Startup performance degradation...

There's an app on my system that causes startup performance degradation:



The file name in the event viewer is "Devic" and in details tab, the folder name displayed as "C:\Devic". This performance degradation does not happen every day and presumably, during the other days the start up is normal.

The issue is that there's no such file or folder name on my system. Neither the file search with Windows Explorer/TreeSize, nor registry search, running both standard and admin account could find it.

Windows Explorer is set to show hidden items, but beyond that, I don't know how to find these files and folders. Are there other ways to find these items on the system?

TIA...

As a start, try Sysinternals/Technet's AutoRuns to see if it appears. Don't be surprised if it appears as File not found.

Alternatively, try Sysinternals/Technet's Process Monitor and, from the Options menu, select Enable Boot Logging. After the trace is completed, look for Failure in the Result column, (Unfortunately ProcMon has a bit of a learning curve, hence why I suggest trying AutoRuns first.)

(I wouldn't be surprised if it was a C:\Device blah blah filepath that's been corrupted.)

Hope this helps...

RickC said:

As a start, try Sysinternals/Technet's AutoRuns to see if it appears. Don't be surprised if it appears as File not found.

Alternatively, try Sysinternals/Technet's Process Monitor and, from the Options menu, select Enable Boot Logging. After the trace is completed, look for Failure in the Result column, (Unfortunately ProcMon has a bit of a learning curve, hence why I suggest trying AutoRuns first.)

(I wouldn't be surprised if it was a C:\Device blah blah filepath that's been corrupted.)

Hope this helps...

It did help, I forgot about the SysInternals tools and thanks for the reminder...

You were correct, AutoRuns didn't find anything...

On the other hand, Process Monitor helped somewhat. Searching for the directory of "C:\Devic" came up empty, but did find a lot of errors for "C:\Device" directory:



Maybe the event viewer does not record the folder/file name correctly. These errors are not just a start up time, the app (VIPRE Advanced Active Protection Service) throws these errors about 100 times a minute. Not even certain why it's looking for "Volume 4", the most volume a drive in this system has is three.

That's something that I should take up with Vipre, or J2 Global, or whoever owns it nowadays. That could be a lost cause, since their licensing is a mess to start with:



Yes, that's a valid license key, all services are the latest version, running just fine and definitions are updated. Go figure...

Could it be some sort or remnant of malware? I remember to have seen that c:\device folder detected as malware by ADWCleaner on some PC I ran it on.

eLPuSHeR said:

Could it be some sort or remnant of malware? I remember to have seen that c:\device folder detected as malware by ADWCleaner on some PC I ran it on.

That had been my initial reaction as well and somewhat relaxed, when the file and folder could not be located anywhere.

I do take preventative measures to make certain there isn't any malware on this system:

• First and foremost, standard security recommendation is in place, including controlling outbound access via software firewall
• Hardware Firewall
• Group policy software restriction
• Vipre AV
• Weekly scan by Emisoft's "Emergency Kit Scanner"
• Once a month alternating offline scan by Bitdefender or Kaspersky Rescue USB

Nonetheless, anything is possible nowadays, but it would also mean that this system had been infected by malware. To my knowledge at least, that has not been the case during this system's lifetime.

The system used to have Malwabytes as well, but had been removed due to the performance impact to the system. Maybe I install it again, the license key is still valid, and see what happens. The only drawback is uninstalling MalwareBytes can be a pain. Maybe just restore the previous day's full Macrium backup a better option...

Good to see you are double-checking everything. Maybe someone else could shed some light on this.

eLPuSHeR said:

Good to see you are double-checking everything. Maybe someone else could shed some light on this.

Maybe someone could, but it started to look like that this is a "wild goose chase"...

Installed and activated my license for MalwareBytes 3.6.1.2711. The initial scan found a PUP, named "reimage.ini". Virus Total showed 56, or all green when it scanned it.

MalwareBytes still adds 2-3 seconds to opening Office 2013 apps, off it goes from my system...