Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: NeroMorte on September 15, 2008, 10:44:34 PM
-
Hi My Computer After i login into System Takes like 10 mins to load now i Looked in Task Manager and Avast.setup is there, As soon as that go's away it Finish's loading system.
I Have Checked
Delay loading of avast! services after other system services.
I Tryed going into Msconfig and Disabling Avast to Be sure it's an Avast Problem and Avast Yells at me that it can't not be disbaled.
I Can't Figure out why it's taking my system so long to load now this been going on 2 Weeks now.
I also Looked in my Event Logs and i don't see no Errors in there that would Reflect System loading slow.
If anyone can please help me out
Thanks, Morte
-
Well the avast.setup is the avast update process and if you have a connection established (broadband starting on boot) it will check for updates, if there is one it will try to download it. That process is CPU and RAM intensive so may be what is slowing your boot.
You need to edit (using notepad) the [InetWD] section of the C:\Program Files\Alwil Software\Avast4\Data\avast4.ini file and add the following line (depending on your connection type):
Broadband connections, add this line: AlwaysConnectedWaitSeconds=120
[InetWD]
AlwaysConnectedWaitSeconds=120
When complete save the changes, avast's self-defence module (what is stopping you in msconfig) will ask for confirmation, etc. answer Yes.
The figure is seconds and the above equates to two minutes, you could try that and adjust upwards if required, 180, 240, etc.
-
Thank you for Reply, I Opened C:\Program Files\Alwil Software\Avast4\Data\avast4.ini and Went to Bottom of ini where i seen [InetWD] and Add'ed AlwaysConnectedWaitSeconds=120 Below it and i click File Save.
It tells me "File/Device may be Readonly, or open for write by another application use 'Save As' to save as a different name." I Try Disbaling Avast thinking maybe it was reading it.
How can i edit this ini file?
Ahh N/m i Had to open it with Notepad and it Brought up a Box Asking me yes or no to change file. let me try this out now see if it works for me
-
Now that i added that Line in the ini file it takes longer for system to boot up.??
-
The change shouldn't increase the duration, currently the auto update check would normally start after 30 seconds, by changing it to 120 the boot should get further before the update check takes place. You can as the instruction said extend that even further 330 = 5 minutes before it checks.
The last update was only a VPS signature update and as such shouldn't have had any impact on boot duration, the last program update which 'might' have had an impact was version 4.8.1229 on the 23.7.2008.
What other security applications do you have installed ?
What is your firewall ?
-
That's all i have for Security Programs.
Firewalls i have no software firewall installed. Only a Router with Firewall enabled.
-
What are your system specifications like CPU type, speed, and RAM amount?
What is the operating system?
-
Windows XP Professional SP3
AMD Athlon 64, 2200 MHZ (11 x 200) 3700+
2048 MB (DDR SDRAM)
NVIDIA GeForce 6800 (128 MB)
300 GB Hard Disk Drive
-
Sorry I can't help as my 2.4GHZ P4 XP SP3 Home and my 2.8GHZ P4 XP Pro SP3 systems boot up quite quickly.
Do you have any telling events in the Event logs?
http://www.eventlogxp.com
Do you have User Hive Cleanup installed?
http://www.microsoft.com/downloadS/details.aspx?FamilyID=1b286e6d-8912-4e18-b570-42470e2f3582&displaylang=en
What is the speed of your Internet connection?
http://www.speedtest.net
Mine:
(http://www.speedtest.net/result/324029770.png) (http://www.speedtest.net)
-
Event Logs:
Antivirus:
Type: Information
Date: 9/13/2008
Time: 07:55:47 AM
Event: 90
Source: avast!
Category: Client
User: N/A
Computer: C1174696-C
Description:
The virus database (VPS 080913-0) was automatically updated.
Type: Error
Date: 9/14/2008
Time: 11:13:40 AM
Event: 90
Source: avast!
Category: Client
User: N/A
Computer: C1174696-C
Description:
AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\Documents and Settings\NeroMorte\Desktop\WinHack\Analysis\OllyDbg\Plugins\Teerayoot.dll failed, 00000005.
Type: Error
Date: 9/14/2008
Time: 11:13:40 AM
Event: 90
Source: avast!
Category: Client
User: N/A
Computer: C1174696-C
Description:
AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\Documents and Settings\NeroMorte\Desktop\WinHack\Analysis\OllyDbg\Plugins\Teerayoot.dll failed, 00000005.
Type: Warning
Date: 9/14/2008
Time: 11:13:40 AM
Event: 90
Source: avast!
