Painfully slow, shut down, restart, and application launches

oconnell565 · August 21, 2015

My computer is incredibly slow almost all the time. Occasionally it operates as I would expect, but I can't find any specific reason. Not sure if there is a hardware issue involved.

Launching applications can take 5 minutes. MS Office applications (2013) are particularly bad. Changing message in Outlook can easily cause it to be nonresponsive. A restart can take 10-15 minutes to get back to login screen. Malwarebytes' Threat Scan took almost 14 hrs.

Scan logs are attached.

Any help is appreciated.

mbam.txt

FRST.txt

Addition.txt

TwinHeadedEagle · August 21, 2015

Hello,

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

Before we start please read and note the following:

We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time. Keep in mind that private life gets in the way too. Note that we may live in totally different time zones, what may cause some delays between answers.
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
I volunteer to help you, so please, do not ask for help for your company/business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.

I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

There are no silly questions. Never be afraid to ask if in doubt!

Rules and policies

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

Right-click on icon and select Run as Administrator to start the tool.
Wait patiently until the main console will appear, it may take a minute or two.

In the main box please paste in the following script:

createsrpoint;autoclean;emptyalltemp;ipconfig /flushdns >>"%temp%\log.txt";b

Make sure that Scan All Users option is checked.
Push Run Script and wait patiently. The scan may take a couple of minutes.
When the scan completes, a zoek-results logfile should open in notepad.
If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)
Post its content into your next reply.

oconnell565 · August 22, 2015

Ran Zoek, but forgot to disable anti-virus. Took a couple hours and the results are attached.

Disabled anti-virus, as I should have originally, and ran again. Been running for about 16 hours and not done. Status messages are here:

----------

Zoek.exe v5.0.0.0 Updated 04-May-2015
Tool run by Mike on Fri 08/21/2015 at 17:36:16.17.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Mike\Desktop\zoek.exe [scan all users] [script inserted]

===== Runcheck 17:40:24.39 =====

--- Create Environment Variables 17:40:30.92
--- Create System Restore Point 17:46:16.43
--- Checking Input 17:46:42.66
--- AU AppData Check 17:47:28.30
--- Remove From Windows Installer 17:47:47.99
--- Empty Folders Check 17:56:18.87
--- Registry HKLM Software Check 17:56:18.95
--- Quick Launch Shortcut Check 17:57:03.77
--- IE Startpage Check 17:57:45.46
--- Program Files DB Check 18:01:39.25
--- C:\Users\Default\AppData\Roaming DB Check 18:05:24.34
--- C:\Users\Default User\AppData\Roaming DB Check 18:05:24.34
--- C:\Users\Jason\AppData\Roaming DB Check 18:05:24.34
--- C:\Users\Jordan\AppData\Roaming DB Check 18:05:24.34
--- C:\Users\Matt\AppData\Roaming DB Check 18:05:24.34
--- C:\Users\Mike\AppData\Roaming DB Check 18:05:24.34
--- C:\Users\Terri\AppData\Roaming DB Check 18:05:24.34
--- C:\Windows\SysNative\config\systemprofile\AppData\Roaming DB Check 18:05:24.34
--- C:\Windows\sysWoW64\config\systemprofile\AppData\Roaming DB Check 18:05:24.34
--- C:\Windows\serviceprofiles\networkservice\AppData\Roaming DB Check 18:05:24.34
--- C:\Windows\serviceprofiles\Localservice\AppData\Roaming DB Check 18:05:24.34
--- C:\Users\Mike DB Check 18:21:37.53
--- C:\PROGRA~3 DB Check 18:30:56.66
--- C:\Users\Default\AppData\Local DB Check 18:34:42.97
--- C:\Users\Default User\AppData\Local DB Check 18:34:42.97
--- C:\Users\hedev\AppData\Local DB Check 18:34:42.97
--- C:\Users\Jason\AppData\Local DB Check 18:34:42.97
--- C:\Users\Jordan\AppData\Local DB Check 18:34:42.97
--- C:\Users\Matt\AppData\Local DB Check 18:34:42.97
--- C:\Users\Mike\AppData\Local DB Check 18:34:42.97
--- C:\Users\Public\AppData\Local DB Check 18:34:42.97
--- C:\Users\Terri\AppData\Local DB Check 18:34:42.97
--- C:\Windows\SysNative\config\systemprofile\AppData\Local DB Check 18:34:42.97
--- C:\Windows\sysWoW64\config\systemprofile\AppData\Local DB Check 18:34:42.97
--- C:\Windows\serviceprofiles\networkservice\AppData\Local DB Check 18:34:42.97
--- C:\Windows\serviceprofiles\Localservice\AppData\Local DB Check 18:34:42.97
--- C:\ProgramData\Microsoft\Windows\Start Menu\Programs DB Check 18:49:36.85
--- C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs DB Check 18:50:29.88
--- Tasks DB Check 18:51:03.79
--- Downloads DB Check 18:51:25.25
--- C:\Users\Jason\AppData\LocalLow DB Check 18:51:55.47
--- C:\Users\Jordan\AppData\LocalLow DB Check 18:51:55.47
--- C:\Users\Matt\AppData\LocalLow DB Check 18:51:55.47
--- C:\Users\Mike\AppData\LocalLow DB Check 18:51:55.47
--- C:\Users\Terri\AppData\LocalLow DB Check 18:51:55.47
--- C:\Windows\SysNative\config\systemprofile\AppData\LocalLow DB Check 18:51:55.47
--- C:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow DB Check 18:51:55.47
--- C:\Windows\serviceprofiles\networkservice\AppData\LocalLow DB Check 18:51:55.47
--- C:\Windows\serviceprofiles\Localservice\AppData\LocalLow DB Check 18:51:55.47
--- Tasks2 DB Check 18:59:58.49
--- Documents DB Check 19:02:25.99
--- C:\Users\Public\Desktop DB Check 19:03:30.10
--- C:\Users\Mike\Desktop DB Check 19:04:24.10
--- Services DB Check 19:05:12.12
--- FF prefs.js DB Check 19:11:19.96
--- Del by CLSID 19:12:14.79
--- Delete Services 19:16:59.68
--- Batch Commands 19:17:42.28
--- Firefox Extensions 19:18:01.32
--- Chrome Look 19:18:22.95
--- Create Backups 19:34:52.64

