[henryfinn]

Hello everyone.

 

My son approached me saying his laptop is running slowly and lagging and he gets popups when browsing the internet. He's used free trial accounts of antivirus until they expire and then he moves on to the next brand.

 

Can someone help me start diagnosing the problem from the ground up? I'd really appreciate it.

[Advertisements]

• Get FRST from http://www.bleepingc...very-scan-tool/You need to download the appropriate tool for your PC.  If you don't know if you have a 32 or 64 bit system get them both.  Only one will work and that's the right one.
• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Check the Addition.txt box
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.  
• Please copy and paste log back here.
• It will generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

 

Get Process Explorer

http://live.sysinter...com/procexp.exe
Save it to your desktop then run it (Vista or Win7+ - right click and Run As Administrator).  

View, Select Column, check Verified Signer, OK
Options, Verify Image Signatures


Click twice on the CPU column header  to sort things by CPU usage with the big hitters at the top.  

Wait a full minute then:

File, Save As, Save.  Note the file name.   Open the file  on your desktop and copy and paste the text to a reply.


Copy the next 2 lines:

TASKLIST /SVC  > \junk.txt
notepad \junk.txt

Open an Elevated Command Prompt:
Win 7: Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator
Win 8: http://www.eightforu...indows-8-a.html
win 10: http://www.howtogeek...-in-windows-10/

Right click and Paste (or Edit then Paste) and the copied lines should appear.
Hit Enter if notepad does not open.  Copy and paste the text from notepad into a reply.


Get the free version of Speccy:

http://www.filehippo.com/download_speccy/ (Look in the upper right for the Download
Latest Version button  - Do NOT press the large Start Download button on the upper left!)  
Download, Save and Install it.  Tell it you do not need CCLEANER.    Run Speccy.  When it finishes (the little icon in the bottom left will stop moving),
File, Save as Text File,  (to your desktop) note the name it gives. OK.  Open the file in notepad and delete the line that gives the serial number of your Operating System.  
(It will be near the top,  10-20  lines down.) Save the file.  Attach the file to your next post.  Attaching the log is the best option as it is too big for the forum.  Attaching is a multi step process.

First click on More Reply Options
Then scroll down to where you see
Choose File and click on it.  Point it at the file and hit Open.
Now click on Attach this file.

 

[RKinner]

• Get FRST from http://www.bleepingc...very-scan-tool/You need to download the appropriate tool for your PC.  If you don't know if you have a 32 or 64 bit system get them both.  Only one will work and that's the right one.
• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Check the Addition.txt box
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.  
• Please copy and paste log back here.
• It will generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

 

Get Process Explorer

http://live.sysinter...com/procexp.exe
Save it to your desktop then run it (Vista or Win7+ - right click and Run As Administrator).  

View, Select Column, check Verified Signer, OK
Options, Verify Image Signatures


Click twice on the CPU column header  to sort things by CPU usage with the big hitters at the top.  

Wait a full minute then:

File, Save As, Save.  Note the file name.   Open the file  on your desktop and copy and paste the text to a reply.


Copy the next 2 lines:

TASKLIST /SVC  > \junk.txt
notepad \junk.txt

Open an Elevated Command Prompt:
Win 7: Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator
Win 8: http://www.eightforu...indows-8-a.html
win 10: http://www.howtogeek...-in-windows-10/

Right click and Paste (or Edit then Paste) and the copied lines should appear.
Hit Enter if notepad does not open.  Copy and paste the text from notepad into a reply.


Get the free version of Speccy:

http://www.filehippo.com/download_speccy/ (Look in the upper right for the Download
Latest Version button  - Do NOT press the large Start Download button on the upper left!)  
Download, Save and Install it.  Tell it you do not need CCLEANER.    Run Speccy.  When it finishes (the little icon in the bottom left will stop moving),
File, Save as Text File,  (to your desktop) note the name it gives. OK.  Open the file in notepad and delete the line that gives the serial number of your Operating System.  
(It will be near the top,  10-20  lines down.) Save the file.  Attach the file to your next post.  Attaching the log is the best option as it is too big for the forum.  Attaching is a multi step process.

First click on More Reply Options
Then scroll down to where you see
Choose File and click on it.  Point it at the file and hit Open.
Now click on Attach this file.

 

[henryfinn]

 

• Get FRST from http://www.bleepingc...very-scan-tool/You need to download the appropriate tool for your PC.  If you don't know if you have a 32 or 64 bit system get them both.  Only one will work and that's the right one.
• Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• Check the Addition.txt box
• Press Scan button.
• It will produce a log called FRST.txt in the same directory the tool is run from.  
• Please copy and paste log back here.
• It will generate another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

 

 

Get Process Explorer

http://live.sysinter...com/procexp.exe
Save it to your desktop then run it (Vista or Win7+ - right click and Run As Administrator).  

View, Select Column, check Verified Signer, OK
Options, Verify Image Signatures


Click twice on the CPU column header  to sort things by CPU usage with the big hitters at the top.  

Wait a full minute then:

File, Save As, Save.  Note the file name.   Open the file  on your desktop and copy and paste the text to a reply.