Category: Client
User: N/A
Computer: C1174696-C
Description:
AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\NeroMorte\Desktop\WinHack\Analysis\OllyDbg\Plugins\Teerayoot.dll (C:\Documents and Settings\NeroMorte\Desktop\WinHack\Analysis\OllyDbg\Plugins\Teerayoot.dll) returning error, 00000005.
Type: Warning
Date: 9/14/2008
Time: 11:13:40 AM
Event: 90
Source: avast!
Category: Client
User: N/A
Computer: C1174696-C
Description:
AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\NeroMorte\Desktop\WinHack\Analysis\OllyDbg\Plugins\Teerayoot.dll (C:\Documents and Settings\NeroMorte\Desktop\WinHack\Analysis\OllyDbg\Plugins\Teerayoot.dll) returning error, 00000005.
Type: Error
Date: 9/14/2008
Time: 11:13:41 AM
Event: 90
Source: avast!
Category: Client
User: N/A
Computer: C1174696-C
Description:
AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of C:\Documents and Settings\NeroMorte\Desktop\WinHack\Analysis\OllyDbg\Plugins\Teerayoot.dll failed, 00000005.
Type: Warning
Date: 9/14/2008
Time: 11:13:41 AM
Event: 90
Source: avast!
Category: Client
User: N/A
Computer: C1174696-C
Description:
AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\NeroMorte\Desktop\WinHack\Analysis\OllyDbg\Plugins\Teerayoot.dll (C:\Documents and Settings\NeroMorte\Desktop\WinHack\Analysis\OllyDbg\Plugins\Teerayoot.dll) returning error, 00000005.
Type: Information
Date: 9/14/2008
Time: 01:55:49 PM
Event: 90
Source: avast!
Category: Client
User: N/A
Computer: C1174696-C
Description:
The virus database (VPS 080914-0) was automatically updated.
Type: Information
Date: 9/15/2008
Time: 01:59:39 PM
Event: 90
Source: avast!
Category: Client
User: N/A
Computer: C1174696-C
Description:
The virus database (VPS 080915-0) was automatically updated.
Application
Type: Warning
Date: 9/15/2008
Time: 01:58:27 PM
Event: 5603
Source: WinMgmt
Category: None
User: \SYSTEM
Computer: C1174696-C
Description:
A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.
Type: Warning
Date: 9/15/2008
Time: 01:58:27 PM
Event: 5603
Source: WinMgmt
Category: None
User: \SYSTEM
Computer: C1174696-C
Description:
A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.
Type: Warning
Date: 9/15/2008
Time: 01:51:00 PM
Event: 63
Source: WinMgmt
Category: None
User: C1174696-C\NeroMorte
Computer: C1174696-C
Description:
A provider, HiPerfCooker_v1, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.
Type: Warning
Date: 9/13/2008
Time: 05:44:48 PM
Event: 1517
Source: Userenv
Category: None
User: \SYSTEM
Computer: C1174696-C
Description:
Windows saved user C1174696-C\NeroMorte registry while an application or service was still using the registry during log off. The memory used by the user's registry has not been freed. The registry will be unloaded when it is no longer in use.
This is often caused by services running as a user account, try configuring the services to run in either the LocalService or NetworkService account.
Type: Error
Date: 9/15/2008
Time: 03:31:53 PM
Event: 25
Source: Diskeeper
Category: None
User: N/A
Computer: C1174696-C
Description:
RPC error.
Diskeeper failed to connect to the service. Error code is 1.
Type: Error
Date: 9/15/2008
Time: 03:17:38 PM
Event: 1001
Source: Microsoft Management Console
Category: None
User: N/A
Computer: C1174696-C
Description:
The description for Event ID ( 1001 ) in Source ( Microsoft Management Console ) could not be found. It contains the following insertion string(s): .
218490579
Type: Error
Date: 9/15/2008
Time: 03:17:36 PM
Event: 1000
Source: Microsoft Management Console
Category: None
User: N/A
Computer: C1174696-C
Description:
The description for Event ID ( 1000 ) in Source ( Microsoft Management Console ) could not be found. It contains the following insertion string(s): .
dfrgsnap.dll
9.0.532.0
dfrgsnap.dll
9.0.532.0
00007970
Type: Error
Date: 9/15/2008
Time: 03:16:47 PM
Event: 25
Source: Diskeeper
Category: None
User: N/A
Computer: C1174696-C
Description:
RPC error.
Diskeeper failed to connect to the service. Error code is 1.
Type: Error
Date: 9/13/2008
Time: 11:21:07 PM
Event: 25
Source: Diskeeper
Category: None
User: N/A
Computer: C1174696-C
Description:
RPC error.
