Author Topic: (Solved) Desktop pc suddenly slow (Read 77242 times)

Lady · « **Reply #25 on:** February 28, 2016, 02:25:11 am »

It took me some time to understand what you meant but I think I do now.

I see three VirusTotals in red. See attachments. 1 is the Tweaking.com Windows Repair Tray Icon! 2 is IOBit Uninstaller. I noticed before that when I wanted to update this program uBlock came with a warning and I didn't update. The third is the Prey program.

What do you say?

Had one instance of slowness. Pc is still fine today, just watched some videos without any problems.

Boggin · « **Reply #26 on:** February 28, 2016, 03:44:22 am »

I have WR Pro and while it is listed in Process Explorer for me, it doesn't have a signature or Virus Total rating.

I also have IObit Uninstaller but it isn't running in the background and so, isn't listed - use IObit Uninstaller to uninstall itself to see if that makes any difference and what is the Prey program ?

Generally, 1 or 2/50 in red are nothing to worry about.

I think at one time I used to get a 1/50 for Flash Player, mine are all showing in blue with 0/50ish.

EDIT - Just had another look and Uninstall Monitor.exe is listed but doesn't have a signature or rating and is very low usage - so perhaps not that.

Boggin · « **Reply #27 on:** February 28, 2016, 03:56:01 am »

Just been playing about with the View options in PE and now both WR and Uninstaller are verified and now showing in red as 1/50ish and 2/50ish respectively - possibly because they have the ability to change your system.

However, PE may show something that is responsible for that 3.6GB usage.

Boggin · « **Reply #28 on:** February 28, 2016, 04:19:38 am »

A bit more on using PE - https://askleo.com/how_do_i_find_out_whos_using_all_my_memory/

Lady · « **Reply #29 on:** February 28, 2016, 04:42:49 am »

Prey is a program that can locate your pc/laptop/cell phone. https://preyproject.com/ You have to sign up and log in, it's not an installed program.

I was just looking at Programs and Features and saw Surfing Protection by IObit. That might be a realtime thing as well. I don't like this IObit one bit

. They keep trying to install all kinds of things. I have Revo but only for 32 bit programs. Didn't know your trick back then.

Do you know another freeware uninstaller so I can get rid of this IObit?

Yeah, I got that, that 1 or 2 positives is nothing to worry about.

I made screenshots of my Process Explorer for you.

Now I'm signing off for the rest of the afternoon, Boggin. It's lovely weather here and I REALLY promised myself to do something else today!

We'll talk later. Oh, but we should not forget that I still cannot open IE.

Have a nice day!

Boggin · « **Reply #30 on:** February 28, 2016, 04:57:49 am »

I've used IObit to uninstall itself before now, but you can download the Pro trial version of Revo which will uninstall 64 bit programs.

Have you tried to open IE without add-ons yet or run AdwCleaner or Junkware Removal Tool to see if they find anything untoward which will stop IE from opening.

Have you also tried resetting IE to defaults ?

If you can open IE without add-ons then that would point to something nasty on your computer which both AdwCleaner and JRT are designed to remove.

If they haven't found anything untoward then go to Method 4 in this article and hit the Download button to re-register IE - https://support.microsoft.com/en-us/kb/813444

Lady · « **Reply #31 on:** February 28, 2016, 09:48:45 am »

I was able to do something with my Sunday for a bit........and here I am again.

If we solve this, I believe I should deserve another karma point. Pfffffffff.

Am looking right now at a possible memory leak in Process Explorer, according to Leo's instructions (Working Set and Virtual Size). I think it's better to do this after a fresh start, but anyway, I'm looking at it.

Hadn't turned off the pc and now it's starting to get really slow again.

Lady · « **Reply #32 on:** February 28, 2016, 09:54:26 am »

Oh, I hadn't seen your last post.
About IE please read my post No. 19.

I will now run AdwCleaner and JunkwareRemovalTool.

No, cannot install them, the pc is too slow. Tomorrow then. BullGuard blocked the JRT site but I assume that's a false positive?

Boggin · « **Reply #33 on:** February 28, 2016, 10:19:57 am »

I've had Norton block AdwCleaner before now as a false positive.

JRT now belongs to MBAM but there are a number of sites you can download it from http://lmgtfy.com/?q=jrt+download

Of those, I would trust bleepingcomputer.com, the MBAM link, filehippo.com, majorgeeks.com and techspot.com

The block may be site specific.

If AdwCleaner and JRT don't find anything or IE still fails to open after running them, then use the link to re-register IE or from an elevated cmd prompt, see what a sfc /scannow reports.

Lady · « **Reply #34 on:** February 28, 2016, 10:45:50 am »

Just a thought: the way I see IE trying to open which is similar to when the pc is slow and I try to install a program made me think: isn't IE a big program like Firefox which would use a LOT of memory space and therefore cannot even open?

