Author Topic: Is my hard drive dying? [Solved] (Read 65409 times)

Boggin · « **Reply #25 on:** February 23, 2015, 01:57:57 am »

The Symantec Event ID 6 may be nothing to worry about but you could reinstall Symantec Endpoint Protection should it have become corrupt.

When you scroll further down in the lower pane on either of those Symantec errors, there's a link which gives you http://www.symantec.com/business/support/index?page=content&id=TECH99755

Just to ensure you are infection free, boot up into Safe Mode with Networking and run the ESET Free Online Scanner. http://www.eset.com/int/home/products/online-scanner/

Click on Advanced and check all of the boxes except the lower Proxy one - check the box for auto uninstall on completion then disable Endpoint Protection immediately before clicking on Scan.

This scan can take well over an hour but it is thorough.

The Windows Update error for your Intel Graphics update was either because you already have that driver version installed or it isn't compatible with your machine.

Do you normally get your machine updates through Windows Updates as some vendors use this method ?

Change your Windows Update settings to Check for updates but let me choose whether to download and install them so when you get the next update notification, go to Windows Update, click on where it tells you how many there are and check to see what it is offering you.

If it's giving you the Intel graphics driver again, right click on it and select Hide - you can also do this for any others you don't want.

I normally do that when it offers me one for the Bing Desktop.

If you aren't using a VPN then you don't need the MS Virtual Miniport Adapters and it is they which are causing the DHCP Client Event ID 1001.

Use the netsh wlan set hostednetwork mode=disallow command to uninstall them.

If you still have problems after reinstalling Endpoint Protection - as a buggy AV program can cause anomalous problems - and running the ESET scan, then I think the factory reset would be the best option - but let's see how it performs after these suggestions.

And you aren't wasting anyone's time

jmk909er · « **Reply #26 on:** February 23, 2015, 06:02:53 am »

Thanks Boggin I will give it a try but I am at work right now. I have to do it at home where I have a better stable connection. I'll let you know how it goes.

Shane · « **Reply #27 on:** February 23, 2015, 09:04:05 pm »

It would be worth a shot of doing a repair install before doing a factory restore.

First you need a Windows 7 disk that has SP1 already on it and isnt the factory disk, you can grab that from here
https://sites.google.com/site/linuxlablibrary/windows-iso

Then all you need to do is follow this guide
http://www.sevenforums.com/tutorials/3413-repair-install.html

A repair install will keep your programs and files while fixing Windows. Well it doesnt aim to fix it, what it does is doing a upgrade to the same version, so basically Windows gets reinstalled while keeping all your stuff.

Shane

jmk909er · « **Reply #28 on:** February 23, 2015, 09:23:24 pm »

Hi Boggin I ran the scan in safe mode with networking and it did find some threat items that I put in the attachment. After finishing it really had a hard time starting so maybe it had to recover something but after starting about 4 or 5 times it is starting up pretty fast again. I also ran "netsh wlan set hostednetwork mode=disallow"
I'll see how this goes for a while.

Shane thanks for your post, it looks promising if my problems continue. Thanks

Boggin · « **Reply #29 on:** February 24, 2015, 01:44:14 am »

While you can do without the Google Toolbar and you definitely don't want the ASK Toolbar, ReImage Repair could either have been a legit program that you installed or it came bundled with another download as a Potentially unwanted Program (PuP). http://www.shouldiremoveit.com/Reimage-Repair-10452-program.aspx

Given that it runs auto in the background at predetermined times and connecting to the 'net, that could well have an effect on your start up times and performance.

When you download anything, always choose the Custom option when offered and always look to see if anything else is bundled with the download where you can uncheck those boxes before clicking on Next or Install.

There seems to be some conflicting info on InstallCore TS but you're probably best without it. https://www.virustotal.com/en/file/ea44e0774b657e90beff912705cec2c3e9088b6814377f9bdf3b5e52db44f2d2/analysis/

Can't find anything on SpeedChecker B, but I'm not sure why it took a few times before the boot got back to normal.

Can you go Control Panel - under System and Security - Find and fix problems then again under System and Security click on Check for performance issues - click on Advanced then on Run as administrator and see what that reports.

jmk909er · « **Reply #30 on:** February 24, 2015, 06:28:35 am »

I avoid toolbars and add ons like the plague I don't know how they got in there, I always uncheck all the extras when I download anything.