Diskeeper failed to connect to the service. Error code is 1.
I Just installed Hive Cleanup now sure how to use it though?
My Speed Test:
(http://www.speedtest.net/result/324032701.png)
-
System
Type: Warning
Date: 9/15/2008
Time: 04:05:34 PM
Event: 18
Source: BTHUSB
Category: None
User: N/A
Computer: C1174696-C
Description:
Windows cannot store Bluetooth link keys on the local transceiver because it cannot determine whether proper security is enabled for the device.
Type: Warning
Date: 9/15/2008
Time: 03:51:21 PM
Event: 20
Source: Print
Category: None
User: \SYSTEM
Computer: C1174696-C
Description:
Printer Driver Dell Photo AIO Printer 942 for Windows NT x86 Version-3 was added or updated. Files:- DLBUDR5C.DLL, DLBUUI5C.DLL, DLBUUI5C.DLL, DLBUDRV.HLP, DLBUCLR1.LUT, DLBUCLR2.LUT, DLBUCLR3.LUT, DLBUCLR4.LUT, DLBUHPEC.DLL, DLBUHPEP.DLL, DLBUHPEH.DLL, DLBUFLIB.DLL, DLBUSTRN.DLL, DLBULPA.HLP, DLBUNOTE.HLP, DLBUDRV.CNT, DLBULPA.CNT, DLBUMA.CNT, DLBUJSWX.EXE, DLBUPSWX.EXE, DLBUJSW.DLL, DLBUJSWR.DLL, DLBULPA.DLL, DLBULPAR.DLL, DLBUPRP.DLL, DLBUPRPR.DLL, DLBUPSW.DLL, DLBUPSWR.DLL, DLBUUTIL.DLL, DLBUUPD.DLL, DLBUUPDR.DLL, DLBUCU.DLL, DLBUCUR.DLL, DLBUPP5C.DLL, LEXEDF.DLL, DLBUPCFG.DLL, lexgo.EXE, DLBUCLN.OUT, dlbuaual.out, hlp256.dll, ptzipw32.dll, dlbueula.txt, DLBUGF.DLL, dlbusk0.dll, dlbusk1.dll, dlbusk2.dll, dlbuserv.dll, dlbucomc.dll, dlbuprox.dll, dlbucoms.exe, dlbuhbn1.dll, dlbuusb1.dll, dlbulmpm.dll, dlbucomm.dll, dlbupplc.dll, dlbucfg.exe, dlbuw2k.ini, dlbuih.exe, dlbu.loc, dlbuvs.dll, dlbuprod.ini, dlbuunst.exe, dlbuins.dll, dlbuinsr.dll, dlbucfg.dll, dlbucomx.dll, dlbupmui.dll, dlbuphau.out, dlbuphcl.out, dlbuprod.ver, dlbudrec.dll, dlbutsfw.dll, dlburetv.dll, dlbuuldr.dll, dlbuview.exe, dlbuserv.exe, dlbutime.dll, dlbuupld.exe, dlbutime.exe, dlbudpp.hlp, dlbuceip.hlp, dlbucub.dll, dlbuinsb.dll, dlbujswb.dll, dlbulpab.dll, dlbuprpb.dll, dlbupswb.dll, dlbuupdb.dll.
Type: Error
Date: 9/15/2008
Time: 05:50:21 PM
Event: 10005
Source: DCOM
Category: None
User: \SYSTEM
Computer: C1174696-C
Description:
DCOM got error "%1058" attempting to start the service IISADMIN with arguments ""
in order to run the server:
{A9E69610-B80D-11D0-B9B9-00A0C922E750}
Type: Error
Date: 9/15/2008
Time: 04:07:52 PM
Event: 7022
Source: Service Control Manager
Category: None
User: N/A
Computer: C1174696-C
Description:
The Windows Image Acquisition (WIA) service hung on starting.
Type: Error
Date: 9/15/2008
Time: 02:28:34 PM
Event: 7000
Source: Service Control Manager
Category: None
User: N/A
Computer: C1174696-C
Description:
The DS1410D service failed to start due to the following error:
The system cannot find the file specified.
Type: Error
Date: 9/15/2008
Time: 02:24:57 PM
Event: 7006
Source: Service Control Manager
Category: None
User: N/A
Computer: C1174696-C
Description:
The ScRegSetValueExW call failed for Start with the following error:
Access is denied.
