Question Windows 7 20+ minute boot. ntbtlog contents.

[Pentacore]

Windows 7 is taking around 20 mins to boot. Turned on logging and filtered only the lines where a device driver isn't loading as that's all that's really in the log other than the successful drivers loading. Searching online, I tried sfc /scannow and if found no issues. I also can CC Cleaner and it fixed nothing.

Here are the drivers from the ntbtlog.txt file (this is a freshly generated one BTW).

Any ideas?

Thanks for your help!

(7 hits)
Line 51: Did not load driver \SystemRoot\system32\DRIVERS\cdrom.sys
Line 102: Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Line 103: Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Line 104: Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Line 105: Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Line 113: Did not load driver \SystemRoot\system32\DRIVERS\MpFilter.sys
Line 127: Did not load driver \SystemRoot\System32\DRIVERS\srv.sys

 

[mikeymikec]

First of all, if you haven't already done so, back up your personal data.

Is the computer just taking a long time to boot then runs at a normal speed, or is it always slow regardless of the amount of time it's been on? Is the computer stable and slow, or is it unstable?

That log is pretty useless. Open up Event Viewer, go into the 'custom views' category, then click on 'administrative events'. This filters the main logs to only show you potential issues. Post any entries that occurred during the startup-sequence as they're more likely to be helpful.

If Windows 7 is suddenly taking that much longer to start, then I'd expect to see either lots of Service Control manager errors in the log complaining about services that hung on starting / not responding after 30k ms etc, or tonnes of disk errors/warnings.

If Win7 has been steadily getting slower over the course of many months and there's nothing interesting in that log, then I'd be inclined to bet that something like Norton or McAfee is/was installed and took over the job of auto-defrag and then proceeded to never defrag the hard drive. In the defrag utility, do an analysis of the Windows partition and if it is something like 10-15% then that's your answer. Defrag it, you should be back to normal, then re-enable the defrag schedule.

I said "was installed" because after they've hijacked the auto-defrag feature, even when you uninstall the software, auto-defrag remains disabled. Very intelligent design (possibly malicious intent).

 

[deustroop]

cdrom.sys failure suggests the following :
In Device Manager Expand Universal Serial Bus controllers.
Note: You might have to scroll down the list to find this item.
Right click the first USB controller under Universal Serial Bus controllers, and then click Uninstall to remove it.
Repeat for each USB controller that is listed under Universal Serial Bus controllers.


Note: Restart the computer. After the computer starts, Windows should automatically scan for hardware changes and reinstall all the USB controllers that you uninstalled.

 

[mindless1]

^ Maybe, but I just checked a Win7 system that has never had a boot problem and it has the same line in ntbtlog.txt, "Did not load driver cdrom.SYS" (as well as many other drivers that "did not load"), so I'm doubting that's it.

What is the history of the system? How long has it taken an excessive amount of time to boot? What changed just before that happened?

I haven't done it in ages, but isn't there a way to display the boot log events on-screen, while booting, to see what tries to happen last before it hangs?

 

[Pentacore]

Thank you for the replies all. Yes @mindless1 , you run can msconfig and check off OS Boot information. Optionally you can check off Boot log to create the ntbtlog log file. Unfortunately checking the OS Boot Information option doesn't show anything helpful on the screen. It flashes a few things at first but then goes all black for a bit, then into Windows.

@deustroop That's a good idea but unfortunately I won't have physical access to the computer to try that for some time. I could do it remotely but don't want to risk that as this computer runs Quickbooks for a small company I support.

@mikeymikec Good call on that. I did check Administrative Events found several interesting pieces I copied down, then got lost Googling them all. Nothing was standing out at first. Then the weekend came and I got side tracked on other things. Let me grab the most interesting ones from that log and reply back here.

Thanks again for all your help everyone!

 

[Pentacore]

So below are some events I copied before and after the computer rebooted.

Anything stand out to anyone?

Thanks so much!

