Tweaking.com Support Forums
Main Forum => General Computer Support => Topic started by: jmk909er on February 19, 2015, 08:24:48 pm
-
Hi, I have a Toshiba Laptop Satellite P744 for about 3 years now, with windows 7. I keep having this recurring situation when I login. It does not happen all the time but seems to be increasing in frequency. Here is what happens:
When I login the bottom task bar is no longer translucent, the start menu and explorer windows are all different, not translucent. It looks to me more like XP.
Shortly after starting I get an error balloon pop up from the task bar saying: "Failed to connect to a windows service, windows could not connect to the system event notification service...etc" I have a screenshot of the entire message.
Then I get another error message pop up saying: "NT Kernal System has changed since the last time you used it"
Sometimes if I restart it will start properly again in windows 7 but not all the time and sometimes I have to do a system restore to get it back and this is happening more and more. Does this mean my hard drive is dying? Is it time to replace it? My laptop is about 3 years old and I am a pretty heavy user and it runs almost all the time but I really don't know what this means.
I am placing this link to screenshots I took of all the errors:
https://www.dropbox.com/sh/r8wzb4sbd...ko-CX4eYa?dl=0
I ran across this Tweeking .com Windows Repair v2.11.1 utility and ran it twice but it did not fix it. So has anyone else run into this? Is it time for a new hard drive?
-
One way to check if your HDD is failing is to run a command prompt as an admin by going Start > type cmd.exe then right click on cmd and select Run as administrator > accept the UAC then enter chkdsk /r
You will be prompted to type y and press enter then reboot for it to run after the restart.
It's full report can be found in Event Viewer by going Start > type eventvwr and press enter.
When the logs have been read expand Windows Logs - click on Application > Action > Find > then type either chkdsk or wininit and click OK or press enter.
Close the Find box to read the report.
You can copy & paste its report into the reply box by clicking on Copy > Copy details as text in the lower right pane, place the cursor in the Reply box, right click and select Paste.
As well as any file fixes you will be looking to see how many KBs there are in bad sectors.
How far do you have to restore back to initially resolve the error - is it prior to this month's Windows Updates or a program you had installed and which AV program are you using.
Event Viewer may also have a record in Errors of the NT Kernel Event
Click on Errors then on View All Instances of This Event in the lower right pane and you can copy & paste any by the same method.
Boot up into the advanced boot options by tapping F8 as you switch on, use the cursor keys to select Safe Mode with Networking and download and run a scan with the free version of MBAM - unchecking the box to run a trial run of the Premium version. https://www.malwarebytes.org/
Let us know if MBAM has found anything.
-
Hi Boggin and thanks for your help. I did what you said and it took hours to run, the results will be below:
You asked: "How far do you have to restore back to initially resolve the error" It has been erroring out more and more so anytime I get a windows update or install a new program and it starts properly again I am creating a restore point. That way when I restore it doesn't have to do all the updates again. My anti virus is Symantec Endpoint Protection, I have used it for years and never had an issue with it.
The problem seems to be occurring more and more. I suspect that my hard drive is going and I would just go ahead and replace it but I don't want to do it if its not bad. Right after running the diagnostic it has booted up again with the errors. Now it seems to do this most of the time.
Log Name: Application
Source: Microsoft-Windows-Wininit
Date: 2/20/2015 11:36:05 AM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: jmk909er-PC
Description:
Checking file system on C:
The type of the file system is NTFS.
Volume label is TI106332W0C.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
286464 file records processed.
File verification completed.
991 large file records processed.
0 bad file records processed.
0 EA records processed.
42 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
377530 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
286464 file SDs/SIDs processed.
Cleaning up 47 unused index entries from index $SII of file 0x9.
Cleaning up 47 unused index entries from index $SDH of file 0x9.
Cleaning up 47 unused security descriptors.
Security descriptor verification completed.
45534 data files processed.
CHKDSK is verifying Usn Journal...
34481280 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
286448 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
150600107 free clusters processed.
Free space verification is complete.
Windows has checked the file system and found no problems.
715239423 KB total disk space.
112291928 KB in 222340 files.
136076 KB in 45535 indexes.
0 KB in bad sectors.
410991 KB in use by the system.
65536 KB occupied by the log file.
602400428 KB available on disk.
4096 bytes in each allocation unit.
178809855 total allocation units on disk.
150600107 allocation units available on disk.
Internal Info:
00 5f 04 00 1a 15 04 00 a8 66 07 00 00 00 00 00 ._.......f......
d4 06 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 ....*...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
<EventID Qualifiers="16384">1001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2015-02-20T19:36:05.000000000Z" />
<EventRecordID>104684</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>jmk909er-PC</Computer>
<Security />
</System>
<EventData>
<Data>
Checking file system on C:
The type of the file system is NTFS.
Volume label is TI106332W0C.
A disk check has been scheduled.
Windows will now check the disk.
CHKDSK is verifying files (stage 1 of 5)...
286464 file records processed.
File verification completed.
991 large file records processed.
0 bad file records processed.
0 EA records processed.
42 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 5)...
377530 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 5)...
286464 file SDs/SIDs processed.
Cleaning up 47 unused index entries from index $SII of file 0x9.
Cleaning up 47 unused index entries from index $SDH of file 0x9.
Cleaning up 47 unused security descriptors.
