[faithnhope77]

Hi and thanks for looking at my plea for help! Obviously I or someone in my family have caught something on our computer. My system is running so slowly that it appears to be completely hung up however, if I let it sit and work for long enough it usually finally does what I asked. It can take up to 30 minutes though to boot, open IE or any other program. I tried disabling Norton and downloading Avast but it found nothing and apparently that is a huge no no so as I type this on my tablet, I am uninstalling avast from my pc.
I have spent the last three days thur, fri and sat running scan with Norton, MBAM, ADW Cleaner and all say no issues found. I read through several threads on this site and have also scanned with Super anti spyware, and Viprescue. So I should have logs from these as well. I think Viprescue said it found 8 and resolved 8 issues but honestly everything is beginning to run together and I am not knowledgable to do anything that these scanners don't do automatically. Please help. Thank you

[Advertisements]

Get Process Explorer

 

http://live.sysinter...com/procexp.exe

Save it to your desktop then run it (Vista or Win7 - right click and Run As Administrator).  

 

View, Select Column, check Verified Signer, OK

Options, Verify Image Signatures

 

 

Click twice on the CPU column header  to sort things by CPU usage with the big hitters at the top.  

 

Wait a full minute then:

 

File, Save As, Save.  Open the file Procexp.txt on your desktop and copy and paste the text to a reply.

[RKinner]

Get Process Explorer

 

http://live.sysinter...com/procexp.exe

Save it to your desktop then run it (Vista or Win7 - right click and Run As Administrator).  

 

View, Select Column, check Verified Signer, OK

Options, Verify Image Signatures

 

 

Click twice on the CPU column header  to sort things by CPU usage with the big hitters at the top.  

 

Wait a full minute then:

 

File, Save As, Save.  Open the file Procexp.txt on your desktop and copy and paste the text to a reply.

[faithnhope77]

Ohmygosh! Thank you so much for helping. I just want to let you know that I have seen your instructions but my system is STILL uninstalling Avast. I will post back as soon as I can. Thank you again!

[RKinner]

From a speed point of view Avast is hands down better than Norton but you need to uninstall Norton before installing Avast.  Once it finishes uninstalling do not reinstall anything.  Just run Process Explorer.

 

Also let's run Speccy:

 

Get the free version of Speccy:

 

http://www.filehippo...download_speccy  (Look in the upper right for the Download

Latest Version button  - Do NOT press the large Start Download button on the upper left!)  Download, Save and Install it.  Run Speccy.  When it finishes (the little icon in the bottom left will stop moving), File, Save as Text File,  (to your desktop) note the name it gives. OK.  Open the file in notepad and delete the line that gives the serial number of your Operating System.  (It will be near the top about 10 lines down.) Attach the file to your next post.  Uninstall Speccy.

[faithnhope77]

ok, I replied to this once and apparently my post didn't save.  Oi, this is not a good time for me and tech.  so here goes again.  Sorry for the delay, Avast took forever to uninstall and restart. No big improvment to performance after restart.  I am having to use an old laptop and thumb driving the programs onto the sick desktop computer because it just takes too long otherwise..Hard to imagine considering how long it's taking anyway.  But here are the reports you requested:

 

Process Explorer:

 

