It takes a long time to login.

[Qwertvert]

As I said in the title, my computer has been logging in very slowly lately. I run Windows XP SP1. After typing in my password in the login screen, it goes to my desktop. I can see just the background image for a few seconds, then the icons and taskbar appear. The taskbar is almost all blue (the color of my background, not the color of the background image) and I can't see the "Start" button, the tray icons, the quick launch icons, or the area where the programs appear on it. One-by-one they appear. Slowly. Once they all appear, my computer is very slow. It will take a minute for a program to open if I click its icon at this point. After a minute or so, the last program that starts on startup appears, and after another minute, my computer is up.

Before this, it would login in seconds, with no wait. The same programs (maybe more would run). I have three programs that run. Xfire, Fraps, and Daemon-Tools. Also, a program for my mouse driver starts up. I have checked out MSConfig, the registry, and also the services thing in the Group Policy Editor (I think, did this a while ago).

Also, there are two things that start on startup that I'm not sure of. In MsConfig, it says that "NvCpl" and "UpdReg" (Both in HKLM\SOFTWARE...Current Version\Run). NvCpl's command is "RUNNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup" and UpdReg's is "C:\WINDOWS\UpdReg.EXE". These are most likely okay, but I figured that I would mention them anyways.

I have (and have ran) AVG, Spy Sweeper, Spybot Search & Destroy, and Ad-Aware. I have ran these and turned up nothing, except a cookie or two.

For my other question, I can't stand a cluttered root, so I want to hide all of my files and folders that I don't access. My question is: If I apply a system attribute (attrib +s +h *), will it mess anything up. Mostly, I want to hide boot.ini, IO.SYS,MSDOS.SYS, IPH.PH, DELL.SDR and (not sure if this is some sort of backup) boot.lgb.

Anyone have an idea as what to do on either of these?

[Boris]

"RUNNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup"

Initializes the clock and memory settings on nVidia based graphics cards.

Disable this if you overclock your card.

[Qwertvert]

No, my GPU isn't overclocked.

Anyone have another idea?

[nellie2]

Download this program and run it and copy and paste the log it makes as a reply to this thread, that way we can see just exactly what is loading at startup

http://www.spywareinfo.com/downloads.php?cat=startup#startup

[Qwertvert]

Logfile of HijackThis v1.98.2

Scan saved at 9:32:50 PM, on 11/2/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\Tablet.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Daemon Tools\daemon.exe

C:\program files\fraps\fraps.exe

C:\WINDOWS\SYSTEM32\Wtablet\TabUserW.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\BETHES~1\MORROW~1\Other\NIFTEX~1\NIFTEX~1.EXE

C:\Program Files\Jasc Software Inc\Paint Shop Pro 8\Paint Shop Pro.exe

C:\Program Files\Xfire\Xfire.exe

C:\Program Files\Opera\opera.exe

C:\PROGRA~1\MICROS~3\Office10\FRONTPG.EXE

C:\Program Files\Winamp\winamp.exe

C:\WINDOWS\System32\Cmd.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\DOCUME~1\smm\LOCALS~1\Temp\Rar$EX00.234\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\Daemon Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [Fraps] c:\program files\fraps\fraps.exe

O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe

O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\SYSTEM32\Wtablet\TabUserW.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O10 - Broken Internet access because of LSP provider 'xfire_lsp_8742.dll' missing

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O12 - Plugin for .tga: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin7.dll

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_42.cab

[Qwertvert]

StartupList report, 11/3/2004, 9:19:54 AM

StartupList version: 1.52

Started from : C:\DOCUME~1\smm\LOCALS~1\Temp\Rar$EX00.765\StartupList.EXE

Detected: Windows XP SP1 (WinNT 5.01.2600)

Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)

* Using default options

==================================================

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\Tablet.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Daemon Tools\daemon.exe

C:\program files\fraps\fraps.exe

C:\WINDOWS\SYSTEM32\Wtablet\TabUserW.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\system32\cidaemon.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Xfire\Xfire.exe

C:\Program Files\Opera\opera.exe

C:\Program Files\WinRAR\WinRAR.exe

C:\DOCUME~1\smm\LOCALS~1\Temp\Rar$EX00.765\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:

[C:\Documents and Settings\smm\Start Menu\Programs\Startup]

Xfire.lnk = C:\Program Files\Xfire\Xfire.exe

Shell folders Common Startup:

[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]

TabUserW.exe.lnk = C:\WINDOWS\SYSTEM32\Wtablet\TabUserW.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

UpdReg = C:\WINDOWS\UpdReg.EXE

--------------------------------------------------

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Fraps = c:\program files\fraps\fraps.exe

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe

SCRNSAVE.EXE=C:\WINDOWS\CoDIntro.scr

drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*

HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Download Program Files:

[{33564D57-0000-0010-8000-00AA00389B71}]

CODEBASE = http://download.microsoft.com/download/F/6...922/wmv9VCM.CAB

[FilePlanet Download Control Class]

InProcServer32 = C:\WINDOWS\Downloaded Program Files\FilePlanetDownloadCtrl.dll

CODEBASE = http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_42.cab

[shockwave Flash Object]

InProcServer32 = C:\WINDOWS\System32\macromed\flash\swflash.ocx

CODEBASE = http://fpdownload.macromedia.com/pub/shock...ash/swflash.cab

--------------------------------------------------

Enumerating Winsock LSP files:

Protocol #1: xfire_lsp_8742.dll (file MISSING)

Protocol #2: xfire_lsp_8742.dll (file MISSING)

Protocol #3: xfire_lsp_8742.dll (file MISSING)

Protocol #4: xfire_lsp_8742.dll (file MISSING)

Protocol #5: xfire_lsp_8742.dll (file MISSING)

Protocol #17: xfire_lsp_8742.dll (file MISSING)

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll

CDBurn: C:\WINDOWS\system32\SHELL32.dll

WebCheck: C:\WINDOWS\System32\webcheck.dll

SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------

End of report, 4,846 bytes

Report generated in 0.219 seconds

Command line options:

/verbose - to add additional info on each section

/complete - to include empty sections and unsuspicious data

/full - to include several rarely-important sections

/force9x - to include Win9x-only startups even if running on WinNT

/forcent - to include WinNT-only startups even if running on Win9x

/forceall - to include all Win9x and WinNT startups, regardless of platform

/history - to list version history only

[nellie2]

There is nothing in your startup log that looks out of place, do you need this video software to load at startup?

c:\program files\fraps\fraps.exe

Perhaps disabling that might make a difference

[madboy33]

why was xfire.exe running at the time of the scan? Or was it?

What Graphics card do you have? Latest drivers installed on it?

I have an ATI card and this happened a couple times, i changed the Smartgart settings and all went back to normal

[Qwertvert]

I load Fraps at startup since I play games a lot on my computer, and I don't want to manually turn it on. Although, I will try it, just in case it makes a difference.

I had Xfire on because I was about to play a game of CoD with my friend, is it a bad thing that it was on at the time of the scan?

I have a nVidia GeForce FX 5200 card. I do remember updating my drivers a while back. It might have been around the time this started. Would that possibly affect the startup time?

[nellie2]

No I can't see a problem with x-fire being run at the time of the scan. Have a fiddle with your settings, and get back to us if there is any improvement or not

[madboy33]

have you tried to uninstall the drivers for the card and use drive cleaner3 in safe mode?

p.s also clean the cab files as well

below is the link for drive cleaner

http://www.drivercleaner.net/

[Qwertvert]

Okay, I'll being trying both of those.

Unfortunately, I'm not sure if I'll be back to you real quick, as I have some personal issues that are taking me out of state for a period of time.