zoek-results.log

zoek-results.txt

TwinHeadedEagle · August 22, 2015

Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

Right-click on icon and select Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
Make sure that Addition option is checked.
Press Scan button and wait.
The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

oconnell565 · August 22, 2015

FRST scan complete

FRST.txt

Addition.txt

TwinHeadedEagle · August 23, 2015

How is your PC behaving now?

oconnell565 · August 23, 2015

Not noticeably different.

Zoek scan (with anti-virus off) never completed. Last message was "Create Backups".

TwinHeadedEagle · August 23, 2015

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

Right-click on icon and select Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
Press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please upload it to your reply.

Check Disk

Press the + R on your keyboard at the same time. Type cmd and click OK.
Copy/Enter the command below and press Enter:
```
chkdsk C: /r
```
You should get a message to schedule Check Disk at next system restart. Please type Y and press Enter.
All you should do now is to restart your PC and let the Check Disk process finish uninterrupted.

Check Disk report:

Press the + R on your keyboard at the same time. Type eventvwr and click OK.
In the left panel, expand Windows Logs and then click on Application.
Now, on the right side, click on Filter Current Log.
Under Event Sources, check only Wininit and click OK.
Now you'll be presented with one or multiple Wininit logs.
Click on an entry corresponding to the date and time of the disk check.
On the top main menu, click Action > Copy > Copy Details as Text.
Paste the contents into your next reply.

fixlist.txt

oconnell565 · August 24, 2015

Could be nothing or only temporary, but PC seems a little faster at the moment.

FRST fix log is attached.

Took forever to complete chkdsk. Details are here:

Log Name:      Application
Source:        Microsoft-Windows-Wininit
Date:          8/24/2015 1:00:37 PM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      Ravenclaw
Description:

Checking file system on C:
The type of the file system is NTFS.
Volume label is Gateway.

A disk check has been scheduled.
Windows will now check the disk.

CHKDSK is verifying files (stage 1 of 5)...
401152 file records processed.

File verification completed.
1218 large file records processed.

0 bad file records processed.

0 EA records processed.

110 reparse records processed.

