Techie WIndows XP Home question

[Digsy]

One for the hardcore IT bods:

I'm doing some IT support for a friend but this one has pretty much got me flummoxed.

Their Windows XP boots VERY slowly, but not in a way that I've seen before. It boots fine up until the dektop and icons appear. The Start menu and taskbar appears, the clock appears in the system tray but then it all goes to pot and sits there for anywhere from a couple of minutes to a couple of hours before the other system tray icons (MSN / NAV etc) appear and the boot completes. During this period, you cannot do anyting that involves the taskbar of start menu. In fact hovering the cursor over the taskbar turns it into the eggtimer.

That's odd enough in iteself but also during this time you can use the PC pretty much normally providing you don't need to go anywhere near the start menu. Most apps seem to run fine if you can get at them via a desktop shortcut.

 

I have done a complete virus scan, checked the registry for problems in the RUN and RUNONCE areas of both CURRENT MACHINE and CURRENT USER. There is nothing in the Startup folder. I have even sat and watched taskmanager during the long boot up wait and no spurious processes seem to be running.

 

There is a steady pulse (one flash per second or so) from the hard disk light during the pause.

 

One final thing: I checked the event logs and there is a long stream of (if I remember the words correctly) " failed because all pipe instances are full" (or something along those lines).

 

Any ideas?

[GeordieSteve]

Run MS config and see if anything is booting on startup that shouldn't

[caliAl]

While using MSCONFIG try doing a clean boot. Disable everything on start-up from the start-up tab and then switch to the services tab and disable all non Microsoft services.

[Digsy]

Done it already - and yes, it boots fine while running diagnostic boots using MS Config (it also boots fine into safe mode).

 

The thing it that I disabled everything using MS config and it booted. I then went through and re-enabled items one by one (also checking that they were legit at the same time) and got to having everything enabled and it still booting up.

 

Then I changed the registry to make the MS Confg changes permanent and hey presto - it failed to boot again.

 

As far as I can see, the startup tab in MSConfig is a GUI for the RUN areas in the registry (because if you run REGEDIT after using MSConfig you will only see the items you have ticked in the startup tab).

[Ian C]

If you haven't got far with installing windows, as I suspect this is on Sarah's new PC? Then just flatten it and start again If it happens again it's either a) a gammy driver, b) a gammy software package, or c) gammy hardware.

 

All of these you can diagnose using divide and conquer or staged installs...

 

-Ian

[Alex]

Stop the NAV and anything else that is in the system tray from loading in SERVICES then testa again.

[Digsy]

If you haven't got far with installing windows, as I suspect this is on Sarah's new PC? Then just flatten it and start again If it happens again it's either a) a gammy driver, b) a gammy software package, or c) gammy hardware.

 

All of these you can diagnose using divide and conquer or staged installs...

 

-Ian

 

Nope, this is a different PC. Sarah's PC is still in a combination of warehouses and courier vans

 

I'll have a closer look at the services again tonight.

[HunterJ]

You could try cleaning out the prefetch directory...

 

Jamie

[Digsy]

You could try cleaning out the prefetch directory...

 

Jamie

 

Yep, tried that too

[Ian C]

Have you tried checking task manager for something eating 100% CPU time while the big heaving chug is going on? Also if you can get the actual event log error, that'd be extremely useful

 

-Ian

[cornimac]

Does sound like a dodgy driver or service that is hogging all the resourses. Try exporting the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

key (right click) then delete everything there. Move all of the shortcuts out of the Start Up folder and reboot. See if it makes a difference. If yes then gradually put all the stuff back until you see the culprit. If not then it is a driver or service.

 

Also sounds a bit like memory / swap file issue. Is the system hard disk full? What about the swap file settings?

 

One other thing you could try is BootVis but this can normally optimize the start up of a healthy system and may not solve your isse but could be worth a try. You can find it here >> Boot Vis

 

TBH, if you don't get much joy you may as well wipe the disk and start over.

[Digsy]

Have you tried checking task manager for something eating 100% CPU time while the big heaving chug is going on? Also if you can get the actual event log error, that'd be extremely useful

 

-Ian

 

I wish people would read my posts properly

 

Yes, I've looked at task manager while booting. System idle process uses between 95 and 99% of the CPU time during the whole shebang. One or two other (legit) processes hunt around between sod all and 2%. There's nowt in there that makes me suspect a process is hogging everything.

