Jump to content

My computer is running at high levels of disk usage

asb4

By asb4
in Resolved Malware Removal Logs

 Share

Recommended Posts

asb4

asb4

Posted
Posted

Hello, daledoc1 told me to come here for a second opinion (the conversation is posted below)

 

https://forums.malwarebytes.org/index.php?/topic/174481-most-of-the-time-100-disk-is-being-used-any-ideas-how-to-fix-this/

 

As mentioned, I have tried several things, but I am still coming across 100% disk usage.

 

I have attached a new set of fresh logs below.

 

Also, I have skype enabled, do you want me to do anything with it? (I know it works through P2P)

 

Thank you in advanced for looking into this!

FRST.txt

Addition.txt

CheckResults.txt

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Hello,

    

 

They call me TwinHeadedEagle around here, and I'll try to help your with your issue.

 

     

    

Before we start please read and note the following:

  • We're primarily oriented on malware removal here, so you must know that some issues just cannot be solved and you must be prepared for this. Some tools we use here will remove your browser search history, so backup your important links and all the files whose loss is unacceptable.
  • Note that we may live in totally different time zones, what may cause some delays between answers.
  • Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
  • Do not paste the logs in your posts, attachments make my work easier. There is a More reply options button, that gives you Upload Files option below which you can use to attach your reports. Always attach reports from all tools.
  • Always execute my instructions in given order. If for some reason you cannot completely follow one instruction, inform me about that.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
:excl: I can't foresee everything, so if anything not covered in my instructions happens, please stop and inform me!

:excl: There are no silly questions. Never be afraid to ask if in doubt!

 

 

 

  warning.gif Rules and policies

 

We won't support any piracy.

That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!

The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!

 

Failure to follow these guidelines will result with closing your topic and withdrawning any assistance.

 

 

51a612a8b27e2-Zoek.png Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)

Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

createsrpoint;autoclean;emptyclsid;emptyalltemp;ipconfig /flushdns >>"%temp%\log.txt";b
  • Right-click on 51a612a8b27e2-Zoek.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)
Post its content into your next reply.
Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Let's see what is going on:
 
 
FRST.gif Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content into your next reply.

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted
2eyjdoj.png Check Disk
  • Press the WindowsKey.png + R on your keyboard at the same time. Type cmd and click OK.
  • Copy/Enter the command below and press Enter:
  • chkdsk C: /r
  • You should get a message to schedule Check Disk at next system restart. Please type Y and press Enter.
  • All you should do now is to restart your PC and let the Check Disk process finish uninterrupted.
Check Disk report:
  • Press the WindowsKey.png + R on your keyboard at the same time. Type eventvwr and click OK.
  • In the left panel, expand Windows Logs and then click on Application.
  • Now, on the right side, click on Filter Current Log.
  • Under Event Sources, check only Wininit and click OK.
  • Now you'll be presented with one or multiple Wininit logs.
  • Click on an entry corresponding to the date and time of the disk check.
  • On the top main menu, click Action > Copy > Copy Details as Text.
  • Paste the contents into your next reply.
Link to post
Share on other sites
asb4

asb4

Posted
  • Author
Posted

Log Name:      Application
Source:        Microsoft-Windows-Wininit
Date:          11/4/2015 2:37:02 AM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      ALEX-HP
Description:


Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.                         

Stage 1: Examining basic file system structure ...
  590080 file records processed.                                                        

File verification completed.
  10019 large file records processed.                                   

  0 bad file records processed.                                     


Stage 2: Examining file name linkage ...
  751524 index entries processed.                                                       

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered to lost and found.                    


Stage 3: Examining security descriptors ...
Cleaning up 28 unused index entries from index $SII of file 0x9.
Cleaning up 28 unused index entries from index $SDH of file 0x9.
Cleaning up 28 unused security descriptors.
Security descriptor verification completed.
  80723 data files processed.                                           

CHKDSK is verifying Usn Journal...
  5429376 USN bytes processed.                                                           

Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...
  590064 files processed.                                                               

File data verification completed.

Stage 5: Looking for bad, free clusters ...
  169731654 free clusters processed.                                                       

Free space verification is complete.

Windows has scanned the file system and found no problems.
No further action is required.

 949805055 KB total disk space.
 269926496 KB in 444695 files.
    254740 KB in 80724 indexes.
         0 KB in bad sectors.
    697203 KB in use by the system.
     65536 KB occupied by the log file.
 678926616 KB available on disk.

      4096 bytes in each allocation unit.
 237451263 total allocation units on disk.
 169731654 allocation units available on disk.

