Almost unusably slow computer

[aboynamedsue]

For about a week my computer was almost unusable due to slowness.  Task manager showed that disc usage was 100% and after I started doing research on this it unexpectedly and suspiciously stopped.  This looks to me like I might be infected with Malware even though running a scan with Malware bytes found nothing.

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 5/28/18
Scan Time: 7:30 PM
Log File: 80d90022-62d7-11e8-944e-082e5f07f92c.json
Administrator: No

-Software Information-
Version: 3.5.1.2522
Components Version: 1.0.365
Update Package Version: 1.0.5282
License: Free

-System Information-
OS: Windows 10 (Build 17134.48)
CPU: x86
File System: NTFS
User: Sheldon-PC\Susan

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 270619
Threats Detected: 0
(No malicious items detected)
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 6 min, 6 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

FRST.txt

Addition.txt

[AdvancedSetup]

Hello @aboynamedsue and

The FRST program was ran as a regular user. Please run it with an Admin level account.

Ran by Susan (ATTENTION: The user is not administrator)

Then post back the new logs

Thank you

Ron

 

[aboynamedsue]

A new user that joined on Friday answered my post and unfortunately I followed his suggestion to run CCleaner before I noticed he wasn't a staff member.  His user name was mrneedhelpalots.  He might still be following my topic.  Here are the updated logs: 

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 7/10/18
Scan Time: 6:02 PM
Log File: 54ebffb6-8495-11e8-ab1c-082e5f07f92c.json
Administrator: Yes

-Software Information-
Version: 3.5.1.2522
Components Version: 1.0.374
Update Package Version: 1.0.5859
License: Free

-System Information-
OS: Windows 10 (Build 17134.112)
CPU: x86
File System: NTFS
User: Sheldon-PC\Sheldon

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 272603
Threats Detected: 0
(No malicious items detected)
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 23 min, 9 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

FRST.txt

Addition.txt

[AdvancedSetup]

Let's start out by at least temporarily removing Avast and McAfee and go from there. Windows 10 has a robust builtin antivirus now called Windows Defender on Windows 10 so between that and Malwarebytes you'll be well protected.

Download and run the following removal tool for Avast using Admin rights.
http://files.avast.com/files/eng/aswclear.exe

Next, download and run the following removal tool for McAfee using Admin rights
http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Once both of those are removed then run a new FRST scan and attach back both new logs.

Thank you

Ron

 

[aboynamedsue]

Here are the logs-thanks for your help.

FRST.txt

Addition.txt

[AdvancedSetup]

Please uninstall the Avira Safe Shopping and reboot. Let me know when done

 

[AdvancedSetup]

How did you install your Hosts file. That is a huge hosts file and should have the DNS client disabled in order to run it without really slowing down the computer.

Where did you get the managed hosts file?

 

[AdvancedSetup]

Please do the steps above first, before running the clean up below.

The clean up routine below will remove left over elements of different antivirus and temp files. It will also run a Full Disk Check on your hard drive.

NOTE: The full disk check may take a few hours to complete, depending on the size of your drive and the speed of your computer. Please let it complete.

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

Thanks

Ron

 

 

[aboynamedsue]

I uninst6alled the Avira safe shopping and this is where I got the host file: www.mvps.org/winhelp2002/hosts.txt.

 

I will do everything else you suggested tonight.

[AdvancedSetup]

Please read the portion about installing the hosts file on Windows 10. Note that newer updates from Microsoft may have enabled your DNS Client Services. There are workarounds to fix things up which I'm guessing you may not have noticed or completed yet.

http://winhelp2002.mvps.org/hosts.htm

 

[aboynamedsue]

I have run the scan and it says 100% complete but the blue wheel is still spinning.  Is this normal?  The hard drive light isn't on. 

[AdvancedSetup]

Just let it run for a bit please. It's possible that a Windows Update kicked into gear and it causing that. Stopping or forcing it closed could cause real problems.

Let it go a couple hours and if still not done then try rebooting

 

[aboynamedsue]

Here are the files.  I had to reboot last night but it looked like the task was completed.