Process CPU Private Bytes Working Set PID Description Company Name Verified Signer
svchost.exe 49.17 19,376 K 18,880 K 1108 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
System Idle Process 40.46 0 K 24 K 0   
procexp64.exe 6.76 33,028 K 58,312 K 2620 Sysinternals Process Explorer Sysinternals - www.sysinternals.com (Verified) Sysinternals
Interrupts 0.45 0 K 0 K n/a Hardware Interrupts and DPCs  
CLMSService.exe 0.15 2,680 K 1,580 K 3572 CLMSService CyberLink (Verified) CyberLink
netsession_win.exe 0.67 7,588 K 13,308 K 2432 Akamai NetSession Client Akamai Technologies, Inc. (Verified) Akamai NetSession Client
csrss.exe 0.31 2,864 K 8,952 K 488 Client Server Runtime Process Microsoft Corporation (Verified) Microsoft Windows
SASCore64.exe 0.33 8,072 K 10,572 K 1540 Core Service SUPERAntiSpyware.com (Verified) SUPERAntiSpyware.com
NOBuAgent.exe 0.22 3,188 K 6,672 K 1928 Norton Online Backup Service Symantec Corporation (Verified) Symantec Corporation
System 0.45 144 K 896 K 4   
mbam.exe 0.18 32,220 K 50,800 K 2820 Malwarebytes Anti-Malware Malwarebytes Corporation (Verified) Malwarebytes Corporation
ScanToPCActivationApp.exe < 0.01 4,820 K 12,664 K 2276 ScanToPCActivationApp Hewlett-Packard Co. (Verified) Hewlett Packard
n360.exe 0.12 24,204 K 12,652 K 2164 Norton Security Suite Symantec Corporation (Verified) Symantec Corporation
svchost.exe 0.02 8,828 K 16,360 K 420 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
DMREngine.exe 0.01 3,808 K 2,012 K 2176 DMREngine CyberLink (Verified) CyberLink
SUPERAntiSpyware.exe 0.09 79,756 K 97,448 K 2404 SUPERAntiSpyware Application SUPERAntiSpyware (Verified) SUPERAntiSpyware.com
dwm.exe 0.34 32,460 K 31,172 K 1324 Desktop Window Manager Microsoft Corporation (Verified) Microsoft Windows
HPNetworkCommunicator.exe < 0.01 3,824 K 8,408 K 3432 HPNetworkCommunicator Hewlett-Packard Co. (Verified) Hewlett Packard
CCC.exe 0.03 98,840 K 24,880 K 4076 Catalyst Control Center: Host application ATI Technologies Inc. (No signature was present in the subject) ATI Technologies Inc.
SearchIndexer.exe 0.07 44,760 K 33,744 K 4728 Microsoft Windows Search Indexer Microsoft Corporation (Verified) Microsoft Windows
wmpnetwk.exe < 0.01 32,976 K 16,728 K 6124 Windows Media Player Network Sharing Service Microsoft Corporation (Verified) Microsoft Windows
explorer.exe 0.05 38,140 K 61,448 K 1304 Windows Explorer Microsoft Corporation (Verified) Microsoft Windows
svchost.exe 0.01 635,092 K 349,284 K 1000 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
MOM.exe 0.02 38,700 K 7,932 K 3984 Catalyst Control Center: Monitoring program Advanced Micro Devices Inc. (No signature was present in the subject) Advanced Micro Devices Inc.
NOBuClient.exe 0.02 2,004 K 5,444 K 2524 Norton Online Backup Service Symantec Corporation (Verified) Symantec Corporation
iPodService.exe 0.01 2,476 K 7,012 K 648 iPodService Module (64-bit) Apple Inc. (Verified) Apple Inc.
AppleMobileDeviceService.exe 0.01 3,272 K 7,424 K 1676 MobileDeviceService Apple Inc. (Verified) Apple Inc.
taskhost.exe 0.02 8,892 K 13,748 K 2036 Host Process for Windows Tasks Microsoft Corporation (Verified) Microsoft Windows
n360.exe < 0.01 15,676 K 10,244 K 2836 Norton Security Suite Symantec Corporation (Verified) Symantec Corporation
svchost.exe 0.01 13,288 K 20,580 K 976 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe  12,924 K 15,848 K 4952 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
csrss.exe < 0.01 2,052 K 3,832 K 412 Client Server Runtime Process Microsoft Corporation (Verified) Microsoft Windows
netsession_win.exe < 0.01 2,892 K 9,196 K 2340 Akamai NetSession Client Akamai Technologies, Inc. (Verified) Akamai NetSession Client
iTunesHelper.exe < 0.01 3,916 K 9,464 K 2588 iTunesHelper Apple Inc. (Verified) Apple Inc.
svchost.exe < 0.01 128,468 K 136,480 K 948 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
PhotoshopElementsFileAgent.exe < 0.01 2,428 K 1,352 K 1560 Adobe Photoshop Elements 9.0 (component) Adobe Systems Incorporated (Verified) Adobe Systems Incorporated
spoolsv.exe < 0.01 9,076 K 17,248 K 1256 Spooler SubSystem App Microsoft Corporation (Verified) Microsoft Windows