I ran Find and fix problems then again under System and Security and it shows a bunch of startup programs and ask what I do not want to run. I don't know if I need these or not. I made a video here: https://www.dropbox.com/s/tizryhf8p3fj6ui/System%20and%20security.mp4?dl=0

The errors in event viewer (see attachment) are minimal and it is starting up pretty good.

Something that happened last night when I ran the online scanner was I could not get to the boot menu. I normally hit F12 to get to the boot menu and after starting 5 times I could not get to it while starting up. The only way I could get to it was to let it finish starting up and then doing a hard shutdown with the power button, than it automatically started with the boot menu screen.

Boggin · « **Reply #31 on:** February 24, 2015, 09:29:06 am »

I've never seen Windows Host Process (rundll32) in a Startup menu before as that should reside in Windows\System32\rundll32.exe so that one could be malicious.

I have rundll32.exe neither showing in Task Manager Processes or Services or do I have the Host Process showing anywhere in my msconfig.

Have you tried the clean boot as Shane had advised earlier ?

The video was a bit too quick for me to follow but were they under the Startup or Services tab ?

The only program I have under the Startup tab is for the Epson Event Manager as I find the printer works better that way when I want to use it.

Any programs that you want to use can be started normally as and when you want them so there's no need to have them running in the background which unnecessarily takes up memory and can impact on performance as Windows has snagged.

I think I stopped Toshiba Reeltime but can't remember what it does now, but I leave all of the other Toshiba services enabled - I have a cheap Satellite C660D.

Sometimes this site will tell you if you need a particular service enabled under the Services tab http://www.bleepingcomputer.com/startups/ but Process Explorer will tell you if you have anything malicious running. https://technet.microsoft.com/en-gb/sysinternals/bb896653.aspx

When you have it up and running, click on Options and ensure the Verify Signature box is checked then hover over VirusTotal.com and check its box.

Virus Total will produce a column in blue with items marked as a low value/~50 but where there are items in red with a highish value/~50 - they will be suspect, especially if their Signatures aren't verified.

You can Google any of those and where they are malicious, removal tips are usually linked.

jmk909er · « **Reply #32 on:** February 24, 2015, 10:05:59 am »

Attached is where the Windows Host Process (rundll32) is at. Should I check the box so it doesn't run?

Boggin · « **Reply #33 on:** February 24, 2015, 04:02:53 pm »

The best thing to do would be to go Start - type msconfig - press enter then check to see if it's listed under the Startup tab or Services when you check the box to Hide all MS services.

Did you download Process Explorer as that should tell you if it's a legit process, but I'm reticent to advise stopping any dll32.exe and if Process Explorer doesn't snag it then I would prefer to leave that one to Shane.

Do you need Skype or Dropbox to be loaded on start up when you can boot them up on demand ?

I don't know what that Office one is for - while it may be advantageous to have something for Office preloaded, this is what I get for Xmarks for IE http://www.shouldiremoveit.com/Xmarks-for-IE-13606-program.aspx

Is that something you have personally downloaded ?

jmk909er · « **Reply #34 on:** February 24, 2015, 05:08:10 pm »

I have to be honest with you the process explorer is very complicated, what am I supposed to look at in there? Is it "rundll32"? Are all start up items? I did a save as of it and attached.

I do use dropbox a lot and store everything on it and not on my computer. It is also convient to be able to use different computers to get to my stuff.

I do like to keep Skype up all the time because I use it although it would be nice if it started up with a delay, it does not need to run right at start up. It could be a few minutes later.

The office one is part of MS Office that has cloud storage, I really don't need that to run.

XMarks is an app that syncs all my bookmarks across all browsers and all machines that I use. I dabble in web design and like to test in IE, Firefox and Chrome

Boggin · « **Reply #35 on:** February 25, 2015, 02:25:41 am »

As you don't need the Office Startup item then you can uncheck that.

If you would be happy with Skype to start a few minutes later, would it be any hardship to just boot it on demand ?

In Process Explorer did you click on Options in the menu bar and check the box for VirusTotal.com - anything it lists in blue is okay, it's just the red ones you need to look for/at.

Occasionally you could get a red one say as 1 or 2/50ish but as long as it's Signature is verified as a source that you know, it will be okay - otherwise you would Google it for more info and definitely if the 1 or 2 is a much higher value.