Security descriptor verification completed.
45534 data files processed.
CHKDSK is verifying Usn Journal...
34481280 USN bytes processed.
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
286448 files processed.
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
150600107 free clusters processed.
Free space verification is complete.
Windows has checked the file system and found no problems.
715239423 KB total disk space.
112291928 KB in 222340 files.
136076 KB in 45535 indexes.
0 KB in bad sectors.
410991 KB in use by the system.
65536 KB occupied by the log file.
602400428 KB available on disk.
4096 bytes in each allocation unit.
178809855 total allocation units on disk.
150600107 allocation units available on disk.
Internal Info:
00 5f 04 00 1a 15 04 00 a8 66 07 00 00 00 00 00 ._.......f......
d4 06 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 ....*...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
</EventData>
</Event>
-
Check out this screen video and see if this helps:
https://www.dropbox.com/s/za0n88zh7r66ay1/Error%20shots.mp4?dl=0
-
Well, it looks like your HDD is fine.
Clicking on any of the Errors then on the blue online help link can give you more info and possible solutions.
This should give you more info on the SidebySide Event ID 35 but generally you can ignore it.
The DistributedCOM error could be a permissions issue so running Shane's Windows Repair program should fix that and possible the rest of the problems. http://www.tweaking.com/
Run a command prompt as an admin and enter netsh wlan set hostednetwork mode=disallow and that will remove the MS Virtual Miniport which is probably giving you the DHCP Client 1001 errors.
The MS Miniport can cause connectivity problems.
To reinstate it if you ever need it, just redo the command and use mode=allow.
Windows has a couple of its own tools that you could run - Go Start - click on Control Panel and under System and Security click on Find and fix problems.
Under the next System and Security click on Run maintenance tasks - Advanced - Run as administrator - Next - then do the same with Check for performance issues and that one will tell you if it found anything and if it fixed anything.
Restarting SuperFetch in Services may help with the Application Popup error
Go Start - type services.msc - press enter then scroll to SuperFetch - it should be displayed as Started and Auto - click on it then on Restart in the top left pane.
You don't need to worry about the ReadyBoot error http://support.microsoft.com/kb/2001347
The Windows Repair program can take a while to run but do all of the pre-requisites first, but creating an external full system image to either DVDs or an external HDD can side step the back ups.
Try the other bits first and then run WR if you still have problems.
Did you run a scan with the free version of MBAM ?
-
chkdsk shows 0 bad sectors, so that is good. If we want to be sure the drive is ding ok we could check the smart status on it as well.
I have seen the error in windows where a service didnt start up correctly, it was the event notifier service that would do it and I traced it down to a driver for IDT audio. I would see the error after a fresh install of Windows, and replacing the drive fixed it.
I say that because it shows how even a driver can cause these problems as well.
So best thing to do is to run scans to make sure the system is clean, malwarebytes, adwcleaner and even combofix. Then once that is done you should check to make sure you have all the latest drivers.
Also another thing you can do is do a clean boot, where all 3rd party programs are disabled from startup. That can help you see if the problem is related to a 3rd party program :wink:
Shane
-
My laptop seems to be going from bad to worse. I am considering doing a factory reset. Do you guys have any further suggestions? Afactory reset should fix it right?
-
A factory reset can be a cure-all but I've seen where it didn't, but it's something I've done when things weren't going right although I'll restore these days with an external saved system image.
Have you run the anti-malware scans as suggested to eliminate an infection or the other suggestions ?
-
Yeah I run Malwarebytes and Superantispyware about twice a month in addition to weekly full scans with my antivirus. I did find something in Device Drivers called Teredo Tunneling Pseudo-Interface that is showing an error. I tried to update the driver but it said it already has the latest driver. I have a screenshot.
(https://www.tweaking.com/forums/proxy.php?request=http%3A%2F%2Fs25.postimg.org%2Fw390nm0kv%2FScreenshot_2015_02_21_10_07_49.png&hash=8978598d0003afbab45c54c2232290fd042ff199)
-
Yes, that could give you problems but that's the first time I've seen incremented MS Virtual WiFi Miniport Adapters.
Run that command that I posted in Reply #4 and that will get rid of those, unless you are using a VPN - in which case you would need one of them.
For the Pseudo Interface, these are the commands I had to do once and worked for me -
Repair of Pseudo-Interface Yellow Alert
Run a command prompt as an administrator and enter each of these commands :-
netsh
int teredo
set state disabled
Then open Device Manager/View/Show hidden devices > right click on Teredo Tunneling Pseudo-Interface and select Uninstall
Open the Cmd Prompt as an administrator again and type then Enter these cmds -
netsh
int ipv6
set teredo client
Open Device Manager/Action/Scan for hardware changes.
Then select Show hidden devices from the View menu where it should now display without the yellow alert.
With Show hidden devices enabled, check for any yellow alerts in Non-Plug and Play Drivers
-
OK I ran all the commands and the Teredo Tunneling Pseudo-Interface is no longer showing in device manager at all. And there are no yellow alerts in the Non-Plug and Play Drivers when viewing Show hidden devices. I went through a restart and it is loading up properly. I will go through a few start up cycles and see how it does.
By the way thanks a lot for all your help. I will report back if its fixed or not.
-
What happened when you did Scan for hardware changes - did the Device Manager do what looked like a reset ?