mDNSResponder.exe < 0.01 2,112 K 4,692 K 1808 Bonjour Service Apple Inc. (Verified) Apple Inc.
WUDFHost.exe  2,012 K 5,976 K 5340 Windows Driver Foundation - User-mode Driver Framework Host Process Microsoft Corporation (Verified) Microsoft Windows
wuauclt.exe  1,988 K 6,352 K 4376 Windows Update Microsoft Corporation (Verified) Microsoft Windows
WmiPrvSE.exe  2,556 K 6,384 K 1836 WMI Provider Host Microsoft Corporation (Verified) Microsoft Windows
winlogon.exe  2,840 K 6,048 K 524 Windows Logon Application Microsoft Corporation (Verified) Microsoft Windows
wininit.exe  1,460 K 3,584 K 480 Windows Start-Up Application Microsoft Corporation (Verified) Microsoft Windows
UpdaterService.exe  1,116 K 3,220 K 1892 Updater Service Acer Incorporated (Verified) Acer Incorporated
TrustedInstaller.exe  5,280 K 10,492 K 4172 Windows Modules Installer Microsoft Corporation (Verified) Microsoft Windows
taskeng.exe  2,168 K 5,472 K 1988 Task Scheduler Engine Microsoft Corporation (Verified) Microsoft Windows
svchost.exe  23,008 K 22,592 K 912 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe  13,456 K 15,780 K 1436 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe  5,312 K 7,892 K 776 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe  4,552 K 8,572 K 700 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe  2,568 K 5,872 K 4916 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe  1,544 K 4,224 K 5956 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
svchost.exe  4,680 K 7,580 K 3100 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows
smss.exe  732 K 1,320 K 280 Windows Session Manager Microsoft Corporation (Verified) Microsoft Windows
services.exe < 0.01 8,464 K 11,064 K 584 Services and Controller app Microsoft Corporation (Verified) Microsoft Windows
RAVCpl64.exe  9,000 K 18,476 K 2268 Realtek HD Audio Manager Realtek Semiconductor (Verified) Microsoft Windows Hardware Compatibility Publisher
procexp.exe  2,572 K 6,752 K 5936 Sysinternals Process Explorer Sysinternals - www.sysinternals.com (Verified) Microsoft Corporation
PresentationFontCache.exe  25,008 K 18,836 K 2748 PresentationFontCache.exe Microsoft Corporation (Verified) Microsoft Windows
NASvc.exe  1,988 K 6,044 K 3132 NeroUpdate Nero AG (Verified) Nero AG
mbamservice.exe  195,584 K 68,808 K 1204 Malwarebytes Anti-Malware Malwarebytes Corporation (Verified) Malwarebytes Corporation
mbamscheduler.exe  4,384 K 8,952 K 1948 Malwarebytes Anti-Malware Malwarebytes Corporation (Verified) Malwarebytes Corporation
lsm.exe  2,476 K 3,684 K 600 Local Session Manager Service Microsoft Corporation (Verified) Microsoft Windows
lsass.exe  5,576 K 12,100 K 592 Local Security Authority Process Microsoft Corporation (Verified) Microsoft Windows
IntuitUpdateService.exe  21,928 K 9,948 K 748 Intuit Update Service Intuit Inc. (Verified) Intuit
hpwuschd2.exe  948 K 3,548 K 2536 hpwuSchd Application Hewlett-Packard (Verified) Hewlett-Packard Company
HotkeyUtility.exe  7,852 K 10,328 K 2564 Hotkey Utility  (Verified) Acer Incorporated
GREGsvc.exe  976 K 3,012 K 1844 Global Registration Service Acer Incorporated (Verified) Acer Incorporated
GoogleCrashHandler64.exe  1,672 K 708 K 2116 Google Crash Handler Google Inc. (Verified) Google Inc
GoogleCrashHandler.exe  1,512 K 528 K 1480 Google Crash Handler Google Inc. (Verified) Google Inc
dllhost.exe  2,372 K 7,092 K 2204 COM Surrogate Microsoft Corporation (Verified) Microsoft Windows
Connect.Service.ContentService.exe  20,760 K 25,628 K 1732 Service  (Verified) Autodesk
clear.fiAgent.exe  2,504 K 816 K 1960 clear.fi Resident Program CyberLink Corp. (Verified) CyberLink
atiesrxx.exe  1,476 K 3,412 K 864 AMD External Events Service Module AMD (Verified) Microsoft Windows Hardware Compatibility Publisher
atieclxx.exe  2,156 K 5,032 K 1288 AMD External Events Client Module AMD (Verified) Microsoft Windows Hardware Compatibility Publisher
armsvc.exe  1,184 K 3,424 K 1628 Adobe Acrobat Update Service Adobe Systems Incorporated (Verified) Adobe Systems
AdobeARM.exe  4,128 K 11,836 K 2572 Adobe Reader and Acrobat Manager Adobe Systems Incorporated (Verified) Adobe Systems