Type: Error
Date: 9/15/2008
Time: 01:58:15 PM
Event: 10016
Source: DCOM
Category: None
User: \SYSTEM
Computer: C1174696-C
Description:
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{D851F103-8C90-4321-AFF0-58BA5BD421C2}
to the user NT AUTHORITY\SYSTEM SID (S-1-5-18). This security permission can be modified using the Component Services administrative tool.
Type: Error
Date: 9/15/2008
Time: 01:57:28 PM
Event: 22
Source: Print
Category: None
User: \SYSTEM
Computer: C1174696-C
Description:
Failed to ugrade printer settings for printer \\C1174696-C\Microsoft XPS Document Writer,LocalOnly driver C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unidrvui.dll error 126.
Type: Error
Date: 9/13/2008
Time: 05:47:47 PM
Event: 7001
Source: Service Control Manager
Category: None
User: N/A
Computer: C1174696-C
Description:
The World Wide Web Publishing service depends on the IIS Admin service which failed to start because of the following error:
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
-
Well your system is up to the task the CPU isn't the fastest but more than adequate.
None of the event logs should be connected the only ones about the VPS update are reporting it was automatically updated, no errors.
Why it is so slow now when it wasn't before is a mystery as it is some time since a program update, which would be the only theoretical possibility and even then it shouldn't extend to 10 minutes or we would be seeing lots of topics on this, but we aren't.
Did you try to further extend the update delay time ?
Try 600 (10 minutes) and see if that is still resulting in a slow boot, if so I would have to say that it isn't down to avast.setup. Or if that doesn't work set the avast! Program Settings, Update (Basic), Virus database and Program to Manual, so there should be no auto update check.
What other applications are run on boot ?
Have you had any changes to your system in this time frame ?
I would like you to check something else out for me, when the boot completes, open the avast On-Access Scanner window (left click the avast 'a' icon) select the Standard Shield and tell me what the sensitivity is (Normal is the default) and also the figure in the Scanned count: field ?
It is almost 2.a.m. here so I am heading to bed now, I will check it out again tomorrow.
-
Alrighty i Try your Suggestions.
Set both Program / Virus Database Automantically Update to Manual. -> Didnt work
Set AlwaysConnectedWaitSeconds=600 in avast4.ini. -> Didnt work
Only other Application i have is:
Apache Server
MySQL
PHP
Perl
Nero Application
Tea Timer
Windows Sound Icon
Only Change Page File Custom Size to System Managed Size probably a bad move but my Game Run better when Windows managed Size then when i auto do it.
I Also Preformed a Clean Boot on Windows And it won't allow me to Disable ashDisp in Startup Tab, Well with Every thing beside that Unchecked, All Services that not not Microsoft and Disabled, The System Still Booted Slow once i click Log in for windows.
When i Try uncheck ashDisp i get follow:
An Access Denied error was returned while attempting to change a servce. You may need to log on using an Administrator account to make the specified Changes.
Well i'm done for the Night Tomorrow i'll see what you have to say and maybe i'll try uninstalling Avast and See if that Fix's Problem that right there will tell me i would think.?
-
The ashDisp.exe is the avast icon and is just an interface to the on-access scanners and program settings, it isn't part of the avst security so disabling it shouldn't have any impact.
However, to be able to disable if you would first need to disable the avast self-defence, Program settings, Troubleshooting, Disable avast! self-defence, ironically to do this you need the avast icon to be present, you could be shooting yourself in the foot.
The fact that there is no change (I assume the avast.setup isn't in the task manager) would tend to lead me away from an avast involvement, when this is going on, what processes are consuming high CPU % ?
No need to uninstall, if you boot into safe mode avast doesn't start (nor do many other applications), so you could try that and see how long the boot takes.
-
I don't know if this will help you and don't know if this is what fixed my problem but here it goes: I was suddenly have slow load problems in Vista (64 bit) after a reboot. Reboot went from roughly a little over 1 minute to 2 or more minutes and was getting progressively worse where last night (after trying a bunch a fixes that did not work), my reboots were taking 3 or 4 minutes and my system is no slouch (Quad 4 2.66 ghz processor and 8 GB RAM). I tried rolling back my system to a back up copy from about a week ago and that did not help. I reboot in Safe Boot mode and the boot up was very fast telling me that something on load up was causing the problem. I was tired and frustrated so I let system overnight. This am I saw your post above about page file and I remembered I turned page file off recently (since I had enough memory to handle it). I decided to try turning it on again this am and rebooted. Suddenly, my system reboot time was significantly better....not quite as good as it was a bit back in time but now down to about 1 1/2 minutes, which I can live with. Don't know what did it and why it suddenly starting work better but it's better. I recognize I'm on vista and you're running XP but you might play around with your page file settings and see if that has an impact. I don't see how it would but sometimes these things throw you for a loop.
