Random crippling slowdown

[Deitus]

Frequently, my PC will just slow down to a complete crawl, and be incapable of doing the simplest tasks like open a web page, or even switch to an already open window. I never lose cursor control or have a complete freeze, but I am unable to do anything. It ranges in severity between just making everything go slowly, to the previously mentioned unable to do anything. It also ranges in duration between a few seconds to 20 minutes in the worst case (most often it lasts 15 seconds to 2 minutes). This is obviously very annoying, but I fear that this is a symptom of a more grave issue, and the fact that it appears to be getting worse makes me worried that my computer will be completely lost if this keeps up.

I have been having this problem for months now, though I can't be sure how long exactly. At first I wrote the occurrences off as isolated incidents, but as they became more frequent and lasted longer it became obvious that something was wrong.

In trying to self-diagnose this issue, I discovered that CPU cycles and RAM are hardly being used at all. Checking the Resource Monitor, I found that my Disk was always at 100% highest active time while this problem occurred, it would jump from 0 to 100 exactly the moment the slowdown started, and drop back down to 0% the moment it ended. During this time, there was also barely any disk activity on the graph (green bar), except the occasional spike every 30 seconds or so, followed by absolutely no activity until the next spike. The summary of disk usage below told a different story though. It showed processes writing sometimes 10-90 GB/min (yes gigabytes) to the disk. I'm no computer expert, but this seemed incredibly excessive.

The processes doing this were things like superfetch, the file indexer, and other background tasks, but as I disabled each of these, the problem would still occur with a different process using the disk. Even after disabling everything else, I still frequently saw massive disk usage from pagefile, ntfs volume log, and system volume information. Pagefile I understand, except that my RAM was hardly being used, so outside of startup I don't see why it would be writing GB to the pagefile. A google search informed me that system volume information was related to System restore, but disabling System Restore (whoops) did not stop the activity of system volume information. Anyway, I came to the conclusion that my efforts to stop this problem were not only unsuccessful, but were potentially causing harm.

I have also run many, many virus scans, with both Norton Internet Security, and Malwarebytes, both in and out of safe mode. While some of these scans (mostly Norton) have turned up Trojan Horses, most were clean. I know my system at the very least was infected, but even as the problem was ongoing the scans were turning up empty. It's very likely that I still have viruses somewhere, but if Norton and Malwarebytes can't find them, I certainly don't know where to look, much less what to do. What little I know about computers is just picked up from using them a lot, so when it comes to situations like this I'm completely at a loss.

I'm not sure what relevant information you might need to know about my PC, but I do use Windows Vista 64-bit. Below is my latest Malwarebytes scan and my DDS log. The attach log and the GMER log are attached in the zip file.

DDS (Ver_10-03-17.01) - NTFSX64

Run by Tom at 20:50:13.73 on Fri 06/25/2010

Internet Explorer: 7.0.6002.18005 BrowserJavaVersion: 1.6.0_17

Microsoft

Attach.zip

[Deitus]

First of all, let me apologize for the rudeness in my original post. I was so focused on describing my problem that I forgot to use any kind of manners, or actually ask for help. I noticed about 30 seconds after I posted the original message that it was severely lacking in manners, but the instructions (found in this thread: http://forums.malwarebytes.org/index.php?showtopic=9573) said not to reply to my own post until 48 hours had passed, so I left it alone. Allow me to say now what I should have said 2 days ago.

Hello. I have been having an issue with my computer (detailed in my first post) for a few months now, and after weeks of trying to fix it myself, I've come to the realization that I don't know enough about computers to fix this on my own (even with help from Google). Since this appears to be related to malware of some sort, I figured this would be a good place to find people experienced in solving this sort of problem. Please, if you have any suggestions as to how to fix this problem, let me know what it is I have to do. I will do my best to be as responsive and cooperative as possible so this problem can get resolved quickly without wasting any more of your time than I have to. Thank you in advance for any assistance you may provide.

