Resolved super slow startup, round 2

Hello,

A couple of weeks ago, I started a thread because of super slow startup which began around the time of the last Windows Update, and I'd ID'd the wuauclt.exe file as the culprit of mega memory usage. I was referred to the Malware and Virus Removal (MVR) forum, where I received help in finding and removing a rootkit. Here is that thread: http://www.windowsbbs.com/malware-v...d-processes-eating-up-memory-no-log-post.html

Unfortunately, although the computer is now clean, I am still experiencing super slow startup. In fact, it's getting worse. This morning it took OVER AN HOUR for a full boot and "normal" usability. I suspect the rootkit wasn't causing the slowness, but was found as a result of diagnosing the slowness.

One of the things that was identified in the MVR forum as problematic is the fact that I'm using a 7-year-old computer with only 256 MB of RAM. There are, however, 5 other computers in my office which have identical hardware, and none of them is experiencing this problem.

The wuauclt.exe file is still running extensively at boot, and consuming much resources, although it has a different "ID" (registry key? CLSID?) associated with it. This is noted in the the thread linked to above, complete with the IDs of the wuauclt.exe file both before and after the rootkit removal.

I've set Process Explorer to run at boot, and watched what was happening this morning while the computer was booting. While I don't understand all the info that's presented, I can certainly look for specific info and report back here if asked to.

I understand that in order to run smoothly, I need to have more RAM. But I also know that until about a month ago, there was no problem, and can't believe that one machine in an office of 6 would stand out in this way. There *must* be something else going on...

 

Did you defrag the computer after cleaning it?

 

Hi Whiskeyman,

I had recently defragged the computer (within the past month) in an attempt to speed it up. When I analyzed it prior to defragging after malware removal, it said I didn't need to. So, no, I didn't defrag.

 

Hi Harpo, It would help us if you posted your computer system details and your OS & SP. Neil.

If this is your main system it would be helpful if you add your system details to your profile. Please click on the link and follow those instructions it could save some time when resolving this or further issues.

A common error is to forget to show your system details in your profile
Quote:
To have your system specifications displayed in your profile, you have to click the link Edit Options, and under Thread Display Options > System Specifications select Yes from the drop-down menu.
If you do add your system specifications be sure to do the above

 

Harpo, bringing your machine up to 512 mb of ram would be of great benefit, but it would not fix the problem that you are experiencing.
Have you run Disk Cleanup, or either ATF - Cleaner or CCleaner both are excellent cleanup utility's and are free.
The Registry Clean in CCleaner is optional you do not have to use it if you are against Registry Cleaners. I have used it on occasions and have not had problems, but other people have reported malfunctions after using it.
Backing up would always be highly advised before using any Registry Cleaners.
CCleaner from memory will do a Registry backup for you, so if things go bad you can go back to your original Registry.
If any of my XP machines would be in a position as yours is in I personally, if the cleanup should not help would perform a Repair Install. Again there would be no guarantee for success either.
For this you would need your original Windows XP CD and create a SP3 slipstreamed Windows XP SP3 CD.

 

@hawk22, we are looking at replacing our computers before the year is out, so the RAM issue will go away (yay!). I ran TFC during the malware removal, and regularly run CCleaner (even created a .bat file to automate it). I also have a registry cleanup/repair tool that I run occasionally.

One thing I hadn't done was run chkdsk, which I now have. It was unable to complete, and it seems perhaps there's something relevant to the question I have posted here: http://www.windowsbbs.com/windows-xp/94890-post-malware-removal-smart-drive-issue.html.

Here's the relevant text of the chkdsk screen:

Re: F parameter not being specified, please review the link above for my post on that problem - the drives usually used by the U3 smart drive are E and F.

 

Hi Harpo, chkdsk has found errors and I would suspect the infections are likely to have caused some file damage so running an XP repair installation would be my next step. It could take a long time to track down any damaged files and repair them manually, unless somebody knows of a better way.

Have you run any tests on the hard drive?

 

No, I haven't. When I look in Device Manager to see who manufactured the hard drive, what I get is a string of letters & numbers. If I select Properties, under Manufacturer it simply says "(Standard Disk Drives) ".

 

Just done a quick search and it might be a Seagate but can't be sure. Best take off the cover and have a look at the drive and make a note of the make and model. Once you have this you can go to the manufacturers site and download diagnostics for the drive.

It would help us to have the model number of the computer IBM NetVista (number?)

 

I just came across this, looks like you are not the only one to have this problem.

Look down the list of posts for the one dated September 02 2010 11.23am.

http://social.answers.microsoft.com...e/thread/dd277abb-bb6f-4136-be3c-9b71186f48ae

 

8303-42U (I think).

Very informative. Good to know I'm not alone!

It's done. We'll see what happens. Thanks.

 

I haven't experienced any further problems since my last post six days ago, so for the time being I guess this needs to be marked as resolved. Thanks to everyone who responded.