[tonyhawk]

" failed because all pipe instances are full"

 

It sounds like it's waiting for someting to reply; pipes are used for communication, either between devices/computers, or between applications, and it could simply be issuing a command or request, but timing out waiting for a response?

 

Could you find out the exact error? If you can get the error id and the Source, then go to http://www.eventid.net, this is a really useful site for answers to event errors. Put in the event ID, then look for the corresponding Source.

 

Hope this helps.

 

If you have no luck, then post or PM me the full error and I'll have a look.

[Digsy]

Does sound like a dodgy driver or service that is hogging all the resourses. Try exporting the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

key (right click) then delete everything there. Move all of the shortcuts out of the Start Up folder and reboot. See if it makes a difference. If yes then gradually put all the stuff back until you see the culprit. If not then it is a driver or service.

 

As stated above - already done, both manually and using MS Config.

 

Also sounds a bit like memory / swap file issue. Is the system hard disk full? What about the swap file settings?

 

Must admit that I didn't check either of those. I have a hardware diagnostics disk on me today that I'll use tonight though.

 

One other thing you could try is BootVis but this can normally optimize the start up of a healthy system and may not solve your isse but could be worth a try. You can find it here >> Boot Vis

 

I came across that during a websearch in desperation but as you say it didn't quite sound like what was needed, but it may be worth a download later on.

 

TBH, if you don't get much joy you may as well wipe the disk and start over.

 

Well, theres yet another issue. The person who bought the PC got it with one of those "pre-installed system on a CD" things from HP (bought from PC World - aaargh!). Their response to any query is "rebuild the system using this CD". The problem is that the owner swears that no CD was ever supplied. Whether this is true or its been lost is another issue, but suffice to say there is no CD.

 

Not really an issue as I could put all my software on it, but there is a bazillion downloaded programs on there, none with any of the relevant setup files remaining. Plus the owner only has access to a dialup internet connection so re-installing is going to be a pain.

 

Put simply, the owner isn't exactly PC-literate. Do I know how to pick 'em or what?

[raymanuk]

Have you tried defragmenting the disks and then running a full scandisk on the HDD?

 

Also if you are having problems with space on the HD turn off the System Restore. Properties of My Computer - System Restore TAB.

 

A problem I had once was that a machine I was looking at did something similar, but before hand it had a virus infection. Even though this was deleted by the AV the system restore still kept a copy of it and reinstalling itself or trying. Once the system Restore was turned off and rescanned it was back to normal.

 

Cheers,

[cornimac]

Put simply, the owner isn't exactly PC-literate. Do I know how to pick 'em or what?

 

Know the feeling mate. Being the good Samaritan doesn't always pay. Hence forth you own all of their problems.. Good luck

[Aerotop Dave]

Check network connections - does it say a network connection is unplugged?

 

I've seem these symptoms when it's expecting to find a LAN or broadband connection and sits there for 30 seconds or so trying to find it before letting you carry on. Particularly common if you install + update via such a connection and then disconnect - it expects the connection to still be there as it was present during the install process.

[Digsy]

Check network connections - does it say a network connection is unplugged?

I've seem these symptoms when it's expecting to find a LAN or broadband connection and sits there for 30 seconds or so trying to find it before letting you carry on. Particularly common if you install + update via such a connection and then disconnect - it expects the connection to still be there as it was present during the install process.

That might be relevant even though the PC has never been connected to a LAN or a router or any other kind of network other than the internet. Apparently when the PC first started to crap out, one of the initial symptoms was that it would lose all the Network Connection settings (i.e the Network Connection folder was empty even though a Freeserve account was set up in there).

[Lucifer]

MOst likley a service is slow to start, or as stated a netwrok connection.

 

1. Is safe mode as slow?

2. Normal made? All auto services started?

3. Turn on Full object loggin in security policy, look at event log.

4. Boot safe with networking, is point 1 slow? if not it will prove point 2.

 

Martin

[Digsy]

Most likley a service is slow to start, or as stated a netwrok connection.

 

Yep, seems to be the concensus. Cool

 

1. Is safe mode as slow?

2. Normal made? All auto services started?

3. Turn on Full object loggin in security policy, look at event log.

4. Boot safe with networking, is point 1 slow? if not it will prove point 2.

 

1. Safe mode is fine, as is diagnostic booting using MS Config.

2. I'll check tonight. Verify that al services set to "Automatic" are actually started, yep?

3. No idea how to do that, I'm afraid

4. I see what you are getting at. If Safe Mode With Networking then its almost certainly looking for a network.

Thanks

[Lucifer]

POst up what you find from there, the other option is to but boootlogged and then look at the bootlog.txt file to give you clues, if you dont understand it, email it to me.

