Funky reeaaallly slow bootup on Win7/64 on SSD

[dissent]

It's finally coming to a head. Lately (last few weeks) been experiencing some slight slowdown in speed of Win7 Pro/64 install on my C:drive SSD (i.e. scrolling through images in Windows seemed to take longer to display). Initially i had to try a reboot and it seemed like the reboot would just hang - I'd get the normal appearing windows desktop, but when I tried to click on anything on the taskbar (Start button or any apps) then nothing would happen. Or so I thought. A day or two ago, I walked away while it was doing this and came back 5 to 10 minutes later, and everything ran fine, browser, apps, internet everything. Ran an up-to-date mbam and found nothing. Tried another reboot and observed the same very, very slow bootup time, but if I let it finish everything would run just fine. Tried to roll back a week to a restore point, but the reboot still took a looonnng time. ran sfc /scannow as administrator and saw nothing. Ran up-to-date MSE full scan and found nothing.

So, should I just do a repair (update) re-install of Windows, or should I be looking at something else?

Should I suspect the health of my SSD? It still is under 50% filled.

Other suggestions? (is mbr bad?) Any of this sound familiar to anyone.

[Krom]

Any interesting errors in event viewer during the relevant time? Does the SSD have any diagnostic software with it that could give you an idea of any potential health issues (although SSDs tend to either work perfectly or not at all).

While the system is sluggish, is it still possible to get task manager or resource monitor open so you can see where the stall is? Task manager could tell you if the CPU is maxed out, resource monitor could show you if the SSD or the RAM are thrashing (or if both are happening and the system is paging to the SSD).

One more antivirus method you could try is a kaspersky or antivir rescue CD which can scan the system offline, but if mbam and mse didn't find anything I wouldn't expect them to find anything relevant either.

[dissent]

I'll have another go at the Resource Monitor. I did look at it after the last bootup and did not see any excessive CPU usage.

Also, don't know if this may be related. I had started to hear an occasional short high pitched scratching noise; quite rare, but I heard it about three times in the last few days. I suspect it may have been from the 3TB external drive I also had attached to the system. I unplugged this drive before doing the diagnostic work over the last couple of days and I haven't heard the sound since (at least not yet)

[Krom]

Check your cooling fans and temps, could explain both the noise and the slowdown (throttling) if the CPU fans are grinding.

[dissent]

Looks like the fans are spinning ok. info from Intel BIOS page :

CPU fan at 720 rpm, front and rear fans at about 500 rpm.

Temps:
CPU core 44
PCH 56
Memory 32
VR 31

Watched the reboot coming out of BIOS. Seems to go at just a fine clip, at least for the first 99.5% of the boot process. Then it just takes an excruciatingly long time (5 -10 minutes) for the last part of the boot to finish, metric being that the taskbar items and desktop items can now be clicked on and something launches. PITA.

[Krom]

Since this is Windows 7, there is a handy feature in resource monitor that might give you a better idea of what is stalling out. When this is going on, since the start menu won't open, right click on explorer.exe in resource monitor and select "analyze wait chain...". It should tell you want explorer (taskbar,startmenu,desktop) is waiting for.

Also, does it still do this in safe mode?

[dissent]

Not sure how I will be able to start resmon while the system is hung since I won't have access to start button. I'll try and see if I can get it to launch.

[Krom]

If you can start task manager, the performance tab has a button for starting resource monitor.

[dissent]

Naw, tried it last night and could not get anything to run until the boot was fully complete. Mouse works (moves around, but clicking on anything gets me nowhere), but can't make keyboard entries either to try to pull up resmon.

And, to answer your other question, no I don't see this slow boot behavior when going into safe mode.

[Krom]

Throw resource monitor into your startup folder.

If it doesn't do it in safe mode, then go through all your startup entries with autoruns and start disabling everything nonessential till you find the one that is doing it.

[Krom]

If you are still having trouble finding out what is causing this, we can go really heavy duty and set your system up to perform a boot trace. It would spell out in great detail what is going on while your system is booting up.

[Tunnelcat]

I know you don't recommend turning off system restore Krom, but there are those out there that claim that it interferes with keeping an SSD trimmed. I only turn it on for a Windows Update or a program install, then I turn it off if the system remains stable for about a week. They all get deleted when you turn it off, so next Windows Update, I turn in on again for a fresh restore point. I try to keep recent backup images of the OS instead of relying on system restore anyway. I don't think I've ever gotten it to work very well when I needed it. This is just a quickie suggestion dissent could try before going the painful route of OS reinstall or SSD swap.