Copy the next 2 lines:

TASKLIST /SVC  > \junk.txt
notepad \junk.txt

Open an Elevated Command Prompt:
Win 7: Start, All Programs, Accessories then right click on Command Prompt and Run as Administrator
Win 8: http://www.eightforu...indows-8-a.html
win 10: http://www.howtogeek...-in-windows-10/

Right click and Paste (or Edit then Paste) and the copied lines should appear.
Hit Enter if notepad does not open.  Copy and paste the text from notepad into a reply.


Get the free version of Speccy:

http://www.filehippo.com/download_speccy/ (Look in the upper right for the Download
Latest Version button  - Do NOT press the large Start Download button on the upper left!)  
Download, Save and Install it.  Tell it you do not need CCLEANER.    Run Speccy.  When it finishes (the little icon in the bottom left will stop moving),
File, Save as Text File,  (to your desktop) note the name it gives. OK.  Open the file in notepad and delete the line that gives the serial number of your Operating System.  
(It will be near the top,  10-20  lines down.) Save the file.  Attach the file to your next post.  Attaching the log is the best option as it is too big for the forum.  Attaching is a multi step process.

First click on More Reply Options
Then scroll down to where you see
Choose File and click on it.  Point it at the file and hit Open.
Now click on Attach this file.

 

 

Thank you for your reply. I hope it's alright if I just attach each file created, I didn't want to leave anything out. 

 

I appreciate your help.

Attached Files

•  FRST.txt   33.15KB   157 downloads
•  Addition.txt   50.4KB   179 downloads
•  System Idle Process.txt   11.8KB   162 downloads
•  junk.txt   9.65KB   175 downloads
•  DESKTOP-JLK4V0U.txt   204.44KB   466 downloads

[RKinner]

Uninstall:

ByteFence Anti-Malware

Chromium

McAfee LiveSafe

 

Download

McAfee Consumer Products Removal tool

from:

https://www.bleeping...s-removal-tool/

 

Save, then right click and Run As Admin.

 

 

Reboot.

 

Download the Feree version of MalwareBytes AntiMalware:

 

https://www.malwarebytes.com/

 

Click on the Free Download button

 

Save the file then:

1. Find installer
   Look for the mb3-setup.exe file in your Downloads folder (or where you saved it).
2. Open installer
   Double click the file and run the program.
3. Follow installer instructions
   Read the instructions to complete installation.

Once it finishes, allow it to delete anything it finds then save the log and post it in a reply.

 

(This is actually a trial so it will expire after a few days.  You can uninstall it then so it won't nag you)

 

Do a new FRST scan as before with Addition.txt checked and post both logs.

[henryfinn]

I've attached the MalwareBytes scan reprt and the new FRST files. Thank you for your help.

 

I would add though, whenever I bring up task manager, it says that the disk usage is at 100% and outlined in red.

Attached Files

•  virus report.txt   116.62KB   144 downloads
•  FRST.txt   21.83KB   158 downloads
•  Addition.txt   46.64KB   209 downloads

[RKinner]

Go into Task Manager, Performance, Resource Monitor then Disk.  It will show you what processes are using the hard drive.  What are they?

[henryfinn]

WmiPrvSE.exe and AvastSvc.exe are the 2 nonhost programs. WmiPrvSE.exe shoots up to 77m b/s on startup. The disc usage usually goes down a little while after startup.

[RKinner]

See if Windows Repair All in one will help:

 

One of its options is WMI repair.  (The other options won't hurt anything but will make it slower so you might want to Uncheck them.)

 

https://www.bleeping...air-all-in-one/

[henryfinn]

I've performed the WMI repair, disk read/write is still maxing out sporadically.

[RKinner]

Rerun MalwareBytes again and let's see if there is any more that it finds.

[henryfinn]

I ran another MalwareBytes scan to no effect. Could it be a drive hardware issue? I would think that would show up in the check disk if it was failing.

[RKinner]

There was an attribute:  BB
                                            Attribute name    Reported Uncorrectable Errors
                                            Real value    917,504
                                            Current    100
                                            Worst    100
                                            Threshold    0
                                            Raw Value    00000E0000
                                            Status    Good

 

That looked bad but I was hoping it was just a stuck bit since all of the other attributes looked good.

 

Get HDTune:

http://www.hdtune.co.../hdtune_255.exe

 

Save and Right click and Run As Admin  Once it installs and runs press Start.

When it finishes what does it say for min and max and access time?

[henryfinn]

Minimum: 9.7 MB/s

Maximum 98.6 MB/s

Average: 70 MB/s

 

Access Time: 18.2 ms

 

Burst Rate: 161.8 MB/s

 

CPU Usage: 3.0%

[RKinner]

Not the fastest hard drive but not impossibly slow.

 

Try WhySoSlow:

 

The Download is on

http://www.resplendence.com/downloads

 

Look under System Monitoring Tools for WhySoSlow 1.0  then click on

Download free home edition

 

Save the file then right click and Run As Admin.  Follow the prompts. Let it run for a minute (watch the Time Running indication at the bottom) then hit Analyze

 

Then when a new window appears hit Analyze again.   Once the report appears scroll down and see if it complains about anything.  You can Save the report but it saves as WhySoSlowOutput.htm which the forum won't let you attach.  You can either zip it up or just rename it to WhySoSlowOutput.txt then attach it.

[henryfinn]

The report says that it should be working fine, but I can say that my CPU is at 57% and disk is at 89-95. Maybe this is just it's normal operating status? I've never used it myself

 

Attached Files

•  WhySoSlowOutput.zip   1.79KB   197 downloads