[Deitus]

I don't know if this is related to the problem I've been having, but after leaving my PC idle for a couple hours I returned to see it on a blue screen which informed me that my computer crashed and that it had completed a crash dump. I couldn't do anything to continue on from that screen so I had to do a hard reset. Since I wasn't in the room when it crashed, I couldn't tell you what caused it or if it had something to do with my problem. Upon rebooting, I got an error message saying:

"Windows has recovered from an unexpected shutdown"

I clicked on the details button and got the following:

Problem signature:

Problem Event Name: BlueScreen

OS Version: 6.0.6002.2.2.0.768.3

Locale ID: 1033

Additional information about the problem:

BCCode: a0

BCP1: 0000000000000009

BCP2: FFFFFFFFC0000001

BCP3: 0000000000000001

BCP4: 0000000000000000

OS Version: 6_0_6002

Service Pack: 2_0

Product: 768_1

Files that help describe the problem:

C:\Windows\Minidump\Mini062710-01.dmp

C:\Users\Tom\AppData\Local\Temp\WER-71791-0.sysdata.xml

C:\Users\Tom\AppData\Local\Temp\WER17D3.tmp.version.txt

Read our privacy statement:

http://go.microsoft.com/fwlink/?linkid=501...mp;clcid=0x0409

Now I don't know what to do with all that, but maybe someone here can make some use out of it. I have the minidump file listed above as well as the crash dump (MEMORY.DMP file) available to post, but I don't know if that contains any sensitive information (I imagine not, but you can never be too careful) so I decided not to attach it until I got the go ahead from someone here. I could not locate the two "WER" files listed above that are supposed to be in the temp folder (I made sure to check the right directory, and I have hidden files set to display).

For the record, this is not a common thing. I'm certainly well acquainted with the Blue Screen of Death, but my current PC has not really encountered it very often. Despite all the slowdown I've been having, it has never resulted in a BSOD, a reboot, or a crash of any other kind up until now. In fact, I can count the number of times my PC has crashed in the year I've had it on one hand, and those have typically been accompanied by heavy usage (playing graphics intensive PC games). I am telling you this because this is either an unrelated incident, or the problem is escalating (or I'm jumping to conclusions). Anyway, this crash gave me a bit of a panic, so I just thought I'd post it here in case it's of any use.

Thanks again.

[screen317]

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please run the PCPitstop Full Tests here. When the tests are complete, a results page will pop up. Copy and paste the URL of the Results screen and post it here for me.

[Deitus]

Thanks for the help. Here is my scan log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4262

Windows 6.0.6002 Service Pack 2

Internet Explorer 7.0.6002.18005

6/30/2010 9:47:28 PM

mbam-log-2010-06-30 (21-47-28).txt

Scan type: Quick scan

Objects scanned: 131243

Time elapsed: 5 minute(s), 43 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

And here is the url for the PCPitstop test results:

http://www.pcpitstop.com/betapit/sec.asp?conid=23702612

Hope this helps.

[screen317]

Hi,

Please download CCleaner and save it to your desktop.

• Run the CCleaner installer.
  
• During installation process, please UNCHECK "Add CCleaner Yahoo! Toolbar".
  
• Please do NOT run a scan yet!
  

Now, open CCleaner:

• Click the "Windows" tab.
  
• Select the following:
  • Check everything under the "Internet Explorer" section.
    
  • Check everything under the "Windows Explorer" section.
    
  • Check everything under the "System" section.
    
  • Check ONLY "Old Prefetch data" under the "Advanced" section.
    

  [*]Then, click the "Applications" tab:

  • CHECK everything there.
    

  [*]Next, click the "Options" button in the left pane, then click the "Advanced" button:

  • CHECK : "Only delete files in Windows Temp folders older than 48 hours".
    

  [*]Next, click the "Cleaner" button in the left pane, then click the "Run Cleaner" button (bottom right), click "OK" at the prompt.

  [*]When done, please exit CCleaner.

CAUTION: Please do NOT use the "Issues" button in the left pane. This is a built-in registry cleaner. If you don

[Deitus]

Thanks again for your help.

I ran the CCleaner and Defragmented my harddrive with MyDefrag. My computer has a defrag on a scheduler, so I never think to run it manually, but apparently it doesn't work as well as I thought because my disk was heavily fragmented.

Unfortunately, while that might have improved the overall performance of my PC, it didn't really resolve my issue. I ran the F-Secure Scan, and the Security Check, but as far as I can tell they didn't turn up anything useful. The results of those are below:

Scanning Report

Saturday, July 3, 2010 12:07:39 - 12:57:40

Computer name: TOM-PC

Scanning type: Scan system for malware, spyware and rootkits

Target: C:\ D:\

No malware found

Statistics

Scanned:

Files: 75633

System: 5088

Not scanned: 32

Actions:

Disinfected: 0

Renamed: 0

Deleted: 0

Not cleaned: 0

Submitted: 0

Files not scanned:

C:\PAGEFILE.SYS

C:\HIBERFIL.SYS

C:\WINDOWS\SYSTEM32\CONFIG\COMPONENTS

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT

C:\WINDOWS\SYSTEM32\CONFIG\SAM

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\COMPONENTS

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\DEFAULT

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SAM

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SECURITY

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SOFTWARE

C:\WINDOWS\SYSTEM32\CONFIG\REGBACK\SYSTEM

C:\WINDOWS\SYSTEM32\CATROOT2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\CATDB

C:\WINDOWS\SYSTEM32\CATROOT2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\CATDB

C:\USERS\TOM\APPDATA\LOCAL\TEMP\ETILQS_HIG9V3L13REQ1X85UCYK

C:\USERS\TOM\APPDATA\LOCAL\TEMP\ETILQS_SPJZIPX1QWQHN81RCREW

C:\USERS\TOM\APPDATA\LOCAL\TEMP\LOW\HSPERFDATA_TOM\4384

C:\USERS\TOM\APPDATA\LOCAL\TEMP\HSPERFDATA_TOM\3708

C:\USERS\TOM\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\CURRENT SESSION

C:\USERS\TOM\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\CURRENT TABS

C:\SYSTEM VOLUME INFORMATION\MOUNTPOINTMANAGERREMOTEDATABASE

C:\SYSTEM VOLUME INFORMATION\{2279D32C-85D7-11DF-8EC6-0024E8153F35}{3808876B-C176-4E48-B7AE-04046E6CC752}

C:\SYSTEM VOLUME INFORMATION\{3808876B-C176-4E48-B7AE-04046E6CC752}

C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\COMMON CLIENT\_LCK\_AVPAPP_{BB639333-810A-4BF8-85F5-C537857F55FC}1

C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\COMMON CLIENT\_LCK\_ISDATAPR_{E8EFD4CD-DE52-4444-9511-EFF3B158724B}1

C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\COMMON CLIENT\_LCK\_ISDATAPR_{FF9AC67A-E394-46AE-B150-B3365343F166}G

C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\COMMON CLIENT\_LCK\_NPC.TRAY.{1AFE47BB-FCF1-4096-9039-1FEBC9A0CCCF}1

C:\PROGRAMDATA\NORTON\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NORTON\COMMON CLIENT\_LCK\_UI.HOST.{1AFE47BB-FCF1-4096-9039-1FEBC9A0CCCF}1

C:\PROGRAMDATA\MICROSOFT\CRYPTO\RSA\MACHINEKEYS\5348F2A3D7ABD9025DEF2D455D7DA4A9_6E00361B-BD93-4256-A165-6B71C3C782F0

C:\BOOT\BCD

Options

Scanning engines:

Scanning options:

Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML XXX ANI AVB BAT CMD JOB LSP MAP MHT MIF PHP POT SWF WMF NWS TAR

Use advanced heuristics

Results of screen317's Security Check version 0.99.4

Windows Vista (UAC is enabled)

Out of date service pack!!

Internet Explorer 7 Out of date!

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Disabled!

Norton Internet Security

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

CCleaner

Java 6 Update 20

Adobe Flash Player 10.0.42.34

Adobe Reader 9

Out of date Adobe Reader installed!

````````````````````````````````

Process Check:

objlist.exe by Laurent

Norton ccSvcHst.exe

````````````````````````````````

DNS Vulnerability Check:

GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

Anyway, my problem is still occurring just as often and severely as before. It might help to show you an image of what my PC is doing.

See how the highest active time line on the Disk graph is staying pretty solid at 100%? And the disk is pretty much inactive the whole time except for a spike of activity every 30 seconds to a minute. And all the while, the CPU and RAM are pretty much idle (except during the spikes). This will typically last for a couple minutes, but sometimes as long as 15 minutes. Then, suddenly disk active time drops down, and the computer is perfectly usable again. When I took this screenshot, it took 5 minutes just to pull up paint to paste and save the image, and then as soon as paint finally pulled up, the PC was operating at normal speeds again.