As the Host Process is verified as a MS one, it will be legit - but you haven't said whether it's listed under the Startup or the Services tab in msconfig.

It's unusual for Windows to suggest that you disable a Windows process to enhance performance and it's unlikely that an item like that would be under the Startup tab, which is for 3rd party programs starting up in the background on Boot.

When you install a program they can insert themselves into the Startup menu, adding time to your boot - so it's worth checking to see if that's the case and whether you want it in there.

One thing to remember is that if you have unchecked a program under the Startup tab and you uninstall it, recheck its box in msconfig first as you will be left with orphan files and that item will remain in msconfig.

jmk909er · « **Reply #36 on:** February 25, 2015, 06:42:44 am »

Hi Boggin the process explorer is a little over my head so I'm not really sure what I need to do there but I made you a video

https://www.dropbox.com/s/ju52f2n7pgnavz3/Start-up%20and%20Process%20Explorer.mp4?dl=0

Boggin · « **Reply #37 on:** February 25, 2015, 08:33:29 am »

You did the Process Explorer just fine.

That Virus Total blue column has 0/50 entries - they are fine.

There were a couple in red with values of 1/57 - they are also fine as is anything in blue - it's when that value is in red and the numerator/50ish is high that you should start researching.

You don't have anything untoward running in there.

The entries that have a red/pinkish background are all MS ones and aren't anything to worry about - guess it displays like that to easier vet the other entries.

Virus Total.com when enabled allows you to see at a glance if you have any nasties by their high red values which makes it a useful tool.

Autoruns which is a similar program, highlights nasties with a yellow background.

Your msconfig/Startup tab entries seem strange as I have most of those, especially the Toshiba ones under my Services tab.

It looks like Toshiba have changed the format.

Click on the Services tab and see if that Windows Host Process is listed in there - if it is, check the box to Hide all MS services and see if it's still listed.

jmk909er · « **Reply #38 on:** February 25, 2015, 09:40:12 am »

Under the system tab the only thing I see with the word "Host" it is Diagnostic Service Host-running and Diagnostic System Host-stopped

When I check to hide Microsoft Services I do not see any.

Boggin · « **Reply #39 on:** February 25, 2015, 09:47:10 am »

I haven't a clue then where Windows is snagging it from for a performance problem.

Mention it in your next post and Shane will probably pick up on it as he doesn't always have time to read through all of the Replies that have been made since his last visit to the forum.

It may not be such a problem if the computer is booting up okay - how long does it take ?

jmk909er · « **Reply #40 on:** February 25, 2015, 10:22:45 am »

Hey Boggin one of the items in my startup is "ROC_roc_ssl_v12" it looks like this is part of a toolbar from AVG. It a tool bar that I was tricked into getting along with some other program quite a while back. I remember getting it because it took over all my search functions and was very intrusive. I uninstalled and got rid of it but as I recall it was hard to get rid of. Should I check this so it does not start in the start menu?

Boggin · « **Reply #41 on:** February 25, 2015, 03:27:36 pm »

Leave it checked, boot up into Safe Mode with Networking and download/run the appropriate AVG Uninstaller - run it a couple of times, rebooting after each then check to see if it's still listed. http://www.avg.com/gb-en/utilities

In IE go Tools cog - Manage add-ons - use the dropdown to select All add-ons and check to see if you have AVG Secure Search.

If that's there, I think you can click on that which will give you the option to remove it - if not, boot up into Safe Mode with Networking again and download AdwCleaner - this is a more specialized PuP remover. http://www.bleepingcomputer.com/download/adwcleaner/

Use the blue Download Now @bleepingcomputer button.

Click on Scan and when that has completed it may list some items in the lower pane.

If you recognize any and want to keep them, uncheck their boxes.

Click on Report and that will show if it has found anything else and will remove when you click on Clean - you have no control over those items as it will delete all that is listed.

Close the report and click on Clean, although I think it's called something else now, but you'll see which one it is.

That will produce another report after the restart to show what it has deleted.

Lower down the Adwcleaner page you will see a link for Junkware Removal Tool - click on that and run that program as a follow up.

This takes a bit longer and you only find what/if it has removed in its report on completion - it also puts this file onto your desktop.

Check to see if the ROC_roc_v12 is still there in msconfig, AVG Secure Search (if it was originally there) in manage add-ons and any of those files in Process Explorer where it said it couldn't find files under the Verified Signature column.

