Programs not starting on boot

[Mighty]

Win 7 Pro 64

I've seen some other threads on this, and I've been searching the 'Net all evening. But I haven't found a solution, yet.

Starting a couple of weeks ago, (around Aug 3) I booted and noticed that a bunch of programs didn't start with Windows as they should. I'm pretty sure the only change that had happened since the previous boot was a Windows Update. Since I was in the middle of something for work, I decided to try a System Restore. That worked, so I put off researching the problem until I had more time. Then, a few days later, a new update came down that installed itself. In addition, it threw away the previous Restore Point. So, no going back, now. I limped along like that for a few days. Then, for no reason I can find, for two boots it worked perfectly. Tonight, another update, and it's back to not working. That's where I'm at now.

Running the programs manually works. No UAC warnings or anything like that.

In addition to none of the programs in my Startup folder starting, when I bring up the Task Manager immediately after a boot, only about 15 processes are running. Normally, there's more than a screen-full. So, I'm pretty sure that there are a lot of other things that are not getting fired off, too.

There are some things that are running. Under HKCU\Software\Microsoft\CurrentVersion\Run I see some items that are running and some that are not. Actual Multiple Monitors, GFI Backup, and Input Director are running and visible in the System Tray. AutoVer, Steam, and WallpaperChanger are not running. I just searched Autoruns for every mention of Actual Multiple Monitors and do not see anyplace else that would fire it off (it's mentioned in a context menu handler.) After a quick skim, it appears that all of the services are starting.

This system has been running under Avast. I downloaded Malwarebytes and ran a full scan. It did not find anything. I ran HijackThis and pored over the log, and recognized or searched to find everything. I ran sfc /scannow. No errors. The items do show up in msconfig, and they are checked. I downloaded Autoruns http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx and they show there, too. I looked in Event Viewer, and nothing jumps out at me, there. I do *not* see a slew of messages telling me about things that didn't run.

Does anyone have suggestions on where to look next?

Thanks,

Drake Christensen

 

[dodger46]

Anything untoward in msconfig? ie all the boxes in Startup and Services checked as normal?

 

[Mighty]

Yep. Every box checked in both tabs.

Drake

 

[dodger46]

Can only suggest you remove Updates since beginning of August (You'll find them in Update History) and then re-install them as that's the only significant change apart from the Restore...

 

[Mighty]

The one time I did do that, the reinstall broke it, again. So, I'm not confident that's going to produce any better results this time.

And, without restore points, can I even remove them? Since they're altering the OS itself, I don't think I can simply remove them. That's basically the purpose of restore points, to save off the system files prior to the update altering them.

Drake

 

[dodger46]

Think we may be edging towards a clean re-install... I'm seeing about 6 recent updates for Windows (Pro 64 same as you) and a few slightly older. Reasonable to assume one of them is the culprit, if you CAN uninstall, select individual updates to re-install till you find which one is causing the grief and prevent it from installing in future. Going to be time consuming whatever...

 

[Mighty]

Obviously, a clean reinstall is what I'm trying to avoid. It would take quite a while to get this machine reconfigured the way I like it.

The fact that it was working for a couple of boots gives me hope that it's fixable. Also, a few threads I've found around the InterWeb tells me that I'm not the only person who's seen this. Hopefully, I'll find one where someone came back and posted a solution that will work for me.

Or, hopefully someone on this board will see this later today.

Drake

 

[dodger46]

Do any of the other threads link it to Windows Update? Guessing there must be a conflict between your setup and one of the updates which could well reappear if/when you re-install Windows. Need to identify which update somehow...

 

[techguy911]

Seem you might have a rootkit and no not all AV's can pick them up.
Download kaspersky rescue cd and burn and boot the iso and run a scan.
Download combofix and under avast shield control disable perm then run combofix.
After combofix is done restart your computer and see if your programs are now starting and re-enable your shields on avast.

 

[Mighty]

Kaspersky currently running. 17% through and it says 10 more hours to complete. It has already checked the boot section.

I predict that's not going to be the problem. We'll see.

Drake

 

[Mighty]

It found Exploit.Linux.Lotoor.g, which is a false positive. That's the rageinthecage exploit that's specific to rooting my Android phone. So, I know what it is, and I know why it's on my machine, and I know it's not the culprit.