CHKDSK is verifying indexes (stage 2 of 5)...
521796 index entries processed.

Index verification completed.
CHKDSK is scanning unindexed files for reconnect to their original directory.
1 unindexed files scanned.

Recovering orphaned file carboniteservice_V5.7.4390_Ee0000102_A000007FEFD24B3DD_T1437254944.dmp (92) into directory file 133414.
There is no DOS file name attribute in file 0x5c.
Correcting minor file name errors in file 92.
0 unindexed files recovered.

CHKDSK is verifying security descriptors (stage 3 of 5)...
401152 file SDs/SIDs processed.

Cleaning up 243 unused index entries from index $SII of file 0x9.
Cleaning up 243 unused index entries from index $SDH of file 0x9.
Cleaning up 243 unused security descriptors.
Security descriptor verification completed.
60323 data files processed.

CHKDSK is verifying Usn Journal...
37668184 USN bytes processed.

Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
Read failure with status 0xc00000b5 at offset 0x94cc3c4000 for 0xc000 bytes.
Read failure with status 0xc00000b5 at offset 0x8c2b060000 for 0x10000 bytes.
Read failure with status 0xc00000b5 at offset 0x7b40e28000 for 0x10000 bytes.
Read failure with status 0xc00000b5 at offset 0x7b40e2a000 for 0x1000 bytes.
Read failure with status 0xc00000b5 at offset 0x7b40bd8000 for 0x10000 bytes.
Read failure with status 0xc00000b5 at offset 0x7b40e2b000 for 0x10000 bytes.
Windows replaced bad clusters in file 78291
of name \Users\Mike\AppData\Local\MICROS~1\Windows\WebCache.old\WEBCAC~1.DAT.
Read failure with status 0xc00000b5 at offset 0x73750d4000 for 0x10000 bytes.
Read failure with status 0xc00000b5 at offset 0x73750e2000 for 0x1000 bytes.
Windows replaced bad clusters in file 116432
of name \Windows\winsxs\AMD27E~1.227\mstscax.dll.
Read failure with status 0xc00000b5 at offset 0x7700af4000 for 0x10000 bytes.
Read failure with status 0xc00000b5 at offset 0x7700afe000 for 0x1000 bytes.
Read failure with status 0xc00000b5 at offset 0x7700bcf000 for 0x10000 bytes.
Read failure with status 0xc00000b5 at offset 0x7700bd9000 for 0x1000 bytes.
Windows replaced bad clusters in file 121503
of name \PROGRA~1\MICROS~2\root\vfs\PROGRA~3\MICROS~1\Office15\APPVIS~2.DLL.
Read failure with status 0xc00000b5 at offset 0x8393a7d000 for 0x10000 bytes.
Read failure with status 0xc00000b5 at offset 0x8393a85000 for 0x1000 bytes.
Read failure with status 0xc00000b5 at offset 0x8393a86000 for 0x10000 bytes.
Read failure with status 0xc00000b5 at offset 0x8393a8a000 for 0x1000 bytes.
Read failure with status 0xc00000b5 at offset 0x8393a86000 for 0x4000 bytes.
Windows replaced bad clusters in file 336332
of name \Windows\MICROS~1.NET\assembly\GAC_MSIL\UIAUTO~1\V40_40~1.0__\UIAUTO~1.DLL.
401136 files processed.

File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
98409819 free clusters processed.

Free space verification is complete.
Adding 34 bad clusters to the Bad Clusters File.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows has made corrections to the file system.

961977343 KB total disk space.
567636368 KB in 298223 files.
    166184 KB in 60324 indexes.
       136 KB in bad sectors.
    535491 KB in use by the system.
     65536 KB occupied by the log file.
393639164 KB available on disk.

4096 bytes in each allocation unit.
240494335 total allocation units on disk.
98409791 allocation units available on disk.

Internal Info:
00 1f 06 00 9f 78 05 00 fa 70 09 00 00 00 00 00 .....x...p......
b4 4e 00 00 6e 00 00 00 00 00 00 00 00 00 00 00 .N..n...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-08-24T20:00:37.000000000Z" />
    <EventRecordID>108578</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>Ravenclaw</Computer>
    <Security />
</System>
<EventData>
    <Data>