If AVG Secure Search is still there you can either click on it and select Disable or reset IE to Defaults.

I only just saw those in Process Explorer when I was looking closer at the video, because I was looking to see which AV program you have installed - but couldn't see any - perhaps you could let us know if you have one installed.

jmk909er · « **Reply #42 on:** February 25, 2015, 05:14:11 pm »

I ran the AdwCleaner and that finally got ROC_roc_v12 out of here.

I noticed in the Windows Repair utility that on the last tab called Simple System Tweaker I ran it and it installed some kind of start up service that has bloat and is slowing the startup down but I don't see a way to get rid of it!

Boggin · « **Reply #43 on:** February 25, 2015, 06:00:02 pm »

Use your restore points to prior to running that but you will probably have to redo all that you have already done to get where you are in cleaning your system, depending upon where in the order of things you ran it.

jmk909er · « **Reply #44 on:** February 26, 2015, 05:15:17 pm »

OK I restored it and have everything up and running OK. At least it is not starting up with the wrong screen and popup errors.

It is still booting up very slow but I think I should just leave it alone. Thanks for your help!

Boggin · « **Reply #45 on:** February 27, 2015, 02:32:32 am »

As you have restored it, it will have undone any cleanout that AdwCleaner has done and may have reinstated the Startup items you have unchecked, so you will need to check in msconfig again.

Run AdwCleaner again and then run JRT http://www.bleepingcomputer.com/download/junkware-removal-tool/

Let us know if there's any improvement.

jmk909er · « **Reply #46 on:** February 27, 2015, 06:41:42 am »

Thanks boggin I already re-did all of the previous steps and also have created a good restore point.

I also just ran the junkware removal tool and have attached the log file from it. (I don't think it found much)

I just shutdown and started 4 times and timed it. It is taking just under 2 minutes to go from pushing the start-up button to get to the sign in screen with 68 seconds of just a black screen.

Yesterday I went to bleeping computers.com and ran their utility "autoruns" to try to get rid of some of my start-up items. I ran the program but didn't really know what to do with it so I posted in their forum to ask about it. I was warned by a few in the forum that this was for advanced users and be careful or I could really screw something up so I chose to just leave it alone.

If you want to see my post it is here: http://www.bleepingcomputer.com/forums/t/568381/how-to-use-autoruns/

P.S. I appreciate all your help and I feel like I am taking up too much of your time. We can stop anytime but if you want to keep sending me suggestions I will keep going. I am learning a lot from this. Thanks.

Boggin · « **Reply #47 on:** February 27, 2015, 07:05:42 am »

My Win 7 x64 HP laptop takes a minute to 1 min 5secs to boot up and on a bad day - 1min 15secs so something is still slowing yours down.

Have you checked Device Manager/View/Show hidden devices to see if any more yellow alerts have popped up ?

What does Check for Performace issues report now ?

StartUpLite is an old program and hasn't been updated for some time but may still pick up on something https://www.malwarebytes.org/startuplite/

jmk909er · « **Reply #48 on:** February 27, 2015, 08:05:14 am »

Good news Boggin

I just booted up in 58 seconds!

There are no yellow alerts in device manager.

I ran "Check for Performance" and I do see a couple of things that may be suspicious I made a video to show you.
https://www.dropbox.com/s/quvbkqcohkdk4lh/Check%20for%20performance%20issues%202-27-15.mp4?dl=0

I ran "StartUpLite" and it suggested that I disable Quicktime from the start-up. I suspect that this is what is taking so long.

From pushing the start-up button to get to the sign in screen was 58 seconds and I only had 6 seconds of black screen

Boggin · « **Reply #49 on:** February 27, 2015, 08:45:33 am »

That's great news - sounds like you've cracked it

If you go Start - All programs - Toshiba and/or Utilities you will see a number of those Toshiba items.

Toshiba Tempro can be booted up and set to disabled, but you won't receive any update messages although you can boot it up and enable it now and again to see if there are any - mine once alerted me to a BIOS update but Toshiba seems to have a short end of life for their products.

The Service Station - clicking on Decline will give a confirmation that it will be disabled - never really knew what that one is for but I have Toshiba Reel Time unchecked in mine.

Given the boot up time you now have, those Toshiba startup services aren't having any adverse effect given that a bare bones Win 7 is supposed to boot up in 47 seconds.

The quickest mine has ever booted up in was 53 seconds - don't know what's happened to it since