[pchelpers] Re: indomitable malware - Antivir best antimalware program

Hi Scott

> EGlnl> I guess you mean ntbtlog.txt in Windows, which is surprisingly
> EGlnl> small, especially compared to my own computer, which seems to
> EGlnl> have major problems with many drivers. What can one do about
> EGlnl> that?
> 
> Let's see.... BOOTEX.LOG is the boot-time scandisk result file...
> 
> Ok, I see NTBTLOG.TXT in C:\Windows, and it is the only file that has
> boot information, but I don't recognize it or the name. Let me run up
> AutoPatcher XP... oh yes, Microsoft BootVis. Try that. It ha several
> options; one is for tracing boot and driver delays, and another option
> is for automatic optimization.

I tried to use that on my computer a while ago but couldn't really
figure it out, not even whether it does more than analyse. I was also 
very frustrated and confused by the "help" file. Luckily we have 
Wikipedia http://en.wikipedia.org/wiki/BootVis where we can find 
collective wisdom and explanations of MS's horrible bureaucratese, 
especially in the links WP provides: http://www.tweakhound.com/xp/bootvis/

I tried Bootvis with both of the unintuitively exclusive and confusing
choices "restart automatically after tracing" and "shutdown before
tracing"* on the formerly sick laptop but it keeps crashing towards the 
end of "saving the boot trace to file" after the boot. I then tried it 
on my computer, but it always crashes there too. I get the error message 
"PerfVis NT Performance Tool has encountered a problem and needs to close."

But since the program seems to crash during the restart of Bootvis, not 
the log creation, i guess the generated logs can be trusted, and they do 
show a very strange and logical period of inactivity of 30 seconds for 
the formerly sick laptop. This precisely corresponds to the startup 
length, which is about 30 seconds longer than on my computer.

I have no idea what to do about that. The only hint the program gives is 
that it says "Warning! Disk write caching is disabled." in the Disk I/O 
graph. But it says that on some of my results too, but not all. Very 
confusing. And the boot activity graph for the sick laptop is completely 
empty although i tried to create a new list with that included. Very 
confusing and frustrating. I was somehow able to make a list in Bootvis 
on my computer a while ago that produces this graph. I can't imagine why 
boot activity is not part of the default list. I could scream...

On the sick laptop, some drivers have long delays, but most of these 
take place after the computer is already usable, so they don't seem to 
slow down the startup process in a way that affects the user noticeably. 
The following ones cause delays before the 80 seconds needed for the 
welcome screen to appear:
sisidex.sys
ikfileflt.sys
network delay

The Optimise System command helped a bit on my computer but not on the 
other.

* Guess they mean "Restart Windows automatically" and "Restart Windows 
manually"
Didn't understand the Initial number choice.

> No, that's not what I was thinking of either, but it may help you
> anyway.  I'm sure that whatever I was thinking of was in C:\, but I
> can't figure out what it was.

I seem to remember that the same logging command that produces
ntbtlog.txt produced c:\bootlog.txt or something like that in 98, but i
don't have time to look that up now.

Before i run Bootvis, is there anything i can do with the info provided
by ntbtlog about all "Did not load driver XYZ" entries? I seem to
remember that the Win98 file had a lot more info, including time spent
trying to load each driver.

> If you haven't looked at AutoPatcher XP yet, you should; it will
> install Microsoft Windows patches for you without needing an internet
> connection. It's updated every other month, and currently it's about
> 364MB in size. There's now a Vista version also.

Thanks, you mentioned that before i think, but i haven't had time to
deal with it.

> EGlnl> Great! The firewall is working again! Interestingly my own
> EGlnl> computer doesn't even have such a key.
> 
> No, it should not have that key normally. The system automatically
> deletes the whole thing if everything is set to "Not configured".

Where? That option is apparently only in gpedit and that's not available
in XP Home.

Since the firewall was set to Off and its choices were grayed out, it
sure looked like a trick produced by malware. What do you think about
that idea and this reg file?:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windowsfirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windowsfirewall\domainprofile]
"enablefirewall"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\windowsfirewall\standardprofile]
"enablefirewall"=dword:00000000


PS
CCleaner deletes the temp files of only the account it's run in. Very
annoying.



-- 
-------list-services-below-----------
Regards, John Durham (list moderator) <http://modecideas.com/contact.html?sig>
Freelists login at http://www.freelists.org/cgi-bin/lsg2.cgi
List archives at http://www.freelists.org/archives/pchelpers
PC-HELPERS list subscribe/unsub at http://modecideas.com/discuss.htm?sig
Latest news live feeds at http://modecideas.com/indexhomenews.htm?sig
Good advice is like good paint- it only works if applied.

Other related posts: