My computer is running very slow, and sometimes freezes

[weigaocb]

Hello,

My computer is running very slow, especially with the firefox browser.  Sometimes the computer freezes.  It's very frustrate to deal with it daily.  Please help me check and fix the problem.  I ran Malwarebytes scanning, and nothing was found.  Thank you very much!  Wei

[weigaocb]

Hello,

I ran FRST, here are FRST.txt and Addition.txt.  Thank you.  Wei

FRST.txt Addition.txt

[AdvancedSetup]

Hello @weigaocb and

The logs don't appear to show any obvious infection. We can try to do some general clean up and possibly stop some programs from automatically loading when the computer starts.

This appears to be a business computer. Just want to make sure your IT Department is aware and that you have the approval to make system-wide changes on the computer.

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks

 

[AdvancedSetup]

Topic has been reopened per request.

Thanks

 

[weigaocb]

Hello,

I ran msconfig and stopped several programs from auto start.  Now the computer runs not that slow anymore.  Are there anything else I should do at this point?  Thank you very much!

[AdvancedSetup]

Well, that's what I was going to offer to help you with. It's up to you but if you'd like me to review suggestions for removal of apps or startup items please run FRST again and post back new logs for both FRST and Addictions.txt

Thanks

Ron

 

[weigaocb]

Ron,

OK, I will run that tomorrow and post the docs here.  

Thank you for your help.

 

[AdvancedSetup]

Okay, sounds good. Check on you again tomorrow

Cheers

Ron

 

[weigaocb]

Hello Ron,

I ran FRST, and here is FRST.txt and Addition.txt.  Thank you.

Addition.txt FRST.txt

[AdvancedSetup]

Sorry for the delay. Is this a business computer or a home computer?

Your answer will help us to know what direction to go in. Please review the current information below and we can discuss it.

 

 

The following software has been updated. You may want to consider updating

7-Zip 19.00 (2019-02-21)  https://www.7-zip.org/download.html
Your Adobe Flash Player behind. I would recommend you uninstall the following first, then update to the latest version.
Adobe Flash Player 28 ActiveX
Adobe Flash Player 31 NPAPI

https://helpx.adobe.com/security/products/flash-player/apsb19-19.html
https://get.adobe.com/flashplayer/

Though this program is designed to keep your system up to date - you really can do it on your own and save a ton of resources. Belarc Advisor is typically a hog on resources so if you can do without it that would improve performance.
Belarc Advisor 8.4
Current version appears to be 9
https://www.belarc.com/products_belarc_advisor

CCleaner (I no longer recommend this product - no longer owned by Piriform, they sold out to Avast a while back. Decide for yourself if you really need this. You can manually do almost anything it's doing on your own)
Your version 5.56
Latest version: v5.56.7144 (09 Apr 2019)

These type of programs are for remote control sessions. Up to you to decide if you need them or not. IF not using I would uninstall them.
Cisco Webex Meetings
Citrix Online Launcher
GoToMeeting 6.0.0.1259

Looks like you have this software installed. May be old and not needed anymore?
ClinCheck (HKLM\...\InstallShield_{E45D1CA0-C70E-4FF4-B46B-1F6ED85501F9}) (Version: 3.1.0.25 - Align Technology, Inc.)
http://investor.aligntech.com/news-releases/news-release-details/align-technology-announces-clincheckr-pro-interactive-3d

This would seem to be related to Dental work. Is this a business computer? Again, up to you if you. If you are using it then by all means leave it alone. If not then more software to consider uninstalling
Dolphin 3D (HKLM\...\InstallShield_{6F146B81-5C3A-413B-86AA-569FFA629E5C}) (Version: 11.7.31 - Dolphin Imaging & Management Solutions)

You have Endpoint Manager Communication Client installed - not sure if you know about that or not. If this is a business computer that may be why as someone is supposed to be doing what I'm doing here for you now.
Endpoint Manager Communication Client -  ITarian LLC

You have what appears to be label software from almost 10 years ago. Not sure if you still use or not
exPressit S.E. 3

You have GIMP 2.8.18 image editor. If  you use it there is an update 2.10.10
https://www.gimp.org/news/2019/04/07/gimp-2-10-10-released/

Your Google Chrome is out of date too. Personally I'd recommend not using Google Chrome but it should be updated if you're going to use it.
Your version:  73.0.3683.103
Updated version: 74.0.3729.108

You have old compromised versions of Java that can help lead to an infection. Please uninstall all versions of Java. If possible and you're able to run the computer without Java that would be best. If you really have to have it though make sure you keep it up to date at all times https://java.com
Java 7 Update 71
Java SE Development Kit 7 Update 55

This is for remote access to your computer as well
LogMeIn Client

Not really sure what this is but an odd entry to not be listed with whom it's from if it really were open source (as you can see the entry is hidden so it does not show in add/remove for programs)
opensource (HKLM\...\{3677D4D8-E5E0-49FC-B86E-06541CF00BBE}) (Version: 1.0.14960.3876 - Your Company Name) Hidden

This appears to be for that Dental software
Patterson Auto Update
Patterson Eaglesoft

Not certain about this software, but it does show up on other computers that have Patterson software so I'm guessing it's part of their software package
PINPadDevice Files

The Cyberlink recovery manager was designed to work with the HP recovery partition and the factory installed Windows 7 HP version OS.
Recovery Manager (HKLM\...\{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}) (Version: 5.5.0.5223 - CyberLink Corp.) Hidden

More remote control software
ScreenConnect Client
https://en.wikipedia.org/wiki/ConnectWise_Control

This is the database portion of the Patterson software (open source SQL database software)
Sqlite

Symantec Endpoint Protection (your version is way behind for Engine protection)
Your version: 12.1.5337.5000
The latest version appears to be: 12.1.7445.7000 for the 12.1x release but the latest is: Stable release: 14.2 (Build 1031) / 26 November 2018; 4 months ago but looks like they have or will soon have 15.x available.
https://support.symantec.com/en_US/article.HOWTO101888.html
https://www.symantec.com/products/endpoint-protection

Your Textpad editor software is very old. There is a free update in the 7.x version. Just so you're ware though, there are some amazingly powerful free text editors out there.
https://www.textpad.com/download/

Yet another remote control piece of software on the computer.
VNC Viewer 6.17.1113
https://www.realvnc.com/en/connect/download/viewer/

Part of the Patterson software
XCTransaction2 Files

Google Pinyin input method
谷歌拼音输入法 2.7 (HKLM\...\GooglePinyin2) (Version:  - Google Inc.)
https://play.google.com/store/apps/details?id=com.google.android.inputmethod.pinyin&hl=en_US

Windows Firewall is disabled.
Why is the firewall disabled?

The computer is using MSCONFIG to stop program startup. This prevents the tool from being used as a diagnostics tool which is what it's meant to be.
I would recommend you either uninstall software you don't want or remove the entry from the Startup Group or from the Registry and stop using MSCONFIG for that.
You can also use AutoRuns from Microsoft if you'd like

MSCONFIG\startupfolder: C:^Users^admin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk => C:\Windows\pss\Dropbox.lnk.Startup
MSCONFIG\startupfolder: C:^Users^admin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Send to OneNote.lnk => C:\Windows\pss\Send to OneNote.lnk.Startup
MSCONFIG\startupreg: BlueNote Communicator Lights => "C:\Program Files\BlueNote Communicator Lights\BlueNoteCL.exe"
MSCONFIG\startupreg: CCleaner Smart Cleaning => "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
MSCONFIG\startupreg: Comodo ITSM => C:\Program Files\COMODO\Comodo ITSM\ITSMAgent.exe
MSCONFIG\startupreg: Dropbox Update => "C:\Users\admin\AppData\Local\Dropbox\Update\DropboxUpdate.exe" /c
MSCONFIG\startupreg: HPSYSDRV => C:\Program Files\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE
MSCONFIG\startupreg: IMSS => "C:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe"
MSCONFIG\startupreg: ISUSPM => C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe -scheduler
MSCONFIG\startupreg: LogMeIn GUI => "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
MSCONFIG\startupreg: PDF Complete => C:\Program Files\PDF Complete\pdfsty.exe
MSCONFIG\startupreg: RTHDVCPL => C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe -s
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: USB3MON => "C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"

 

Intersting, you show you're running, using quite a bit of Commodo software yet there is no installation entry for it.
Comodo Security Solutions, Inc.

(Comodo Security Solutions, Inc. -> Comodo Inc.) C:\Program Files\COMODO\Comodo ITSM\RmmService.exe
(Comodo Security Solutions, Inc. -> COMODO) C:\Program Files\COMODO\Comodo ITSM\CpmService.exe
(Comodo Security Solutions, Inc. -> COMODO) C:\Program Files\COMODO\Comodo ITSM\CpmService.exe
(Comodo Security Solutions, Inc. -> COMODO) C:\Program Files\COMODO\Comodo ITSM\ITSMService.exe

So, is this still a business connected computer or was it purchased from a company and taken home to use for personal use?

This entry grants someone remote access to it every time the computer boots
IFEO\ehshell.exe: [Debugger] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" -MceShellRedirect

There are Domain policy or Local policy entries that normally I'd suggest removing
GroupPolicy\User: Restriction ? <==== ATTENTION
GroupPolicyUsers\S-1-5-21-2181890955-3231938180-3595645503-1001\User: Restriction <==== ATTENTION

 

[weigaocb]

Hello,

Thank you very much for a long email.  Yes, this is a business computer, and I'm the owner of this business.  This is the computer I use in the office.

We have an IT company helps us maintain our hardwares, network, equipment, etc.  They use Logmein to remotely log into our computers to maintain them.  However, when I told them about this computer being slow, all they told me is it's too old, I need to get a new one.  To be honest, I don't really need a top notch computer to do my daily work, so, I'm wondering if there is something can be done to clean it up.

I will delete and update some very old software, please let me know anything that I should do.  Thank you very much for the help!

[AdvancedSetup]

Well, it's late for you. You appear to be a couple of hours ahead of me. I'll write some code to help remove some entries for you. Ultimately though I hope you're backing up your data properly and it cannot be accessed by any type of these new Ransomware attacks. None of this computer stuff matters if you don't have good backups of your data. If using remote data then you need to ensure that infection cannot access it too.

 

 

[weigaocb]

Hello,

First of all, thank you for your help.

When you mentioned backing up properly, do you mainly mean files that I created, or something else?  I don't store any documents to this computer locally.  There is an antivirus software on our server that holding all remote data.  Will this be ok to stop infection access to remote data?  Thank you.

[AdvancedSetup]

20 minutes ago, weigaocb said:

However, when I told them about this computer being slow, all they told me is it's too old, I need to get a new one. 

 

Well, more of an issue is that Windows 7 support from Microsoft ended on January 13, 2015, and Extended support will end January 14, 2020,

https://www.microsoft.com/en-ca/windowsforbusiness/end-of-windows-7-support

If you do have the means, then installing an SSD drive into this computer and upgrading it to Windows 10 would be a reasonably cheap way to keep the computer and also be on the latest version of Windows 10

You can get a 120GB HP SSD drive for $21 from NewEgg
https://www.newegg.com/Product/Product.aspx?Item=N82E16820326766

This is your computer below

HP Compaq Pro 6300 Microtower PC Product Specifications
https://support.hp.com/hr-en/document/c03382665

Windows 10 Pro is $200 directly from Microsoft

Total physical RAM: 1908.95 MB so I would recommend installing more RAM and if the software supports x64 then using x64, if not then you can still install Windows 10 x86 but x86 only support 4GB of RAM. Would recommend 8GB if possible, the computer supports 32GB

2x4GB = 8GB RAM is about $72

https://www.amazon.com/HP-Compaq-Desktop-NON-ECC-PC3-12800-Tech/dp/B00VPQDEPG/ref=sr_1_1?keywords=8GB+KIT+(2+x+4GB)+for+HP-Compaq+Pro+Desktop+6300&qid=1556335350&s=electronics&sr=1-1

 

[AdvancedSetup]

6 minutes ago, weigaocb said:

Hello,

First of all, thank you for your help.

When you mentioned backing up properly, do you mainly mean files that I created, or something else?  I don't store any documents to this computer locally.  There is an antivirus software on our server that holding all remote data.  Will this be ok to stop infection access to remote data?  Thank you.

Hopefully whoever you're getting your IT Support from would be able to accurately determine that. I'm not familiar with what your systems are really running and how data is stored or backed up. Generally speaking, that is why you having remote IT support. Not very friendly of them to not discuss options for you though as to how to best stretch your dollars.

How many Servers, Workstations, are there?

 

[AdvancedSetup]

I also assume your remote IT Support is taking care of the Hippa requirements from a computerized point of view for you as well.

The Health Insurance Portability and Accountability Act (HIPAA) sets the standard for sensitive patient data protection. Companies that deal with protected health information (PHI) must have physical, network, and process security measures in place and follow them to ensure HIPAA Compliance
https://digitalguardian.com/blog/what-hipaa-compliance

 

[weigaocb]

Hello,

I see what do you mean about security now.  I either get a new computer that has Windows 10 or upgrade my current one to Win10.  Thank you, I will look into your suggestions.

We have one server, 2008, and the IT company told me the server should be replaced soon since it will not be supported either.  We also have 13 workstations running Windows 7 and 10.  There is a daily data backup on our server.

Thank you.

[AdvancedSetup]

Yes, unfortunately, there is an uncertain amount of cost in running a business that from the outside doesn't seem to make you money so often it gets neglected. I can help you clean up this computer some, yes, but ultimately you should discuss cheap alternatives with your IT Support for moving forward.

 

[weigaocb]

Yes, we are in compliance with HIPPA.  

[weigaocb]

Thank you very much!  

[AdvancedSetup]

If you'd like me to write a script to stop some of the startup stuff please let me know.

Cheers

Ron

 

[weigaocb]

Sure, do I need to let you know the programs?  Here are the programs I copied from your reply.  Some of them I know for sure that I don't want them anymore, so they can be deleted; some just need to be stopped; and there are some I'm not sure what they are, and if I need them or not.  Thank you!

Delete: Dropbox, CCleaner, SunJavaUpdateSched

Stop: PDF Complete, LogMeIn, OneNote

Not Sure: Comodo ITSM, HPSYSDRV, IMSS, ISUSPM, RTHDVCPL, USB3MON

 

[AdvancedSetup]

The Comodo was probably manually copied by your IT group and thus why no installer. We can stop it if you like. If they want or need it running they can have you start it manually.

Do not delete anything. You need to go into Control Panel, Programs, Add/Remove and uninstall them properly, and ONLY the ones you're sure of. Once uninstalled you may not be able to reinstall it.

I'll look at the other items and provide you a script to make changes. All of these programs can be manually started if needed, they don't have to run every time the computer starts.

 

[weigaocb]

Ok, I will delete the programs I know from the Control Panel.  Is the Comodo a security software?  Does it need to be ran all the time?  Thanks