 

Look here for the general ide:- http://forums.pcworld.co.nz/archive/index.php/t-42021.html

 

Let us know the results.

[Digsy]

Right-ho.

 

Tried the following:

Checked whether any services set to Auto were not running. Found that "Remote Access Auto Connection Manager" wasn't playing ball so I disabled it and rebooted (everything else looked ok).

 

Woo-hoo! The PC fired up first time, as it should do - straight it and no messing. Just to check it wasn't a fluke I rebooted again, and it hung. Tits. Oddly enough it hung while starting MSN Messenger, so I disabled that in the registry and rebooted again, but it still hung. Double tits.

 

Just another details: Last night my girlfriend (as it her friend's PC) had a go and managed to coax it a bit further into life by creating a new user account with Admin rights. Since this was done, logging in as any user now gets you an active taskbar and start menu right from the off, but the system tray icons still take fecking ages to appear - but at least you can now use the PC pretty much as normal.

 

I had another look at the event logs and the "pipe instances" error I reported earlier has gone. Check them out:

[tonyhawk]

I have gone through some of the errors, but on the whole, I would guess that this is a PC that has had Windows XP installed and then had SP 2 added afterwards, which if fraught with problems, and I've yet to see one that works with that config.

 

Though I hate to say it, a rebuild might be easier, and better, but if you have no means to install it, then that might be a problem!

 

I hope this is of some help:

 

8193: VSS: This is a Shadow Copy error that occurs when you boot in safe mode, and can be ignored

 

4609: Event System:

 

This appears to be an issue with installations of XP that have had SP2 installed afterwards, new security settings aren't applied properly. The following steps should fix it:

 

1) Go to Start -> Settings -> Control Panel -> Administrative Tools.

2) Run “Local Security Policy”.

3) Go to Security Settings -> Local Policies -> User Rights Assignments.

4) Double click on “Create global objects”. The correct default settings are “Administrators”, “INTERACTIVE”, and “SERVICE”.

5) Double click on ''Impersonate a client after authentication''. The correct default settings are “Administrators”, “ASPNET” (if you have the .NET Framework installed) and “SERVICE”.

Even if the settings are set correctly, you may need to “refresh” them to fix the problem. To do this, on each policy, remove one of the entries (“SERVICE” is probably the best to remove), then press OK to save the changes, and then go back in and add it back in again (click “Add User or Group...”, type “SERVICE” into the white box, and press OK). Then close the Local Security Settings box and reboot.

 

1517: Userenv: This is a bit generic, but basically says that the user profile was locked, and couldn't be loaded/unloaded properly. In the most part it can be ignored, unless it reccurs a lot.

 

1524: Userenv: This is very similar to 1517, and relates to the users profile not unloading properly.

 

2002: Perflib: This error means that one of the performance counters failed to receive information, but to be honest, it can be ignored:

 

As per Microsoft: "The performance counter provider could not return performance counter data within the specified open timeout period. Either there is a problem with this performance counter provider or the service it is collecting data from, or the system was too busy when this call was made"

 

1000: Application Error: This is really dependant on the detail in the error, which isn't in the text file you posted.

 

4099: WMIAdapter: This indicated that a performace counter could not connect to the WMI interface, which is an interface for reading such counters. You can ignore this one.

 

4353 & 4356: Event System: both of these relate to the Com+ subsystem failing to connect to something, there are quite a few of these, and could indicate the reason for the slow down if they're waiting for something and failing, like I suggested in my earlier post?

[Digsy]

Thanks Tony.

 

Pretty sure this PC hasn't had SP2 installed though. In fact its a 2001 install so it might not even have SP1. It has had a few "hotfixes" though, so ot must have seen Windows Update at least once.

 

I'll run through the security things tomight and see if it helps, though.

 

Thanks again

[Digsy]

1) Go to Start -> Settings -> Control Panel -> Administrative Tools.

2) Run “Local Security Policy”.

 

I'm afraid I can't find Local Security Policy under Admin Tools, dude. Are you sure that XP Home has this? Isn't it just XP Pro?

 

BTW, the XP install is 2002 vintage XP Home with no SP1. Just a few hotfixes.