[Deitus]

Whoops, didn't meant to past that second image there. It's the same image as the first one, but before I cropped it.

[screen317]

Hi,

Navigate to Start --> Run, enter cmd.exe, then right-click on the cmd.exe that appears, and click Run as Admin...

Enter this command:

chkdsk /r

You will be told that the disk is locked and you will have to restart to run the scan; press Y and Enter.

Restart your computer, allow the disk check to proceed, and when it finishes, see if the disk access spikes are still occurring.

-screen317

[Deitus]

Unfortunately, the problem is continuing, even after the disk check.

[screen317]

Hi,

In Task Manager's Resource Monitor, click on Disk and sort it by highest read and write amounts. See what exactly is causing the spikes.

[Deitus]

Hey,

It doesn't seem to be the spikes themselves that are the problem. It's more like the computer stalls out for several minutes at a time, and then suddenly it tries to do everything it had been trying to do for the last few minutes in a single second, and then it stalls out again. But then I'm no expert, I'm just speculating.

Anyway, it just happened when I was using the internet. I immediately closed out of my browser to limit the processes that display to hopefully be able to isolate it a little bit. Here's the screenshot I took:

As you can see above there's not a whole lot of disk activity, and what there is isn't doing much. I've seen NTFS volume log, system32\config, and System Volume Information on this list a lot, and again here, but I don't know if that's unusual. I have no idea what to think about that process that doesn't have a name, only a hyphen for a filename, but I've seen that before as well.

Now this is not typical. Usually there is a lot more activity, but usually I am using my computer a lot more when I notice the problem. Earlier today, I saw it where there was no disk activity (60 seconds had passed since the last read/write, and when the list refreshed it was completely empty). I don't know if that means that this problem isn't related to something accessing my disk heavily, but it does seem to imply that the problem can occur even when the disk isn't being used.

[screen317]

Hi,

Try this please; maybe we can isolate the problem.

Click Start and type in msconfig.exe

Right click the file msconfig.exe that will appear, and select Run as Admin...

Click the Startup tab, then click Disable all...

Click OK.

Restart your computer and use it normally for a bit, and let me know if the problem persists. If not, that means one or more of your items running on startup are to blame. If the problem still persists, we will attempt other avenues of troubleshooting.

Let me know how it goes.

-screen317

[Deitus]

Hey,

I disabled all the startup programs, but that didn't stop the problem from happening.

[screen317]

Under the General tab of MSConfig, click on Diagnostic Startup. Click OK then restart your computer. Does the issue persist?

[Deitus]

The problem still occurred in Diagnostic Startup. It might have been less frequent, but its hard to say as its so sporadic.

I switched out of Diagnostic Startup and rebooted, since in that mode my network connection, my audio device, and my anti-virus (among others) were disabled, and that's just not going to work for me long term. All of the startup programs you had me disable at startup earlier are still disabled.

What next?

[screen317]

Go ahead and re-enable all of your startup programs.

I believe this may be an issue with your protection software. I would like you to try (for troubleshooting purposes) to uninstall Norton from Add or Remove Programs.

After that, run the Norton Removal Tool.

Next, restart your computer and let me know if disk usage persists. If so, post a fresh DDS log and we'll take it from there.

[Deitus]

Problem continued after uninstalling Norton. Here's the DDS Log:

DDS (Ver_10-03-17.01) - NTFSX64

Run by Tom at 2:30:42.03 on Sun 07/11/2010

Internet Explorer: 7.0.6002.18005 BrowserJavaVersion: 1.6.0_20

Microsoft

[screen317]

Hi,

Yes post attach.txt too this time.

Let me consult with my colleagues and I will get back with you as soon as possible.

In the meantime, let's run this online scan to look for infections.

Please scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your Desktop.
    
  • Double click on the icon on your Desktop.
    

  [*]Check

  [*]Click the button.

  [*]Accept any security warnings from your browser.

  [*]Check

  [*]Push the Start button.

  [*]ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

  [*]When the scan completes, push

  [*]Push , and save the file to your Desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

  [*]Push the button.