[Krom]

System restore doesn't interfere with TRIM in any way, it is just files on the drive like any other set of files. When an old restore point gets cleaned up, the OS sends the TRIM command to the drive with the relevant blocks. The most you could say is that it uses a few gigabytes of capacity, but if you were running a SSD that close to capacity the performance would degrade even if you turned system restore off.

[Tunnelcat]

It was just a thought..........

[dissent]

hmm. Can't seem to get resmon to run from the Startup folder. Used perfmon the first try and that didn't run either. Tried to set up a task Sceduler folder to run it (with resmon.exe) and that didn't work either. I'm going to try again (this time with resmon in the Startup folder). I'm struggling with some kind of human virus at the moment, so my energy level is a little lower than normal for this testing

The Logon tab on Autoruns doesn't seem to have anything there that it shouldn't have. There was an item there as I recall the 1st time I ran it related to the Adobe Updater, but I just ran the update for Adobe Flash manually, and now I don't see that item any more ... oops, Nope, it's still there in the Task Scheduler section on the Everything tab. I'm going to uncheck it and then run the next reboot test and see what happens.


edit - OK, that worked. On reboot resmon came right up and I had immediate access to it via the mouse. Not seeing any excessive high levels of CPU usage at all. What else should I be looking for?

[Krom]

Analyze the wait chain on explorer.exe while it is doing this. If that doesn't turn up anything useful, then we should probably just go for a full blown boot trace.

[dissent]

explorer.exe is waiting for another process (svchost.exe(LocalSystemNetworkRestricted))

Also found -
One or more threads of mbamservice.exe are waiting to finish network I/O

one or more threads of svchost.exe(netsvcs) are in waiting status

[Krom]

It is normal for some instances of svchost.exe to be waiting on threads, and also for malwarebytes to be waiting on network I/O (a lot of applications wait on that).

Go ahead and try this:
http://helgeklein.com/blog/2013/07/anal ... -analyzer/

[flip]

That high pitch noise could be a cap going bad.

[Krom]

Looking at the localsystemnetworkrestricted service host, it runs 8 services on my rig. What I would do is look in event viewer for errors or warnings from those services.

[dissent]

hmm, where would that be listed in the Event Viewer?

Under the "Error" Event Type, I have entries under Kernel Event Tracing, WMI, Print Services and several Service Control Manager entries.
Examples are, under the "hung on starting" banner: Windows Update Service, Function Discovery Reserve Publication, Function Discovery Provider Host and SSDP Discovery Service. A number of error were under Session "Microsoft Security Client OOBE" stopped due to the following error 0x000000D".

Google search on the last one led to this -
http://www.howtogeek.com/forum/topic/mi ... 0xc000000d
which seems to suggest a problem related to mse, and a proposed solution. But it is late and my body is saying "go to sleep", so i'm out for a few hours.

[Krom]

One of those hung on startup errors is probably the culprit, time to find out why these services are broken and get them running normally again. In a good system there should be no service errors.

[dissent]

From this search -
https://www.google.com/#q=how+to+use+wi ... +windows+7

I found this interesting article -
http://www.techrepublic.com/blog/window ... imes/3253/

So I'll be going over this sporadically for the next few days (probably). I may also try an uninstall and reinstall of MSE to see if that helps.

Krom, thanks for your help ... and your patience.

[dissent]

Well, I didn't have any chance to work on this over Easter weekend, and work this week has been a bear. So I went back and looked some more at the Resource Monitor tonight. Analyzed a few wait chains. Then ...

weirdness.

Did a reboot ... and the system started up normally. Completely normally. Rabbit quick. Go figure.

Of course, all is not perfect. Now in the Resource Monitor I am seeing a lot of activity in the network area that I was not seeing before. Some on the disk too, but the CPU is fairly quiet. One svchost.exe process (LocalSystemNetworkRestricted) has one or more threads in waiting status, and another svchost.exe process (LocalServiceAndNoImpersonation) is waiting to finish network I/O.

Pretty Greek to me. Sound like anything anyone else has seen?

[Krom]

http://www.howtogeek.com/school/sysinternals-pro/

Read up on Process Monitor and Process Explorer (and Autoruns if necessary). They are my usual go-to tools when I need to dig deeper than you can with resource monitor or task manager.

[dissent]

Interesting stuff, but it's a little hard to know what I'm looking for. So many numbers, so much ignorance on my part.

In the Resource Monitor, is there a way to fix the vertical axis span on the disk, CPU, or Network graphs? It's a little hard to figure out what "normal" looks like when these axes magnitude's keep changing as your watching the Monitor output.