I normally advise creating a restore point before uninstalling anything like that but I had success with that cmd when my Pseudo-Interface picked up a yellow alert.
Check your restore points as Windows may have recorded its uninstall.
-
Just as a matter of interest, did you click on View/Show hidden devices as the Pseudo-Interface isn't visible in Network adapters until you do.
If it's still missing and Windows hasn't recorded its uninstall, Action/Add legacy hardware has a MS one but I've never known if that is the same as the one that is normally installed as it isn't listed as a MS adapter.
These steps will reinstall it if needed, but manually create a restore point before executing them. http://answers.microsoft.com/en-us/windows/forum/windows_7-hardware/how-to-install-teredo-tunneling-pseudo-interface/754c8f29-3a87-4e77-babd-a69c8910e17e
-
Hey Boggin, maybe I don't need it?? I have gone through 5 shutdowns and start ups and I have not gotten a single error and it is booting up like it is supposed to (almost seems a little faster)
I did click on View/Show hidden devices. I just now also checked it again, scan for new devices and show hidden and I don't see the Teredo Tunneling Pseudo-Interface.
Do you think I should try to reinstall it or leave it alone?
-
While you may not need it yet, I would reinstall it http://superuser.com/questions/22290/what-is-the-teredo-tunneling-pseudo-interface
It was obviously the buggy driver that was causing the boot up problem, although I don't think you've mentioned you had this problem ?
Did you run the hostednetwork command as that can also aid boot up as they won't be there looking for an IP address.
-
Everything got unstable and locked up so I restored to yesterday. The Teredo Tunneling Pseudo-Interface is showing again but still has the error
-
How do you mean it got unstable and locked up - did it do this on its own after booting up or when you were doing something ?
I should think Event Viewer would have recorded that so check to see what it has.
While the chkdsk /r gave you a clean bill of health, see what a sfc /scannow run from an admin command prompt reports.
This article will show you how to view the trimmed CBS Log if it reports anything other than no integrity violations.
http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html
-
Hey I found a solution to get the Teredo Tunneling Pseudo-Interface fixed and clear the error here:
https://www.youtube.com/watch?v=m8UdZ0PZm6Q
I did this and the error is now clear
It got unstable while doing stuff
I'll try this for a while and see how it goes
-
I noticed that one was listed as the MS Teredo Tunnelling Adapter although I missed what it said about the error at the end.
Is yours now listed as a MS one ?
As I'd said earlier, you can get the MS one through Device Manager/Action/Add legacy hardware
Click Next > Next > Next > scroll to Network Adapter in the left pane > Next > Microsoft > scroll the right pane and click on MS Teredo Tunneling Adapter > Next and follow the prompts.
-
Yes to you last post I did that but it would install it with the error
-
Here are the errors now in the event viewer:
https://www.dropbox.com/s/c5pjuxsxked4ev2/event%20viewer.mp4?dl=0
-
Now that you are back to the yellow alert on Pseudo-Interface, create a restore point and try the instructions for its reinstall.
If that works, create another restore point to consolidate that then go Start - type msconfig and press enter.
Under the Startup tab note which boxes are checked and items running then click on Disable all -Apply - OK - then reboot to see if the computer performs any better.
If your AV program is listed in the Startup items it will reinstate itself.
If the computer no longer locks up then add one Startup item back at a time until it starts playing up again and then leave that one unchecked.
If it continues to play up with all of the Startup items disabled then under the Services tab check the box to Hide all MS services.
It is imperative that you do this before disabling the remainder otherwise you'll have serious problems.
Again, check to see what is checked and shows as Running or Stopped before disabling all.
If this gives the desired result then add the items back either singly or a few at a time, rebooting and running for a period to see if it remains stable.
If you add a few back at a time and the problem reoccurs then you will need to vet those.
What were you doing last time when the freeze occurred ? - repeating this after adding items back could replicate the freeze if any are responsible.
-
Hi Boggin, the yellow alert is no longer showing after making a correction in the registry. Also I have been checking the error about the boot driver and I can't find anything definitive on that exact driver "yyfeapq" I am pretty sure it is for one of my Brother or HP printers.
It is booting up properly now. I am going to try it for a while like this and see if I have any issues.
-
See if DriverView lists that and then you'll be able to ID its origin. http://www.majorgeeks.com/files/details/driverview.html
I think you can set it to hide MS drivers so that will make the search easier.
If your printer(s) aren't switched on before you switch the computer on, then it will initially try to load it.
I have an Epson printer that has a card reader which Windows has assigned as Z: Drive and it usually pops up to tell me that it unable to load all drives when it has finished booting.
-
Hey Boggin I think my laptop has even more issues than I think. I have been going back in the event viewer and seeing many errors not just for boot up but others. I have attached a log that you can view (hopefully) I don't want to keep wasting your time. I think maybe I should do a factory reset???
-
The Symantec Event ID 6 may be nothing to worry about but you could reinstall Symantec Endpoint Protection should it have become corrupt.
When you scroll further down in the lower pane on either of those Symantec errors, there's a link which gives you http://www.symantec.com/business/support/index?page=content&id=TECH99755
Just to ensure you are infection free, boot up into Safe Mode with Networking and run the ESET Free Online Scanner. http://www.eset.com/int/home/products/online-scanner/
Click on Advanced and check all of the boxes except the lower Proxy one - check the box for auto uninstall on completion then disable Endpoint Protection immediately before clicking on Scan.