I did get five "Processing Error" "Read error"s. They were all within the QuicktimeInstaller.exe in my /mnt.../Downloads folder. Plus one more for the folder itself. I searched on that, and from what I can gather, that appears to point to various bugs within Kaspersky itself. My impression is that it is *not* indicative of a dying hard disk. The scan continued to run after these errors and went on to report a couple of more instances of the same Linux exploit I mentioned above, within the .zip file that I originally downloaded it.

If someone insists I'll run it again over night. But, I think that points away from a virus/trojan, and I'm pretty sure it's not flaky hardware.

Who has ideas on where to look next?

Thanks for the ideas so far,

Drake

 

[MidnightDistort]

Have you tried running the viral software in safe mode? You might have something that is preventing the scans to read it. Also if you have CCleaner check your registry files and there's also a startup, like msconfig that might be able to tell you something.

 

[dodger46]

Did you try Startup Repair from your Installation disk yet??

 

[Mighty]

Have you tried running the viral software in safe mode? You might have something that is preventing the scans to read it. Also if you have CCleaner check your registry files and there's also a startup, like msconfig that might be able to tell you something.

The Kaspersky Rescue Disk runs completely outside the OS, so it's basically "Safer than Safe Mode."

Also, in my original post, I mentioned running msconfig and autoruns. All of the programs are listed, and all are checked.

Did you try Startup Repair from your Installation disk yet??

I'll give CCleaner a try, and then I'll look into Startup Repair.

But we're starting to get a little drastic at trying destructive repairs without knowing what it is we're dealing with. I had seen some discussions of similar issues on this board, but never a resolution. Someone on another board turned off UAC, which I don't want to do. Both for security reasons, and because this was working fine just a few weeks ago. And, running each program manually does not generate a UAC warning.

Can anyone think of any more diagnostics I can run to narrow down why none of the items in the Startup folder run, and some of the items in HKCU\Software\Microsoft\CurrentVersion\Run run and others don't? As I said, I looked at the Event Viewer and I do *not* see a slew of error messages about programs that can't be run. I don't know if the OS is even trying to run them. Is there some other form of logging I can turn on (I've already turned on boot logging from the F8 menu and there's nothing noteworthy there) that will tell me more about what's going on during the boot process?

Drake

 

[dodger46]

Here's a step-by-step for Startup Repair just in case. Recommends remove USB drives before you start. Last resort I guess before you have to re-install...
http://pcsupport.about.com/od/toolsofthetrade/ss/windows-7-startup-repair.htm

 

[Mighty]

The latest oddity is that it straightened itself out, again, briefly.

I was doing some surfing on it and had a bazillion tabs open in IE. At one point, it got confused and there was little I could do. The Windows button didn't work. So, I did a hard reset.

When it came back up from that, all of my Startup programs had loaded. Albeit, on the first boot I didn't have any network. For the next two reboots after that, everything loaded. On a third reboot, as a test, it failed, again.

Just now I did a restart from the Windows button and it failed. From there I did a reset and no joy. Still not working.

You know. It almost acts as if it thinks the Shift key is being held down. I did recently add an Xarmor wireless keyboard. And my old Logitech wireless is still plugged in. There's no reason those should interfere. There's nothing lying on a key on either keyboard. Hmm. That's probably not it. I just checked and the keyboard had been installed for a couple of weeks before I started seeing this problem.

I just unplugged the Xarmor adapter and rebooted and it worked. While logging in I tapped both shift keys on the Logitech a few times. It didn't feel like there was anything stuck under the keys. But, it could be that the keyboard got confused about the state of the shift key. I haven't touched that keyboard in a few weeks.

Next, I'm going to unplug the Logitech and plug the Xarmor back in.

And it worked.

I'm not going to take time to plug both back in and narrow it down any further. It could be interference. Or, it could be dust or something under the shift key on the old keyboard. Doesn't matter that much to me.

Thanks for helping me think this through. I'm glad it was something simple, and I'm glad that I found a specific cause. I hate magic solutions.

Hopefully someone in the future with this issue will stumble on this thread.