Internal Info:
00 01 09 00 77 04 08 00 c9 3a 0e 00 00 00 00 00  ....w....:......
7e 25 00 00 46 00 00 00 00 00 00 00 00 00 00 00  ~%..F...........

Windows has finished checking your disk.
Please wait while your computer restarts.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Wininit" Guid="{206f6dea-d3c5-4d10-bc72-989f03c8b84b}" EventSourceName="Wininit" />
    <EventID Qualifiers="16384">1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-11-04T10:37:02.000000000Z" />
    <EventRecordID>21092</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>ALEX-HP</Computer>
    <Security />
  </System>
  <EventData>
    <Data>

Checking file system on C:
The type of the file system is NTFS.

A disk check has been scheduled.
Windows will now check the disk.                         

Stage 1: Examining basic file system structure ...
  590080 file records processed.                                                        

File verification completed.
  10019 large file records processed.                                   

  0 bad file records processed.                                     


Stage 2: Examining file name linkage ...
  751524 index entries processed.                                                       

Index verification completed.
  0 unindexed files scanned.                                        

  0 unindexed files recovered to lost and found.                    


Stage 3: Examining security descriptors ...
Cleaning up 28 unused index entries from index $SII of file 0x9.
Cleaning up 28 unused index entries from index $SDH of file 0x9.
Cleaning up 28 unused security descriptors.
Security descriptor verification completed.
  80723 data files processed.                                           

CHKDSK is verifying Usn Journal...
  5429376 USN bytes processed.                                                           

Usn Journal verification completed.

Stage 4: Looking for bad clusters in user file data ...
  590064 files processed.                                                               

File data verification completed.

Stage 5: Looking for bad, free clusters ...
  169731654 free clusters processed.                                                       

Free space verification is complete.

Windows has scanned the file system and found no problems.
No further action is required.

 949805055 KB total disk space.
 269926496 KB in 444695 files.
    254740 KB in 80724 indexes.
         0 KB in bad sectors.
    697203 KB in use by the system.
     65536 KB occupied by the log file.
 678926616 KB available on disk.

      4096 bytes in each allocation unit.
 237451263 total allocation units on disk.
 169731654 allocation units available on disk.

Internal Info:
00 01 09 00 77 04 08 00 c9 3a 0e 00 00 00 00 00  ....w....:......
7e 25 00 00 46 00 00 00 00 00 00 00 00 00 00 00  ~%..F...........

Windows has finished checking your disk.
Please wait while your computer restarts.
</Data>
  </EventData>
</Event>

Link to post
Share on other sites
asb4

asb4

Posted
  • Author
Posted

Um, so I did the chkdsk and it got stuck on 11% for about 4 hours, but then I went to check on it and it was done but said about an error in starting up but that a restart would probably fix it.

Now that its on, I dont see any apparent differences.

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

51a46ae42d560-malwarebytes_anti_malware. Scan with Malwarebytes' Anti-Malware

Please re-run 51a46ae42d560-malwarebytes_anti_malware. Malwarebytes' Anti-Malware.

  • First of all, select update.
  • Once updated, click the Settings tab, in the left panel choose Detection & Protection and tick Scan for rootkits.
  • In the same tab, under PUP and PUM detections make sure it is set to Treat detections as malware
  • Click the Scan tab, choose Threat Scan is checked and click Start Scan.
  • If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
  • Upon completion of the scan (or after the reboot), click the History tab.
  • Click Application Logs and double-click the newest Scan Log.
  • At the bottom click Export and choose Text file.
Save the file to your desktop and upload your next reply.

FRST.gif Scan with Farbar Recovery Scan Tool

 

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.

    (XP users click run after receipt of Windows Security Warning - Open File).

  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please upload them into your next reply.
Link to post
Share on other sites
asb4

asb4

Posted
  • Author
Posted

Um... Not too much different... :( Could it be my computer is just getting old?

 

Oh by the way, since your here, I was scanning my parents computer earlier (I have many times with malwarebytes and SuperAntiSpyware) but this time malwarebytes didnt find anything but SuperAntiSpyware said it found "Maleware.Trace". Is their anything extra I should do then let the program remove it?

Link to post
Share on other sites
TwinHeadedEagle

TwinHeadedEagle

Posted
Posted

Um... Not too much different... :( Could it be my computer is just getting old?

 

Oh by the way, since your here, I was scanning my parents computer earlier (I have many times with malwarebytes and SuperAntiSpyware) but this time malwarebytes didnt find anything but SuperAntiSpyware said it found "Maleware.Trace". Is their anything extra I should do then let the program remove it?

 

What do you mean by not much different?

 

Yes, you can remove threats found by SAS.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.