This scan can take well over an hour but it is thorough.
The Windows Update error for your Intel Graphics update was either because you already have that driver version installed or it isn't compatible with your machine.
Do you normally get your machine updates through Windows Updates as some vendors use this method ?
Change your Windows Update settings to Check for updates but let me choose whether to download and install them so when you get the next update notification, go to Windows Update, click on where it tells you how many there are and check to see what it is offering you.
If it's giving you the Intel graphics driver again, right click on it and select Hide - you can also do this for any others you don't want.
I normally do that when it offers me one for the Bing Desktop.
If you aren't using a VPN then you don't need the MS Virtual Miniport Adapters and it is they which are causing the DHCP Client Event ID 1001.
Use the netsh wlan set hostednetwork mode=disallow command to uninstall them.
If you still have problems after reinstalling Endpoint Protection - as a buggy AV program can cause anomalous problems - and running the ESET scan, then I think the factory reset would be the best option - but let's see how it performs after these suggestions.
And you aren't wasting anyone's time :smiley:
-
Thanks Boggin I will give it a try but I am at work right now. I have to do it at home where I have a better stable connection. I'll let you know how it goes.
-
It would be worth a shot of doing a repair install before doing a factory restore.
First you need a Windows 7 disk that has SP1 already on it and isnt the factory disk, you can grab that from here
https://sites.google.com/site/linuxlablibrary/windows-iso
Then all you need to do is follow this guide
http://www.sevenforums.com/tutorials/3413-repair-install.html
A repair install will keep your programs and files while fixing Windows. Well it doesnt aim to fix it, what it does is doing a upgrade to the same version, so basically Windows gets reinstalled while keeping all your stuff. :wink:
Shane
-
Hi Boggin I ran the scan in safe mode with networking and it did find some threat items that I put in the attachment. After finishing it really had a hard time starting so maybe it had to recover something but after starting about 4 or 5 times it is starting up pretty fast again. I also ran "netsh wlan set hostednetwork mode=disallow"
I'll see how this goes for a while.
Shane thanks for your post, it looks promising if my problems continue. Thanks
-
While you can do without the Google Toolbar and you definitely don't want the ASK Toolbar, ReImage Repair could either have been a legit program that you installed or it came bundled with another download as a Potentially unwanted Program (PuP). http://www.shouldiremoveit.com/Reimage-Repair-10452-program.aspx
Given that it runs auto in the background at predetermined times and connecting to the 'net, that could well have an effect on your start up times and performance.
When you download anything, always choose the Custom option when offered and always look to see if anything else is bundled with the download where you can uncheck those boxes before clicking on Next or Install.
There seems to be some conflicting info on InstallCore TS but you're probably best without it. https://www.virustotal.com/en/file/ea44e0774b657e90beff912705cec2c3e9088b6814377f9bdf3b5e52db44f2d2/analysis/
Can't find anything on SpeedChecker B, but I'm not sure why it took a few times before the boot got back to normal.
Can you go Control Panel - under System and Security - Find and fix problems then again under System and Security click on Check for performance issues - click on Advanced then on Run as administrator and see what that reports.
-
I avoid toolbars and add ons like the plague I don't know how they got in there, I always uncheck all the extras when I download anything.
I ran Find and fix problems then again under System and Security and it shows a bunch of startup programs and ask what I do not want to run. I don't know if I need these or not. I made a video here: https://www.dropbox.com/s/tizryhf8p3fj6ui/System%20and%20security.mp4?dl=0
The errors in event viewer (see attachment) are minimal and it is starting up pretty good.
Something that happened last night when I ran the online scanner was I could not get to the boot menu. I normally hit F12 to get to the boot menu and after starting 5 times I could not get to it while starting up. The only way I could get to it was to let it finish starting up and then doing a hard shutdown with the power button, than it automatically started with the boot menu screen.
-
I've never seen Windows Host Process (rundll32) in a Startup menu before as that should reside in Windows\System32\rundll32.exe so that one could be malicious.
I have rundll32.exe neither showing in Task Manager Processes or Services or do I have the Host Process showing anywhere in my msconfig.
Have you tried the clean boot as Shane had advised earlier ?
The video was a bit too quick for me to follow but were they under the Startup or Services tab ?
The only program I have under the Startup tab is for the Epson Event Manager as I find the printer works better that way when I want to use it.
Any programs that you want to use can be started normally as and when you want them so there's no need to have them running in the background which unnecessarily takes up memory and can impact on performance as Windows has snagged.
I think I stopped Toshiba Reeltime but can't remember what it does now, but I leave all of the other Toshiba services enabled - I have a cheap Satellite C660D.
Sometimes this site will tell you if you need a particular service enabled under the Services tab http://www.bleepingcomputer.com/startups/ but Process Explorer will tell you if you have anything malicious running. https://technet.microsoft.com/en-gb/sysinternals/bb896653.aspx
When you have it up and running, click on Options and ensure the Verify Signature box is checked then hover over VirusTotal.com and check its box.
Virus Total will produce a column in blue with items marked as a low value/~50 but where there are items in red with a highish value/~50 - they will be suspect, especially if their Signatures aren't verified.