Drake

 

[Mighty]

Hmm. That wasn't it. Or, that wasn't all of it. It now works some of the time. Maybe 3 out of 10 tries. One could say that's an improvement. But apparently I'm still searching. Next, unplug all of the wireless keyboards and try a wired keyboard.

Drake

 

[Mighty]

Nope. Still fails. The only keyboard plugged in at the moment is the wired one.

But I think this idea that Windows thinks the Shift key is down is an idea I wish I knew how to chase down. I wish Microsoft had provided some sort of indicator that it was bypassing Startup programs.

(I would have designed that entire thing differently. I would provide some sort of menu at the logon screen for the user to quite specifically and very visibly choose to suppress the Startup folder.)

I suppose the next thing to unplug is the new Logitech G700 mouse that I got at the same time as the Xarmor keyboard. I don't think I have a working wired USB mouse, at the moment. I'll have to use a different wireless one.

I'll also unplug my hub. I think the only working device plugged into it right now is the mouse receiver. I think everything else is just a dangling cord.

Drake

 

[dodger46]

The intermittent nature of the bug is a thorny one, hubs can produce strange results, I use a non-powered one, and though peripherals are recognised when plugged in, they don't always perform. At least it would appear to be a hardware problem and negate the necessity of Startup Repair etc.

 

[Mighty]

I dunno. I would have bought the idea of a hardware problem except I've swapped out or removed pretty much every component. The hub was disconnected and the only USB devices were a simpler Logitech wireless mouse and a generic wired keyboard. So, I've seen this behavior with four different keyboards and two mice.

Also, thinking it through a little further, my idea of Windows being confused about the shift state doesn't really hold up. Otherwise, I'd be seeing shift behavior all over Windows. I'd see caps when I'm typing, shift-click when I'm using the mouse, etc. I'm not seeing any of that.

So, it's more like the "Shift is down" flag is being set during the boot process, even though the keyboard driver doesn't actually see the shift being held down.

Or, it's something else entirely. That just seemed like a pretty good fit when it came to mind.

And my success rate has fallen back off. After those few good boots a few hours ago, I've booted the machine to about 7+ failures in a row.

Windows just installed *another* update. Just rebooted and it's another failure. So, I guess I'm at a loss, again.

Do you, or anyone else, have any more suggestions?

Drake

 

[dodger46]

You'd think if it was software it would affect every boot, and in the same manner. Which brings you back to hardware. Could try testing memory, perhaps one area dodgy, causing the startup to be misread, or possibly a bad sector on your HDD? Simple enough to run checks and rule them out of the equation...

 

[Mighty]

memtest86+ v4.20 had made it 86% of the way through when I bumped the Esc key. Doh! I'm letting it run again to completion. But, if the problem were bad memory then I would expect it to show up by that point. So, that's probably not it.

Is there a current favorite non-destructive hard disk tester?

Drake

 

[dodger46]

I use Seatools
http://www.seagate.com/support/downloads/
(Didn't destroy a disk on me yet!)
More on the Hiren's Disk (Too many to mention!
http://www.hirensbootcd.org/download/
I think they recommend at least 3 passes of Memtest to be sure...

 

[Mighty]

Thanks for those links. I'd actually saved a link to Hiren's before, but of course, that was probably a couple years ago, so I don't even remember doing it. Looks like there's a lot of stuff in there.

I understand about letting it run a few passes. But, I think that the way to bet is that if it's failing, then it'll fail pretty quick. Still, doesn't hurt to let it run while I sleep. I'll let it finish this pass (94%) and then I'll reboot and give a hard disk diagnostic a chance.

This problem that I'm seeing is so specific that flaky hardware just doesn't seem very likely. If the hardware were failing then I'd expect to see all kinds of wacky behavior and some BSODs. I expect it's going to be some off setting in Windows, or some obscure interaction with something early in the boot process. I just wish I could get more information on what it's actually attempting to do and what it's bypassing.

Drake

 

[dodger46]

I tend to agree with that, and we're clutching a straws a bit, but have to rule it out.
Startup Repair still an option, but still poses the question, what is the variable which allows some boots to work and others not? Whilst I don't have a great deal of faith in the Repair options, it's one step to take in desparation rather than a complete re-jig...