Error 1/4/2024 11:53:55 PM Schannel 36887 None
Error 1/4/2024 11:53:55 PM Schannel 36887 None
Error 1/4/2024 11:53:35 PM Schannel 36887 None
Error 1/4/2024 11:53:35 PM Schannel 36887 None
Error 1/4/2024 11:53:35 PM Schannel 36887 None
Error 1/4/2024 11:53:35 PM Schannel 36887 None
Error 1/4/2024 11:53:29 PM Schannel 36887 None
Error 1/4/2024 11:53:29 PM Schannel 36887 None
Error 1/4/2024 11:53:29 PM Schannel 36887 None
Error 1/4/2024 11:53:29 PM Schannel 36887 None
Error 1/4/2024 11:26:42 PM Kernel-EventTracing 3 Session
Warning 1/4/2024 11:26:42 PM Kernel-EventTracing 4 Logging
Error 1/4/2024 11:24:20 PM DistributedCOM 10016 None
Error 1/4/2024 11:23:20 PM Service Control Manager 7026 None
Error 1/4/2024 11:23:20 PM WMI 10 None
Error 1/4/2024 11:23:12 PM Kernel-EventTracing 3 Session
Warning 1/4/2024 11:04:08 PM User Profile Service 1530 None
Error 1/4/2024 10:58:08 PM Schannel 36887 None

-REBOOTED COMPUTER-

Error 1/4/2024 10:35:51 PM Microsoft Antimalware 2001 None
Error 1/4/2024 10:35:51 PM Microsoft Antimalware 2001 None
Error 1/4/2024 10:35:51 PM Microsoft Antimalware 2001 None
Error 1/4/2024 10:27:44 PM Kernel-EventTracing 3 Session
Warning 1/4/2024 10:27:44 PM Kernel-EventTracing 4 Logging
Error 1/4/2024 10:25:49 PM srv 2017 None
Error 1/4/2024 10:25:50 PM DistributedCOM 10016 None
Error 1/4/2024 10:24:50 PM Service Control Manager 7026 None
Error 1/4/2024 10:24:49 PM WMI 10 None
Error 1/4/2024 10:24:45 PM Kernel-EventTracing 3 Session
Error 1/4/2024 10:06:50 PM Kernel-EventTracing 3 Session
Warning 1/4/2024 10:06:50 PM Kernel-EventTracing 4 Logging
Error 1/4/2024 10:06:26 PM DistributedCOM 10016 None
Error 1/4/2024 10:05:52 PM mrcbt 2008 None
Error 1/4/2024 10:05:26 PM Service Control Manager 7026 None
Error 1/4/2024 10:05:25 PM WMI 10 None
Error 1/4/2024 10:05:19 PM Kernel-EventTracing 3 Session
Error 1/4/2024 5:41:51 PM Schannel 36887 None

 

[mikeymikec]

What are the Service Control Manager, mcrbt and srv ones about?

 

[Shmee]

I would definitely check hardware, especially focusing on the boot drive. If it is a HDD, probably time to clone to an SSD. I also agree with backing up, if this hasn't been already done. Also make sure there is ample free space on the boot drive.

 

[Pentacore]

Everything is backed up. The boot drive is a new Samsung SSD that I cloned the existing 14 year old WD 1TB HD to. This problem was happening long before that change to the SSD though, so it must be something else. It 's a 1TB SSD with over 600GB of free space, so that's also not an issue.

As for the Service Control Manager, mcrbt and srv ones, I really don't know. I will look them up individually online, and continue my search. This machine is rarely rebooted so at least this isn't a huge deal, but it would be nice to resolve it. Thanks all!

 

[mikeymikec]

Event Viewer - double-click on a log entry for more information.

Can you provide some systems specs?

Check with Samsung Magician whether your drive needs a firmware update?

 

[In2Photos]

So this machine is quite old then? Is the CMOS battery dead?

 

[Pentacore]

Thanks all, but Samsung magician reports the drive is fine and using the latest firmware. The CMOS battery was replaced 2 years ago, so that's not it either. It's ok., I will just live with it because as I mentioned already, the machine is rarely rebooted.

 

[mindless1]

Everything is backed up. The boot drive is a new Samsung SSD that I cloned the existing 14 year old WD 1TB HD to. This problem was happening long before that change to the SSD though, so it must be something else. It 's a 1TB SSD with over 600GB of free space, so that's also not an issue.

I overlooked this. Do you still have the 14 year old WD 1TB HDD hooked up? If so then the next thing I'd try is to disconnect it.

I came back to this topic because I had a similar situation. Old Win7 system, and although it did not have the HDD cloned to an SSD, it had a good/newer SSD in it for boot/OS that works fine but also a HDD as secondary storage and the HDD was dying.

The system acted weird, that HDD dropped out, and oddly enough even some of the USB ports (but not all?!) stopped recognizing USB flash drives. I rebooted to see if that would fix anything, and suddenly it would stop booting on the windows logo and just sit there. Whether it would have finished if I had waited 20 minutes, IDK, I don't have time for that!

Anyway, tried booting again a few times and always stopped at the same point, then disconnected the HDD and it booted fine thereafter.