You can Google any of those and where they are malicious, removal tips are usually linked.
-
Attached is where the Windows Host Process (rundll32) is at. Should I check the box so it doesn't run?
-
The best thing to do would be to go Start - type msconfig - press enter then check to see if it's listed under the Startup tab or Services when you check the box to Hide all MS services.
Did you download Process Explorer as that should tell you if it's a legit process, but I'm reticent to advise stopping any dll32.exe and if Process Explorer doesn't snag it then I would prefer to leave that one to Shane.
Do you need Skype or Dropbox to be loaded on start up when you can boot them up on demand ?
I don't know what that Office one is for - while it may be advantageous to have something for Office preloaded, this is what I get for Xmarks for IE http://www.shouldiremoveit.com/Xmarks-for-IE-13606-program.aspx
Is that something you have personally downloaded ?
-
I have to be honest with you the process explorer is very complicated, what am I supposed to look at in there? Is it "rundll32"? Are all start up items? I did a save as of it and attached.
I do use dropbox a lot and store everything on it and not on my computer. It is also convient to be able to use different computers to get to my stuff.
I do like to keep Skype up all the time because I use it although it would be nice if it started up with a delay, it does not need to run right at start up. It could be a few minutes later.
The office one is part of MS Office that has cloud storage, I really don't need that to run.
XMarks is an app that syncs all my bookmarks across all browsers and all machines that I use. I dabble in web design and like to test in IE, Firefox and Chrome
-
As you don't need the Office Startup item then you can uncheck that.
If you would be happy with Skype to start a few minutes later, would it be any hardship to just boot it on demand ?
In Process Explorer did you click on Options in the menu bar and check the box for VirusTotal.com - anything it lists in blue is okay, it's just the red ones you need to look for/at.
Occasionally you could get a red one say as 1 or 2/50ish but as long as it's Signature is verified as a source that you know, it will be okay - otherwise you would Google it for more info and definitely if the 1 or 2 is a much higher value.
As the Host Process is verified as a MS one, it will be legit - but you haven't said whether it's listed under the Startup or the Services tab in msconfig.
It's unusual for Windows to suggest that you disable a Windows process to enhance performance and it's unlikely that an item like that would be under the Startup tab, which is for 3rd party programs starting up in the background on Boot.
When you install a program they can insert themselves into the Startup menu, adding time to your boot - so it's worth checking to see if that's the case and whether you want it in there.
One thing to remember is that if you have unchecked a program under the Startup tab and you uninstall it, recheck its box in msconfig first as you will be left with orphan files and that item will remain in msconfig.
-
Hi Boggin the process explorer is a little over my head so I'm not really sure what I need to do there but I made you a video
https://www.dropbox.com/s/ju52f2n7pgnavz3/Start-up%20and%20Process%20Explorer.mp4?dl=0
-
You did the Process Explorer just fine.
That Virus Total blue column has 0/50 entries - they are fine.
There were a couple in red with values of 1/57 - they are also fine as is anything in blue - it's when that value is in red and the numerator/50ish is high that you should start researching.
You don't have anything untoward running in there.
The entries that have a red/pinkish background are all MS ones and aren't anything to worry about - guess it displays like that to easier vet the other entries.
Virus Total.com when enabled allows you to see at a glance if you have any nasties by their high red values which makes it a useful tool.
Autoruns which is a similar program, highlights nasties with a yellow background.
Your msconfig/Startup tab entries seem strange as I have most of those, especially the Toshiba ones under my Services tab.
It looks like Toshiba have changed the format.
Click on the Services tab and see if that Windows Host Process is listed in there - if it is, check the box to Hide all MS services and see if it's still listed.
-
Under the system tab the only thing I see with the word "Host" it is Diagnostic Service Host-running and Diagnostic System Host-stopped
When I check to hide Microsoft Services I do not see any.
-
I haven't a clue then where Windows is snagging it from for a performance problem.
Mention it in your next post and Shane will probably pick up on it as he doesn't always have time to read through all of the Replies that have been made since his last visit to the forum.
It may not be such a problem if the computer is booting up okay - how long does it take ?
-
Hey Boggin one of the items in my startup is "ROC_roc_ssl_v12" it looks like this is part of a toolbar from AVG. It a tool bar that I was tricked into getting along with some other program quite a while back. I remember getting it because it took over all my search functions and was very intrusive. I uninstalled and got rid of it but as I recall it was hard to get rid of. Should I check this so it does not start in the start menu?
-
Leave it checked, boot up into Safe Mode with Networking and download/run the appropriate AVG Uninstaller - run it a couple of times, rebooting after each then check to see if it's still listed. http://www.avg.com/gb-en/utilities
In IE go Tools cog - Manage add-ons - use the dropdown to select All add-ons and check to see if you have AVG Secure Search.
If that's there, I think you can click on that which will give you the option to remove it - if not, boot up into Safe Mode with Networking again and download AdwCleaner - this is a more specialized PuP remover. http://www.bleepingcomputer.com/download/adwcleaner/
Use the blue Download Now @bleepingcomputer button.
Click on Scan and when that has completed it may list some items in the lower pane.
If you recognize any and want to keep them, uncheck their boxes.
Click on Report and that will show if it has found anything else and will remove when you click on Clean - you have no control over those items as it will delete all that is listed.