  [*]Push

[screen317]

Received a reply after asking if someone else had an idea about the source of this problem:

Yep, SuperFetch. Do an SC Config on sysmain and set it to startup= disabled or manual and have the user reboot. SuperFetch is always reading from the HDD, especially when idle, to preload frequently accessed programs into memory. Background idle defrag and search indexing are also likely culprits.

edit: An additional note, I recommend leaving the config alone. Vista and 7 maintain themselves much better than XP for the sake of performance. If the user is just really annoyed with it, tell them to always use "Sleep" instead of shutting down and to let their PC sit running idle every once in a while so it has a chance to catch up with idle tasks. Using Sleep avoids SuperFetch related issues since the OS no longer needs to start loading the files into memory like it does on reboot.

[Deitus]

Actually, Superfetch was one of the first things I suspected to be the cause of this problem (well after it came up a lot in google searches looking for people who had a similar problem to mine). This was long before I posted here looking for help.

Unfortunately, this cannot be the culprit. When I thought it was causing the problem, I disabled the service and never bothered to re-enable it, and that was probably about a month ago. I also did the same same thing with the search indexer. I probably could have re-enabled it when I realized it wasn't causing the problem, but I was trying to cut down on background processes to help isolate the problem, and it was always using the disk which was getting in the way.

With regards to the performance advantage of superfetch: I don't think the person who posted that realizes that this isn't just a minor annoyance to me. When this problem occurs, which while random, is quite frequent, my computer is rendered useless until the problem clears up, which might take anywhere from a 1 to 20 minutes. If my computer is not usable, I don't much care if it can open files a few seconds faster. When we get this problem resolved, then the extra disk usage probably won't bother me as much, and I can reenable it.

Anyway, I ran the scan and it found one trojan. Here's what the log reported:

C:\Users\Tom\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57\6c4c5379-6e2caef9

Java/TrojanDownloader.Agent.NBB trojan

I haven't taken any action on the file in question yet. I'll await your instructions on that one.

Also, here's the attach file from my previous DDS log:

Attach_new.zip

[screen317]

Hi,

It appears as though your Master File Table (MFT) is to blame. The reason why is unknown as of right now, but maybe with some diagnostic tools, we can pinpoint the issue. Keep in mind that this is not a malware issue so bear with me as we try various things that may or may not help.

First I would like to collect some information about your MFT.

Download SysInternals' ntfsinfo and extract it to your Desktop.

Now, click Start and type in cmd.exe

Right-click the first option that appears and click Run as Admin...

A black box will open (we call this an elevated command prompt); enter the following command exactly as shown:

"%userprofile%\desktop\ntfsinfo.exe" C:>"%userprofile%\desktop\ntfsinfo.txt"

Press Enter.

On your Desktop, open the newly created ntfsinfo.txt and post its contents here.

-screen317

[Deitus]

Hey,

Thanks for all your help so far. I really appreciate you taking the time to help me with my computer problems. Here's the ntfsinfo log:

NTFS Information Dump V1.01

Copyright © 1997 Mark Russinovich

http://www.sysinternals.com

Volume Size

-----------

Volume size : 595047 MB

Total sectors : 1218658303

Total clusters : 152332287

Free clusters : 68200915

Free space : 266409 MB (44% of drive)

Allocation Size

----------------

Bytes per sector : 512

Bytes per cluster : 4096

Bytes per MFT record : 1024

Clusters per MFT record: 0

MFT Information

---------------

MFT size : 218 MB (0% of drive)

MFT start cluster : 786432

MFT zone clusters : 22905952 - 22908480

MFT zone size : 9 MB (0% of drive)

MFT mirror start : 76166143

Meta-Data files

---------------

That "Meta-Data files" field at the end was empty in the log, I didn't just copy/paste wrong.

[screen317]

Hi,

Let's try defragmenting the Master File table.

You'll need the full version of Diskeeper (a trial is available here which you can uninstall later):

http://www.diskeeper.com/trialware/TrialwareProducts.aspx

Select Pro Premier (English)

Download the trial and run it; ensure that the MFT gets defragmented.

After it completes, restart your computer and see if the issue persists.

-screen317

[Deitus]

Okay, I ran Diskkeeper, and had it defragment my MFT. It seems to have successfully defragged the MFT (only two fragments in MFT and 4 in the rest of the disk now), but that didn't stop the problem from continuing.