FRST.txt

Addition.txt

[AdvancedSetup]

Please visit each of the following sites and let's reset all of your browsers back to defaults to prevent unexpected issues.
If you are not using one of the browsers but it is installed then you may want to consider uninstalling it as older versions of some software can pose an increase in the potential for an infection to get in.

Internet Explorer
How to reset Internet Explorer settings

Microsoft Edge
How to Reset Microsoft Edge in Windows 10

Firefox
Click on Help / Troubleshooting Information then click on the Refresh Firefox button.

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• Open Chrome and at the top right, click  More tools  Extensions
• Write down the list of Extensions installed.
• Next, go to >> Google Sync << and sign into your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the run dialog box.
   
  • 
     
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

Restart your computer now and make sure there are no longer any redirects or other browser issues and let me know the results

Thanks

Ron

 

 

[aboynamedsue]

The link to reset Internet Explorer leads to a page not found error. Also, when doing the reset for Edge the instructions say to do a full backup before.  Is this really necessary?

[AdvancedSetup]

On IE you can go to Tools, Internet Options, Advanced, and click on Reset

As for a backup, it's protection to help in case some were to go wrong. You should be backing up your data but I would not expect any error that would compromise your  actual data.

 

[aboynamedsue]

I have completed all the steps.  The folders A C and settings couldn't be deleted from this:C:\Users\Susan\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe

[AdvancedSetup]

Okay, let's scan for further issues. Please run these scans again.

 

 

Please run the following steps and post back the logs as an attachment when ready.

STEP 01

• If you're already running Malwarebytes 3 then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• If you don't have Malwarebytes 3 installed yet please download it from here and install it.
• Once installed then open Malwarebytes and check for updates. Then click on the Scan tab and select Threat Scan and click on Start Scan button.
• Once the scan is completed click on the Export Summary button and save the file as a Text file to your desktop or other location you can find, and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know on your next reply.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Right-click on the program and select Run as Administrator to start the tool.
• Accept the Terms of use.
• Wait until the database is updated.
• Click Scan.
• When finished, please click Clean.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Copy its content into your next reply.

 

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here.
• Please attach the Additions.txt log to your reply as well.

 

Thanks

Ron

 

[aboynamedsue]

Here are all the current logs:

MB.txt

AdwCleaner[C01].txt

FRST.txt

Addition.txt

[AdvancedSetup]

Please run the following. It will take a while to complete so be patient.

 

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

fixlist.txt

 

Ron

 

Edited July 19, 2018 by AdvancedSetup

[aboynamedsue]

Here's the scan.

Fixlog.txt

[AdvancedSetup]

Looks like it was able make some fixes.

How is the computer running now?

 

[aboynamedsue]

It is running much better but I still notice some weird things.  It seems that file sharing was turned on.
Also,this pc and "workgroup" now showing under shared on my MacBook.
Some email contents appear that they are being changed en route. Windows update was disabled. I bought an app from the Microsoft store and can't install it. Last of all, the system idle process is showing many connections from this computer to remote tcp port 53 in netstat.

 

[AdvancedSetup]

Okay, let me have you run the following.

 

--RogueKiller--

• Download & SAVE to your Desktop Download RogueKiller
• Quit all programs that you may have started.
• Please disconnect any USB or external drives from the computer before you run this scan!
• For Vista or above, right-click the program file and select "Run as Administrator"
• Accept the user agreements.
• Execute the scan and wait until it has finished.
• If a Windows opens to explain what [PUM's] are, read about it.
• Click the RoguKiller icon on your taksbar to return to the report.
• Click open the Report
• Click Export TXT button
• Save the file as ReportRogue.txt
• Click the Remove button to delete the items in RED  
• Click Finish and close the program.
• Locate the ReportRogue.txt file on your Desktop and copy/paste the contents in your next.?

 

[aboynamedsue]

Here's the latest scan.  I had to attach the scan because when I tried to copy and paste it all that showed up was the following link.

"http://www.adlice.com/contact/"

ReportRogue.txt