Close the report and click on Clean, although I think it's called something else now, but you'll see which one it is.
That will produce another report after the restart to show what it has deleted.
Lower down the Adwcleaner page you will see a link for Junkware Removal Tool - click on that and run that program as a follow up.
This takes a bit longer and you only find what/if it has removed in its report on completion - it also puts this file onto your desktop.
Check to see if the ROC_roc_v12 is still there in msconfig, AVG Secure Search (if it was originally there) in manage add-ons and any of those files in Process Explorer where it said it couldn't find files under the Verified Signature column.
If AVG Secure Search is still there you can either click on it and select Disable or reset IE to Defaults.
I only just saw those in Process Explorer when I was looking closer at the video, because I was looking to see which AV program you have installed - but couldn't see any - perhaps you could let us know if you have one installed.
-
I ran the AdwCleaner and that finally got ROC_roc_v12 out of here.
I noticed in the Windows Repair utility that on the last tab called Simple System Tweaker I ran it and it installed some kind of start up service that has bloat and is slowing the startup down but I don't see a way to get rid of it!
-
Use your restore points to prior to running that but you will probably have to redo all that you have already done to get where you are in cleaning your system, depending upon where in the order of things you ran it.
-
OK I restored it and have everything up and running OK. At least it is not starting up with the wrong screen and popup errors.
It is still booting up very slow but I think I should just leave it alone. Thanks for your help!
-
As you have restored it, it will have undone any cleanout that AdwCleaner has done and may have reinstated the Startup items you have unchecked, so you will need to check in msconfig again.
Run AdwCleaner again and then run JRT http://www.bleepingcomputer.com/download/junkware-removal-tool/
Let us know if there's any improvement.
-
Thanks boggin I already re-did all of the previous steps and also have created a good restore point.
I also just ran the junkware removal tool and have attached the log file from it. (I don't think it found much)
I just shutdown and started 4 times and timed it. It is taking just under 2 minutes to go from pushing the start-up button to get to the sign in screen with 68 seconds of just a black screen.
Yesterday I went to bleeping computers.com and ran their utility "autoruns" to try to get rid of some of my start-up items. I ran the program but didn't really know what to do with it so I posted in their forum to ask about it. I was warned by a few in the forum that this was for advanced users and be careful or I could really screw something up so I chose to just leave it alone.
If you want to see my post it is here: http://www.bleepingcomputer.com/forums/t/568381/how-to-use-autoruns/
P.S. I appreciate all your help and I feel like I am taking up too much of your time. We can stop anytime but if you want to keep sending me suggestions I will keep going. I am learning a lot from this. Thanks.
-
My Win 7 x64 HP laptop takes a minute to 1 min 5secs to boot up and on a bad day - 1min 15secs so something is still slowing yours down.
Have you checked Device Manager/View/Show hidden devices to see if any more yellow alerts have popped up ?
What does Check for Performace issues report now ?
StartUpLite is an old program and hasn't been updated for some time but may still pick up on something https://www.malwarebytes.org/startuplite/
-
Good news Boggin :cheesy: I just booted up in 58 seconds!
There are no yellow alerts in device manager.
I ran "Check for Performance" and I do see a couple of things that may be suspicious I made a video to show you.
https://www.dropbox.com/s/quvbkqcohkdk4lh/Check%20for%20performance%20issues%202-27-15.mp4?dl=0
I ran "StartUpLite" and it suggested that I disable Quicktime from the start-up. I suspect that this is what is taking so long.
From pushing the start-up button to get to the sign in screen was 58 seconds and I only had 6 seconds of black screen
-
That's great news - sounds like you've cracked it :smiley:
If you go Start - All programs - Toshiba and/or Utilities you will see a number of those Toshiba items.
Toshiba Tempro can be booted up and set to disabled, but you won't receive any update messages although you can boot it up and enable it now and again to see if there are any - mine once alerted me to a BIOS update but Toshiba seems to have a short end of life for their products.
The Service Station - clicking on Decline will give a confirmation that it will be disabled - never really knew what that one is for but I have Toshiba Reel Time unchecked in mine.
Given the boot up time you now have, those Toshiba startup services aren't having any adverse effect given that a bare bones Win 7 is supposed to boot up in 47 seconds.
The quickest mine has ever booted up in was 53 seconds - don't know what's happened to it since :smiley:
-
Thanks Boggin, I am very happy with the results, Thanks for your help and for being so persistant! :wink:
-
That's alright :smiley:
If you're happy you can modify your thread title to include SOLVED.
-
Good work Boggin sticking through and helping.
Thats my kind of fellow tech :artist:
Shane
-
Thanks Shane - the good feedback from JMK helped, but I am still puzzled where that Windows Host Process came from that Windows found as a performance issue.
-
Hi,
Another way of testing the hard drive with command prompt, without using any tool by manufacturer or third party . Please try and ensure your health of hard disk
go to cmd
need not be administrator cmd
just type these commands, enter after each command. You get the status.
wmic then press enter key
diskdrive get status then press enter key. If the status is ok, then it is ok in smart test
-
And then what do you enter ?
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>wmic
wmic:root\cli>
-
Hi again guy's I just wanted to give an update. I further tried to disable some startup items using "autoruns" at bleebingcomputer.com I had some issues and and tried to restore the registry file I created and for some reason it would not take it after trying several times in different ways.
