Serious bootproblem

"Macamba" wrote in message


> "Daave" wrote:

>> If you don't mind using the keyboard, there's always:
>>
>> 1. Windows Key + R
>> 2. eventvwr.msc
>> 3. Enter

> Hi All,
>
> Thanks for your replies in the aria of how I can start up the Event
> Viewer.
> I think the suggestion Daave gave is the one best suited for me, as I
> do not
> have a 'My Computer' either in my start menu, nor on my desktop. But
> many
> roads lead to Rome.
>
> On the issue of 2-3 minutes start up... It took me half an hour before
> my
> system was responding to instructions of me. I think the timing of the
> events
> was as follows:
> - 2-3 minutes: Desktop appear
> - 15 minutes: Taskbar and icons appear
> - 30 minutes: System starts to respond
> After that starting a new program takes more time than previously
> observed,
> as in several minutes, instead of several seconds.
>
> I'll surely will scan for malware. I thought that was secured. But I
> might
> have to conclude it was not secure enough.

Malware, unfortunately, is always a possibility. In the event there is
no malware, the next most common cause is the presence of certain
anti-malware programs! Often, they are configured to scan the entire
hard drive every time you boot up the PC. It's better to schedule a scan
for overnight when you are not using the PC and won't experience any
kind of performance hit.

Question: After the 30 minutes, does your system perform well?

I don't know much about Bit Defender, so I can't give you any feedback
regarding it. However, you stated in another post that you had been
running McAfee. It's possible it was never uninstalled completely (not
your fault; the uninstaller is not a good one). In case you haven't used
it, there is a Removal Tool (MCPR.exe) from their site you should use:

[URL="http://service.mcafee.com/FAQDocument.aspx?id=TS100507&lc=1033"]http://service.mcafee.com/FAQDocument.aspx?id=TS100507&lc=1033[/URL]

If still no joy, configure a clean boot:

[URL="http://support.microsoft.com/kb/310353"]http://support.microsoft.com/kb/310353[/URL]

How is the bootup time after you configure a clean boot? If it's fine,
then you know it's one of your startup programs/processes. Use the
process of elimination to detemine which one it is.
 >> Stay informed about: Serious bootproblem 

Hi Gerry (and others),

Thanks for your support until now. I just ran a check using Spybot. Only two
problems:
1. DoubleClick Cookie
2. Registry change in Internet Explorer:
HKEY_USERS\S-1-5-21-548039337-2906353147-2206293470-1006\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff
(and yes, I already posted about the second problem. Apologies).
As far as I see not really earth shattering problems. I believe I can live
with these two problems.

I will install the other program you advised me, and will boot in safe mode
to run a check. Hopefully that will give me more joy.

The story continues...

Macamba

"Gerry" wrote:

> Macamba
>
> From what you say I suggest you need to check for malware before
> investigating other problems.
>
> I suggest you download and run Spybot S & D (freeware version). There
> is a freeware version buried in this link:
> [URL="http://www.safer-networking.org/en/spybotsd/index.html"]http://www.safer-networking.org/en/spybotsd/index.html[/URL]
>
> Malwarebytes' Anti-Malware
> 1.32 -freeware (if you upgrade you pay).
> [URL="http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html"]http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html[/URL]
>
> Run Malwarebytes' in safe mode and turn off your current anti-virus
> before you do to avoid a conflict. Disregard the invitation on the web
> site regarding the Registry Optimiser -a Registry Optimiser is not a
> helpful utitity.
>
> aheh1ims.SYS: I am not sure what to make of this item.
>
> Go to Start, Control Panel, Folder Options, View, Advanced
> Settings and verify that the box before "Show hidden files and
> folders" is checked and "Hide protected operating system files
> " is unchecked. You may need to scroll down to see the second
> item. You should also make certain that the box before "Hide
> extensions for known file types" is not checked.
>
> Try again to see if you can locate aheh1ims.SYS
>
> These lines are strange and seem to be conflicting
> Geladen stuurprogramma \SystemRoot\System32\Drivers\NDProxy.SYS
> Kan stuurprogramma niet laden \SystemRoot\System32\Drivers\NDProxy.SYS
>
> I have found other reports of this combination in Google. NDProxy.SYS is
> a Microsoft file genuine but malware has been known to create fake file.
> In Windows Explorer check the file detail especially the
>
> For the files to be shown as loading in the ntbtlog.txt files there must
> be a StartUp item.
>
> A safer way than msconfig to disable / remove unwanted start up items is
> to use Autoruns.
> [URL="http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx"]http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx[/URL]
>
> With Autoruns you can uncheck an item, which disables it from starting,
> or you can can right click an item and then delete it. If you uncheck
> you can recheck to re-enable the item. It is a much safer approach than
> editing the Registry. Another useful feature of the programme is that
> you can right click an item and select Search Online to get information
> about the item selected.
>
> Please check aheh1ims.SYS
>
> I am still researching the NDProxy.SYS oddity.
>
> --
>
>
>
> Hope this helps.
>
> Gerry
> ~~~~
> FCA
> Stourport, England
> Enquire, plan and execute
> ~~~~~~~~~~~~~~~~~~~
> Macamba wrote:
> > Hi Gerry,
> >
> > You raise a few interesting observations. Yes, I have 'Nokia PC Suite'
> > installed. It worked fine in the past. But as I just tried to
> > synchronize with it, I found out synchronization failed. As a matter
> > of fact, tiered of having to plug in the bluetooth dongle in my
> > system I pushed it in, and never got it out again. Might that create
> > the issues?
> >
> > Malfunctioning devices:
> > Again the issue with a Dutch OS. I think I found what you were
> > requesting. I do not have anything listed under 'Problem Devices'.
> >
> > Anti-virus and anti-spyware arrangements?
> > I have just installed Bitdefender as anti-virus software. Before that
> > I had MacAfee installed. I do not have specific software for
> > anti-spyware.
> >
> > aheh1ims.SYS:
> > That is a nice one. I searched for it in 'Windows', and after that in
> > 'Program Files'. I had no luck in finding it. I looked it up in my
> > ntbtlog.txt file and found out it was loaded from
> > \SystemRoot\System32\Drivers\. When I tried to find the file in
> > C:\WINDOWS\System32\Drivers\ I came up empty. So, although it should
> > be loaded, it does not reside on my harddrive.
> >
> > Finally your request to check my registry, yes it contains
> > D20EA4E1-3957-11d2-A40B-0C5020524153 on the location you mentioned. It
> > contains:
> > Name - (Default)
> > Type - REG_SZ
> > Data - Systemmanagement
> > (again translated from Dutch).
> >
> > Should I remove the Bluetooth dongle from my system?
> >
> > Thanks for your help.
> >
> > Macamba
> >
> > "Gerry" wrote:
> >
> >> The question is what is calling DCOM and this may be difficult to
> >> determine.
> >>
> >> This guid ACF50018-41F8-476D-85FD-CD953DAE4A49 is also difficult to
> >> identify. I found a reference to Nokia PC Suite. Does this ring any
> >> bells?
> >>
> >> Are any devices malfunctioning?
> >>
> >> Select Start, All Programs, Accessories, System Tools, System
> >> Information. Open Components under System Summary and click on
> >> Problem Devices. Is anything listed there?
> >>
> >> Are there any yellow question marks in Device Manager? Right click on
> >> the My Computer icon on your Desktop and select Properties,