[RKinner]

The top line 

 

svchost.exe 49.17 19,376 K 18,880 K 1108 Host Process for Windows Services Microsoft Corporation (Verified) Microsoft Windows

 

is the problem.  Unfortunately svchost.exe is a generic program used for many different services so I can't see what it does.  Run Process Explorer again and if svchost.exe is still high then right click on it and select Properties then Services.  What Services are riding on this one?

[faithnhope77]

ok.  I re ran explorer.  It was still on top.  it lists C:/windows/system32... 

CryptSvc

Dnscache

Lanman Workstation

NlaSvc

 

Also, I am still trying to post the Speccy log back to you.  It keeps getting hung up trying to post.  I am going to try to use another laptop really quick.

[faithnhope77]

ok, fair warning!!!  I have tried to copy/paste this text file into this reply about 6 times on two different laptops.  I don't know why, it's too big or it's buggy or I don't even know what to say.  I am totally and completely at a loss.  So I am trying to attach the file instead.  I don't know if you want to or should open it.  I just don't know. If you have other instructions for me, I will follow take that next step instead.

 

Attached Files

•  HARRISHOME-PC.txt   312.37KB   391 downloads

[RKinner]

Go back to Process Explorer and right click on the sick svchost and select Properties then Services.  

 

 

Highlight the DNSCACHE Service and click Stop.  Watch the CPU %  Does it drop?

 

Highlight the Crypto Service and click Stop.  Watch the CPU %  Does it drop.

 

The other two can't be stopped so easily as they have dependent services.  I am hoping one of these makes a big difference.

 

Restart the services.

 

The easiest way to stop the other two is via the Services menu.  Right click on Computer and select Manage (Yes) then Services and applications then Services.  Find the Workstation and right click on it and select Properties.  Stop the service.  It will complain.  Tell it you want to do it anyway.  Check Process Explorer and see if the % changes.

 

Repeat for Network Location Awareness.

 

These last two have dependencies which won't automatically restart until you reboot but I don't think they are important.

 

Hopefully one of these 4 is the culprit.  Let me know.

[RKinner]

The speccy report is too big to copy and paste.  Attaching it is the correct thing to do.  Speccy says you are running a bit hot and the Hard drive is getting a bit too full.  I don't think it's hot enough yet to cause the CPU to slow down but the full drive can cause problems as it doesn't have enough freespace to defrag.  Do you have something on there that you don't need?  

[faithnhope77]

Ok. I tried to stop DNScache and it said "The service did not respond to the control request in a timely manner." Then I moved on to cryptsvc and it stopped at first there was no change in the cpu % but then after a minute or two, svchost left the top slot and I started typing this response to you super excited that you'd found the problem on the first shot. Svchost was down lower on the list 3 or 4 times but way lower percentage that kept jumping around. As I type this idle process is at the top. I can't see how to restart the cryptsvc process though. When I stopped it, it disappeared from the services list altogether.

[faithnhope77]

Ok. So it took me a minute to figure out how to do the other two. Workstation also said it didnot respond in a timely manner but then the properties window showed stopped. So I'm not sure which way it went. Nla stopped but made no change in process explorer. For each of the other three crypt, DNS, and workstation, error message or no, the svc host left the top slot for several minutes then went back to top. I don't know if that makes sense to you. I'm pretty confused myself. At this moment, I have attempted to stop all four and svc host is still the top position. Dns and lanman said they timed out. I'm am going to try freeing some hard drive space to preparer for a defrag when you tell me to do that.

[RKinner]

To restart the Crypto service you can Right click on Computer and select Manage (Yes) then Services and applications then Services.  Find the Cryptographic service and click on it.  There should be a Start option in the upper right.  IF not right click on it and select Properties.  Then press the Start button.

[faithnhope77]

Oh man, now I'm really confused! I tried to restart cryptsvc and it already said started under status! So then I checked DNS also says started, network location says started, workstation is blank. So was I supposed to apply changes or did they restart on their own?

[faithnhope77]

Ps I freed up 180 gb out of 911 available so that's 19% on the hard drive. That's enough for now right? I can keep deleting but I wanted to let you know. Isn't 15% the bare minimum?