registry backup dating from 27th of last month - when everything was hunky-dory. However, I'm somewhat nervous of double-clicking it - in case I've done something since then that would cause reinstalling that reg backup to create even worse havoc than I have at the moment. What do you think? (All my emails and files are duplicated on an external hard drive).

 

Stop the presses!! I believe I have found the answer. Will report back when I'm sure. Please do not do any more lookups or investigations on my behalf, in the meantime.
David

 

This is really most puzzling.

I stopped the Avast virus scan when it had already scanned 35 G of files, and had not yet reached C:\Windows\System32... Since I only have a 40 G hard drive, it looks like it is almost completely full, at least 88% full, possibly over 90%....

But, if I open Windows Defragmenter, it shows I have a 37.25 G capacity on the drive (OK, I'll accept that as a 40 G NTFS drive) with 44% (16.16 G) free space, in other words, only 56% full. Clearly the two bits of information do not tie up.

I do have all files and folders visible.

 

Sorry _ I've temporarily turned off my virtual memory. Is it safe to delete Pagefile.sys under this circumstance? And likewise - if I toggle off System Restore, will it be safe to delete the C:\System Volume Information\_restore{etc..}? files?

I'll then check Disk management under normal startup mode.
David