I also tried to restore to an earlier time and and then it was erroring out even more. Anyway I did a "factory restore to new" I have already reinstalled my MS Office, Dropbox, etc, etc. Also been doing the many microsoft updates. Everything is hunky dory and my boot time from startup to sign in screen is a little under 45 seconds! Nice.
I sure do thank you guys at tweaking.com and bleepingcomputers.com for helping me out, you guys are a great resource.
Now the lappy is happy and so is it's pappy :wink:
-
So do you have different accounts you can sign into ?
I just have a normal boot up where it takes me to the desktop and yesterday it managed 52 secs - but not since :smiley:
When a restore point reports as unsuccessful it's usually the AV program that is blocking it and booting up into Safe Mode (I always use Safe Mode with Networking) will isolate the AV and other 3rd party programs and the restore should be successful.
To back up the registry it's easier just to create a restore point than exporting the registry folder.
A factory reset does clean out clutter that we cannot see which is normally left when just using Windows Add/Remove Programs and it's always best to use a 3rd party Uninstaller program that will clean out the residue.
-
If I time it from when I push the power button and include sign it to when the desktop shows it is 63 seconds.
Hey when you say: "A factory reset does clean out clutter that we cannot see which is normally left when just using Windows Add/Remove Programs and it's always best to use a 3rd party Uninstaller program that will clean out the residue."
Is there something else I should run now? I am a little concerned now about fixing things to the point of breaking them :confused:
-
When you factory reset an OEM computer, you get all of the bloatware the vendor preinstalls and just using Add/Remove programs to get rid of what you don't want, will leave residue in the registry.
One way to remove that is with a registry cleaner, but they can be indiscriminate and hose your system and are best left alone.
The next best thing is to use a 3rd party uninstaller.
Here are a couple of articles where you can read about them -
http://dottech.org/100309/windows-best-free-clean-uninstaller-program-review/
http://listoffreeware.com/list-of-best-free-uninstaller-software/
The free version of Revo only picks up on 32 bit programs and not 64 bit programs so you would need to use the free trial of the Pro version for any 64 bit programs you want to uninstall - or buy it.
I use IOBit Uninstaller which does for both and prefer it to Revo because of its simpler use and find it particularly useful in uninstalling the McAfee which came preinstalled on both my Toshiba laptops.
If you do decide to install IOBit then look out for a small checked box to the right of the pre-checked EULA box.
It could be for either of any other IOBit's products, so uncheck it before clicking on Install/Next.
One program you can use to sort out the chaff and vet your Startup menu is DeCrapifier although I've never used it, as I know which programs I want rid of. http://www.pcdecrapifier.com/ - it may also be worth running StartUpLite again as preinstalled programs can also be inserted into the Startup menu of which some, DeCrapifier may not pick up on..
CCleaner is mentioned in one of those articles and is a handy tool for clearing the temp Internet cache which when built up can have an adverse effect on the performance by slowing its operation down.
This is how to use it https://www.piriform.com/docs/ccleaner/using-ccleaner and some tips on using it http://www.howtogeek.com/113382/how-to-use-ccleaner-like-a-pro-9-tips-tricks/
One other place to check for a build up of files is the temp folder - one machine I cleaned out had over 3GB of files in there which was slowing the computer to a crawl.
You can view this by going Start - type %temp% and press enter.
If that is highly populated then click on Organize - Select all - Organize - Delete - confirm.
There should only be a Debug file remaining so check the box then click on Skip.
If there are any large files remaining, repeat the procedure and accept the UAC if you are presented with one.
Going back to your backing up the registry - I don't know how Shane's WR program backup and restore does it but when you back up the full registry, you can't use that to restore as you cannot restore files that are in use.
Perhaps Shane can explain how WR accomplishes that.
You can however, back up and restore individual registry folders by clicking on their name - File - Export - give them a name where they will be saved as a .reg file and to restore them - File - Import - browse to the saved location - click on it then on Open where it will be reinstated.
-
Thanks Boggin for the tip I installed IOBit and I like it, I will use it. What about all the programs I already deleted before IOBit? Do you recommend I do anything there?
-
Hi, Boggin,
after that please type
diskdrive get status
and press enter
If the status is fine, it will give you OK
-
Thanks Boggin for the tip I installed IOBit and I like it, I will use it. What about all the programs I already deleted before IOBit? Do you recommend I do anything there?
If you are unable to reinstall them to use IOBit on them, you could use CCleaner's registry cleaner as it is an intelligent cleaner - but uncheck the box for ActiveX and Class Issues before running it and this will clean out the residue.
It may also list a load of missing DLLs - which is normal after a factory reset because the contents of the Recovery partition have an universal install, depending upon on your model and it is okay to let it delete these.
It affords you the option to create a registry back up but this as far as I know, only contains the items it removes and I have yet to be able to restore those items using that back up - perhaps that's something I'm not doing right.
The only sure way to back up the registry is to create a restore point and ensure it remains after a reboot because Win 7 can develop a nasty habit of deleting restore points.
The alternative to using CCleaner and if you are unable to reinstall/uninstall those programs would be to redo the factory reset and all that entails.