> >> Hardware,Device Manager. If yes what is the Device Error code?
> >>
> >> We may need to try to rule out malware. What are your anti-virus and
> >> anti-spyware arrangements?
> >>
> >> aheh1ims.SYS What is this item in your ntbtlog.txt? Right click on
> >> the file in Windows Exp;orer and select Properties. What does it say
> >> about the purpose and source of the file?
> >>
> >> There are too many entries in your ntbtlog.txt to check. I looked
> >> at a few and the above was the only mystery.
> >>
> >> I do not know what controls whether Administrative Tools dispays in
> >> Control Panel.
> >>
> >> Using Regedit check whether you have this key. This is just a guess
> >> on my part.
> >> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D20EA4E1-3957-11d2-A40B-0C5020524153}
> >>
> >> --
> >>
> >>
> >>
> >> Hope this helps.
> >>
> >> Gerry
> >> ~~~~
> >> FCA
> >> Stourport, England
> >> Enquire, plan and execute
> >> ~~~~~~~~~~~~~~~~~~~
> >> Macamba wrote:
> >>> Hi Gerry,
> >>>
> >>> I think I found the event viewer you mentioned. I found an
> >>> interesting entry when my system was booting:
> >>> DCOM error
> >>> Type event: Error
> >>> Source of event: DCOM
> >>> Category of event: None
> >>> Event-ID: 10005
> >>> Date: 17-1-2009
> >>> Time: 10:30:05
> >>> User: WALHALLA\Macamba
> >>> Computer: WALHALLA
> >>> Description:
> >>> DCOM got the error message 'The service did not respond to the start
> >>> or manage(?) instruction in the correct way.' while startint the
> >>> ServiceLayer-service with the arguments" to start server
> >>> {ACF50018-41F8-476D-85FD-CD953DAE4A49}
> >>>
> >>> (Hope my translation is usable...)
> >>>
> >>> Is this something you can use?
> >>>
> >>> "Gerry" wrote:
> >>>
> >>>> Macamba
> >>>>
> >>>> Please post copes of Error Reports as they appear in Event Viewer.
> >>>>
> >>>> Have a look in the System and Application logs in Event Viewer for
> >>>> Errors and Warnings and post copies here. Don't post any more than
> >>>> 48 hours ago.
> >>>>
> >>>> You can access Event Viewer by selecting Start, Control Panel,
> >>>> Administrative Tools, and Event Viewer. When researching the
> >>>> meaning of the error, information regarding Event ID, Source and
> >>>> Description are important.
> >>>>
> >>>> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
> >>>> [URL="http://support.microsoft.com/kb/308427/en-us"]http://support.microsoft.com/kb/308427/en-us[/URL]
> >>>>
> >>>> A tip for posting copies of Error Reports! Run Event Viewer and
> >>>> double click on the error you want to copy. In the window, which
> >>>> appears is a button resembling two pages. Click the button and
> >>>> close Event Viewer.Now start your message (email) and do a paste
> >>>> into the body of the message. Make sure this is the first paste
> >>>> after exiting from Event Viewer.
> >>>>
> >>>> --
> >>>>
> >>>>
> >>>>
> >>>> Hope this helps.
> >>>>
> >>>> Gerry
> >>>> ~~~~
> >>>> FCA
> >>>> Stourport, England
> >>>> Enquire, plan and execute
> >>>> ~~~~~~~~~~~~~~~~~~~
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>
> >>>>
> >>>> Macamba wrote:
> >>>>> Hi,
> >>>>>
> >>>>> I have a fairly new system (8 months), using an AMD64 dual core
> >>>>> processor with 4G internal memory. As operating system I use XP
> >>>>> Home/SP3.
> >>>>>
> >>>>> I noticed that booting the system takes a lot of time (2 -3
> >>>>> minutes). I often gaze at the picture of my desktop waiting for
> >>>>> something to happen. All the time I see no icons on the desktop,
> >>>>> nor is a taskbar available.
> >>>>>
> >>>>> The previous week I bought myself a HP Deskjet D2560. And because
> >>>>> I was not paying attention during installation a lot of junk was
> >>>>> installed on my harddrive (which I deinstalled yesterday). Today I
> >>>>> started up XP, and could not make it do anything. Everything I do,
> >>>>> like starting the taskmanager, takes more then 5 minutes. I'm not
> >>>>> able to do anything. I can not start a browser to look on the
> >>>>> Internet for solutions.
> >>>>>
> >>>>> I'm rather at a loss, and considering to reinstall the system. But
> >>>>> me thinks that a daunting task, as all the drivers need to be
> >>>>> gathered, all software needs to be installed and the like. So I
> >>>>> was hoping for some pointers to do before I wipe the hard drive
> >>>>> clean.
> >>>>>
> >>>>> Macamba
>
>
>
 >> Stay informed about: Serious bootproblem 

Macamba

Did you intentionally set up your computer to have no Log Off?
[URL="http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/93519.mspx?mfr=true"]http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/93519.mspx?mfr=true[/URL]

The other explanation is a Trojan which is more serious than Double
Click.
 >> Stay informed about: Serious bootproblem 

Macamba

Spybot was to test the water. Try it again.
 >> Stay informed about: Serious bootproblem