Long pause at boot

Unfortunately, I have already delivered the machine back to my customer. They were anxious to get it back, and the no autorun wasn't a big deal for them. I am however going to pay attention to this thread and see if I can put in anymore input from what I can remember on the computer. I'd really love to know exactly what hardware kryptic has to see if any of it matched the computer I was working on. When I am not working from 7am to 11pm and get more time, I'll try and see what I can do to help other people on this site. I just need to get unbusy. But then that wouldn't be all that good either.

 

I posted this just now you know but I'll do it this way.

 

Volume in drive C is WinXP
Volume Serial Number is 5464-6112

Directory of C:\qoobox

12/21/2007 03:21 PM 808 ComboFix-quarantined-files.txt
1 File(s) 808 bytes

Total Files Listed:
1 File(s) 808 bytes
0 Dir(s) 7,292,895,232 bytes free

 

ComboFix-quarantined-files.txt

2007-07-19 13:46 34494 --a------ C:\Qoobox\Quarantine\C\Program Files\Outerinfo\outerinfo.ico.vir
2007-11-05 18:11 83008 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qidsgemk.dll.vir
2007-11-12 20:09 81472 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\jgcdyuau.dll.vir
2007-11-13 22:13 130333 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bbeeg.bak2.vir
2007-11-14 22:14 102978 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bbeeg.bak1.vir
2007-11-15 21:19 105434 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bbeeg.ini.vir
2007-12-22 10:48 352 --a------ C:\Qoobox\Quarantine\Registry_backups\services_nm.reg.dat
2007-12-22 10:50 2185 --a------ C:\Qoobox\Quarantine\C\ComboFix\errdbg.dat.vir

 

That is I presume the contents of the text file? Not what I had expected ..... looks as though the format of it has been changed since I last requested one. Doesn't appear there will be anything helpful in there anyway. Thanks!


electronerdz - I look forward to seeing more of your input to WindowsBBS, as your time allows. I'm not convinced, as I'm sure you already gathered, that the Shell Hardware Detection service is actually the culprit. However, if I'm wrong in my previous conclusion RE: Zone Alarm and the ScanningProcess.exe, I do plan to address that service's configuration, as well as others loading under the same instance of svchost.

 

electronerdz, did the machine Zone Alarm on it?

And what about my hardware config do you want to know exactly?

 

I was playing around with the dll files and I managed to get the original xpsp2res.dll back in and the extra languages in the regional settings are gone and all weird characters except this one

http://download.yousendit.com/D5DDEB0006BAD2F0

But, also I got this error message when booting in windows. I think it might have been because I was doing stuff before everything loaded but I think it's important.
http://download.yousendit.com/367B45524AADAF97

 

That error message is in reference to your overclocking program's tray icon. We'll come back to that.

Sure happy to hear that restoring the dll repaired most of the language problem. Let's unregister and re-register the dll. Click Start>Run and paste the command below then hit enter.

regsvr32 /u /s xpsp2res.dll

Then do this one. You should get a Succeeded message.

regsvr32 xpsp2res.dll

May require a reboot, but see if that fixes the Security Center icon in the control panel.

Did you try renaming the ScanningProcess.exe file yet?

 

Well I was referring to what the error was with. Namely, System Shell Notification

When I tried to unregister I didn't get a Succeeded message.

I did restart just to see and problem remains.

 

The message was telling you that it couldn't create the tray icon for the overclocking app. Did it happen again on reboot? Is the icon missing?

You would not have gotten a message unregistering the dll because the silent switch (/s) was used in the command. You're sure that you used the original xpsp2res.dll? Did you compare version numbers with the one that I indicated to use from the C:\WINDOWS\$NtUninstallKB894472$ folder?

 

No, didn't happen again.

C:\WINDOWS\$NtUninstallKB894472$ = 5.1.2600.2180
The one before = 5.1.2600.2653

I tried to put C:\WINDOWS\$NtUninstallKB894472$ the the system32 but when I did it read 2653. And it is in C:\WINDOWS\system32\dllcache now but 2653 only keeps coming back.

Also when I try to unregister (without /s) I get an error. Something about DllUnregister Service could not find entry point.

 

I did and it did kill the problem but so did disabling the process electronerdz spoke of.

 

And that confirms my suspicion. The slow boot problem is caused by Zone Alarm's ScanningProcess.exe

When it hangs, it causes many other processes to hang with it. Why disabling the SHD service is a viable workaround too I don't know. I will research it further and try to find a connection between them, but for now you have just a few choices to prevent the hang at logon.

1. Disable (manual may work too) the SHD service.
2. Dump Zone Alarm
3. Try the following solution I found that many report worked for them.

Older versions available here. No need for you to get the trial of version 7 either. You do have the installation file or cd? And the license number?

I will continue to look into a better and effective way of getting the correct working xpsp2res.dll in place, and let you know something asap.

 

I got the one from C:\WINDOWS\$NtUninstallKB894472$ to get in and all is well!!!

At least for strange characters.

But how did you know the one from C:\WINDOWS\$NtUninstallKB894472$ would work.

 

Edit

That's great!

 

I didn't. I was basing the recommendation on file size, date and KB package it came with. Luck of the draw.

 

Would this Zone Alarm fix still work if I started with 7 from XP install?

 

Not the way I read it. You need to start with 6.1 and then do an upgrade installation to 7.

 

Well I have had that little bit of a delay with Zone Alarm since ver 6 but that was never as long as this 2 mins.

Plus my laptop is also running ZAS 7 and I don't get a 2 min delay.

Also, my machine always had ZAS 7 but I didn't have this delay all the time.

 

Are both machines running the exact same version, with the exact same update signatures?