I once read that it was advocated to do a factory reset once a year just to clear out the clutter, but given how long it takes for all of the Windows Updates to download and install as well as cleaning out the bloatware and reinstalling your own programs - it's advice I've ignored :smiley:
If you use CCleaner to clear the temp file etc. cache, under the System section uncheck the box for Memory Dumps as they will be needed if you ever get a BSOD - Blue/Black Screen of Death.
-
Hi, Boggin,
after that please type
diskdrive get status
and press enter
If the status is fine, it will give you OK
Thanks JR - perhaps you would like to edit your previous post to include that info to make it clearer.
-
Hi,
Thanks boggins. Did jmk apply the commands for his system. I do not know..
Please see my post, I have already included . I specifically mentioned to enter then after each line. Only think i missed was , where it would take that, the directory in your post. So everything is clear.
I am asking jmk because, the ultimate problem is dying hard disk problem reported by him.
-
Hi,
Thanks boggins. Did jmk apply the commands for his system. I do not know..
Please see my post, I have already included . I specifically mentioned to enter then after each line. Only think i missed was , where it would take that, the directory in your post. So everything is clear.
I am asking jmk because, the ultimate problem is dying hard disk problem reported by him.
While that is the title of the thread, it was just a suspicion that a failing HDD was the cause of performance problems - as you will see from the chkdsk /r report that JMK posted, the HDD is fine.
-
Hey Boggin, I ran the decrapifier last night and it suggested to remove a few things a couple of then was Toshiba Reel Time, Toshiba Face Recognition and a couple more. I uninstalled then with IObit, after the uninstall IObit suggested 100's of items in the registry to delete and they didn't look like they were all related to the items I uninstalled. I didn't delete them, should I have? It was a lot of scary stuff.
I just did a restore to undue what I did last night
-
Hey Boggin, I ran the decrapifier last night and it suggested to remove a few things a couple of then was Toshiba Reel Time, Toshiba Face Recognition and a couple more. I uninstalled then with IObit, after the uninstall IObit suggested 100's of items in the registry to delete and they didn't look like they were all related to the items I uninstalled. I didn't delete them, should I have? It was a lot of scary stuff.
I just did a restore to undue what I did last night
They probably are related to it but you do the right thing by creating a restore point prior to making any changes, but when you select a restore point, click on Scan for affected programs as some have to be reinstalled to become functional again.
I remember when I've used IOBit to remove Java 64bit it found over 700 items relating to it.
To refresh my memory about Toshiba ReelTime, I Googled it and got http://www.shouldiremoveit.com/TOSHIBA-ReelTime-5312-program.aspx
There's a link lower down the page which lists what it calls other Toshiba bloatware.
I've run Decrapifier on both my Toshiba Win 7 laptops and while this slightly older one doesn't have Face Recognition, it didn't snag Toshiba ReelTime on either or Face Reconition on the other although it listed it in Everything else - do you have either of those programs running - msconfig should show that.
I can't see ReelTime in my msconfig - probably because I unchecked it ages ago, but it may be in yours.
If you do have it listed in msconfig and you want to uninstall it, then leave its box checked otherwise you could end up with orphaned files, regardless of IOBit.
Have you used Toshiba Media Creator to make a set of Toshiba Recovery Disks - these are a copy of what is in the Recovery partition and should you need to factory reset or have serious problems, you can boot up with them.
It requires two DVDs.
I've only had to use mine once when in the Advanced Boot options I noticed I no longer had the option of Repair your Computer.
If you ever need to check if there are any driver updates for your machine then just Google Toshiba driver support.
You'll probably get a different location to my UK one and when you are entering your model details it will ask for the short model number which will be on the underside of the laptop, but you'll recognize which bit you need from the dropdown choice.
-
Hey Boggin, my computer is running great, I just booted up to the desktop in 46 seconds! WoHoo!
I ran the CCleaner as you recommended and I think it did a lot of good. Do you recommend that I leave CCleaner installed and working all the time? I notice that it is in the startup menu as well as running in the task bar but maybe that's a good thing?
Leave it or uninstall it?
-
Hey Boggin, my computer is running great, I just booted up to the desktop in 46 seconds! WoHoo!
I ran the CCleaner as you recommended and I think it did a lot of good. Do you recommend that I leave CCleaner installed and working all the time? I notice that it is in the startup menu as well as running in the task bar but maybe that's a good thing?
Leave it or uninstall it?
The free version is usually used as an on demand program and I run it to clear the cache at the end of every session.
If you click on Tools/Settings have a look to see if the box is checked for it to run on Startup - it doesn't need to be - running it manually is sufficient.
My laptop has never booted up that quickly even when new :smiley:
-
Thanks, what about the setting for 'Enable System Monitoring" and "Enable Active Monitoring" Do you uncheck those? I notice that it is always running in the task bar.
-
Thanks, what about the setting for 'Enable System Monitoring" and "Enable Active Monitoring" Do you uncheck those? I notice that it is always running in the task bar.
Actually, they were the ones I was looking for but thought they applied to another program I have installed - memory isn't what it was :cheesy:
Yes, uncheck those and that will keep it dormant until you want to run it.
-
Hi, Boggins,
the wmic command list will give the instant status and information of the system very quickly. It is only used by advance users, because, there is no going back on any command. I mean, if the action is performed then there is no reverse for it.
But i took this command to get disk status, to easily find the status of the hard disk. The link is given below for the users of this forum.
http://www.thewindowsclub.com/hard-disk-drive-health