Also, in addition to the suggestions on trying a reboot in Safe Mode, which should help you determine if it's a startup program causing your system load up delay, you might reboot creating a boot log to see what errors arise. Also, you can mess around with the various startup programs and gradually disable them from startup one by one to idenitfy the culprit causing the slow startup.
-
DavidR Right after i login i Open Task Manager Where it Takes long time to load CPU Across Board was all 00 Besides
System Idle Process was 99% i'm guess that is Idle meaning PC doin nothing?
I Think these are my Source of Slow Loading now what do you guys think an Application that Hangs can Cause something to load slow no while we wait for it's timeout hang?.
Type Date Time Event Source Category Domain\User
Error 9/16/2008 10:35:00 AM 7022 Service Control Manager None N/A
Description: The Windows Image Acquisition (WIA) service hung on starting.
Error 9/16/2008 10:33:34 AM 7000 Service Control Manager None N/A
Description: "The DS1410D service failed to start due to the following error:
The system cannot find the file specified.
"
Error 9/16/2008 10:33:21 AM 10005 DCOM None \SYSTEM
Description: "DCOM got error ""%1058"" attempting to start the service IISADMIN with arguments """"
in order to run the server:
{A9E69610-B80D-11D0-B9B9-00A0C922E750}"
Warning 9/16/2008 10:32:40 AM 18 BTHUSB None N/A
Description: Windows cannot store Bluetooth link keys on the local transceiver because it cannot determine whether proper security is enabled for the device.
Error 9/16/2008 10:32:05 AM 10005 DCOM None \SYSTEM
Description: "DCOM got error ""%1084"" attempting to start the service EventSystem with arguments """"
in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}"
I Doubt it's what System loads on startup because it does not load much.
Name: Monitor Apache Servers
Path: C:\webserver\bin\apache2.2.8\bin\ApacheMonitor.exe
Name: SpybotSD TeaTimer
Path: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
Name: BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}
Path: "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
Name: SoundMan
Path: SOUNDMAN.EXE
Name: nwiz
Path: nwiz.exe /install
Name: NvMediaCenter
Path: RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
Name: NvCplDaemon
Path: RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
Name: NeroFilterCheck
Path: C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
Name: MULTIMEDIA KEYBOARD
Path: C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
Name: Cmaudio
Path: RunDll32 cmicnfg.cpl,CMICtrlWnd
I Tried Loading into Safe Mode System Did load Quick
Texas-hansen:
I Tried disabling all Startup stuff because thats what a Clean boot does even during Clean boot system still loaded slow.
So i Heavy Thinking it's not a program Rather Something with windows. Windows has been giving me a shyt load of updates.
I Been Google them Services Errors and Many People Report When WIA Hangs that there system takes 5 mins to boot.
I'm guess now thats my problem only how to fix =) hehe sorry i thought it was Avast, and i Thank you for Helping me determine what it was now i just have to find a Fix
I Just want to Point to anyone have Similar problem Disabling Windows Image Acquisition (WIA) System Loads Quick Again. Now if i Find a Fix so that WIA can be enabled i will Post it here.
-
I used to get the occasional WIA error in the event viewer on my old system, but it didn't appear to impact on my boot duration.
Unfortunately I'm at a loss as to what it might be or its solution.
The WIA service you could try setting it to manual start and see if a) something starts it on boot or b) if it remains unstarted after boot; mine is set to manual and currently it isn't started.
I guess it depends on what other hardware you have loaded if it is needed or not.
Provides image acquisition services for scanners and cameras.
-
Yea i have a Printer that is Scanner/Print/Fax/Camera Docking So i Need the WIA i don't mind starting it when i need to use them so i took your advice.
I Set the WIA to Manual and system loads quick again.
Got me on that one i looked on Microsoft.com Site Found:
http://support.microsoft.com/default.aspx?scid=kb;en-us;823612
http://support.microsoft.com/default.aspx?scid=kb;en-us;819017&Product=winxp
It appears something with the WIA and Incorrect Drivers make system load slow i Have a dell print so i went to dell and downloaded newest drivers still didn't fix problem i may call dell and yell at them. =)
Lolz anyways Thanks again Setting Service WIA to Manual did fix problem and it boots fine now.
-
You're welcome.
Manual is a safer setting as it only loads when required, and you shouldn't actually have to start it yourself (I believe), when you start up your scanner/printer, etc. that should start the WIA service, at least that is my understanding of it. Though if not it isn't a big deal to start it.