Boggin · « **Reply #35 on:** February 28, 2016, 12:57:49 pm »

It's possible that you have tried to open IE and even though it failed to open, Windows could still be trying which could account for the memory leak - but just a guess.

When you go Start - type iexplore.exe and press enter, does it open ?

The next thing to check would be Event Viewer for when you try to open IE - look for the Error time stamps, but don't forget to use the MS article to re-register IE or see if a sfc /scannow reports anything.

Lady · « **Reply #36 on:** February 28, 2016, 01:57:40 pm »

Quote from: Boggin on February 28, 2016, 12:57:49 pm

It's possible that you have tried to open IE and even though it failed to open, Windows could still be trying which could account for the memory leak - but just a guess.

Yes, this could well be. I meant it in a different way: if there's so little free physical memory left then IE wouldn't have enough memory to even open and fails immediately. As already happens with simple programs failing to be installed. So maybe, even when the pc is on normal speed, there's not enough memory for IE to open. Could this be valid somehow?

Quote from: Boggin on February 28, 2016, 12:57:49 pm

When you go Start - type iexplore.exe and press enter, does it open ?

I did this, see post 19.

Quote from: Boggin on February 28, 2016, 12:57:49 pm

The next thing to check would be Event Viewer for when you try to open IE - look for the Error time stamps, but don't forget to use the MS article to re-register IE or see if a sfc /scannow reports anything.

Please don't forget that I'm trying hard to keep up with you, trying to understand what you're saying, I have to look up pretty much everything you're suggesting, search for things, translate, etc. It's not easy....

I found out what the Event Viewer is, but don't know where to look. It's big. I uploaded the error message again which I received once when I tried to open IE. See attachment.

Maybe it's just all due to the number of tabs I have in Firefox......

The pc is so superslow now that I cannot even write here in a normal fashion. Have to turn the thing off.

And I have to take a break from this now.

Boggin · « **Reply #37 on:** February 28, 2016, 02:27:20 pm »

Shane may know what that IE txt refers to but I don't.

Do you try to open IE in each new session ?

I would normally explain about Event Viewer but thought you'd already been in there.

When Event Viewer has read the data you will be presented with a pane listing Critical, Errors etc. and if any have occurred in the last hour, 24 hrs etc.

Click on Error then on View All Instances of This Event in the lower right pane and then you can look for the applicable time stamped errors.

If you see any, click on them and more info will appear in the lower pane and clicking on the blue online help link can sometimes explain why that error occurred and possible solutions, but if you want to post the error, then click on Copy/Copy details as text in the lower right pane, then right click in the reply box and select Paste.

You would do this for each Error you clicked on.

Can you see if you can boot up into Safe Mode with Networking, usually by tapping F8 as you switch on and then select that option and press enter - AdwCleaner should install then as all 3rd party programs such as Bullguard will be isolated.

I believe you have WR installed - if you click on its system tray icon you can see if using the Clean Memory option will free up sufficient for you to install AdwCleaner.

You haven't said if you've used the download button in that MS article to re-register the IE .dlls.

The article doesn't give it as being applicable to IE 11 and Win 7 but I'd already run it to see if it gave any error messages, everything still works as it should.

I think you know how to run a sfc /scannow from an elevated command prompt, but go Start - type cmd then right click on cmd and select Run as administrator - accept the UAC and enter sfc /scannow to see what it reports.

Lady · « **Reply #38 on:** February 28, 2016, 02:43:05 pm »

When I closed down the pc just now I paid more attention as I thought I saw something happening yesterday. And it did. I was very particular in closing every program before closing down and it took a while (the slowness) but for a very short time a pane appeared which said something about program or programs still needing to be closed. I couldn't even read it, it was gone so fast. But I managed to click on cancel, so I could view it again. It appeared again on closing down, I pressed printscreen but it closed down completely.

So there are still things happening in the background that I cannot see. I think that was important for you to know.

Right now I cannot do all the things you're suggesting. It's too much. Communicating through writing causes misunderstandings so easily, it wears me out. I can download AdwCleaner and everything else when the pc is normal.

Boggin · « **Reply #39 on:** February 28, 2016, 02:52:56 pm »

Sometimes the shutdown can hang because not all background programs/services shutdown straight away, but if the message is just fleeting then they will be closing down.

What problems are you encountering in following my suggestions ?

If you can run AdwCleaner when the machine is normal - at least that is something, but without the further diagnostic suggestions it is difficult to progress.

I've emailed Shane to see what he makes of that IE.txt attachment, but I don't expect a reply until at least tomorrow.

Lady · « **Reply #40 on:** February 29, 2016, 03:51:21 am »

I cannot install Revo Pro as I've used the 30 days trial period in the past and didn't know your trick (what was the trick again?), so now they ask to activate it with a licence. Maybe I should buy a licence.

I'll run AdwCleaner and JRT today.

Can we leave the IE issue for now? My feeling is that there's nothing wrong with IE itself.

I have uninstalled EMET. Someone told me to install HitmanPro.Alert instead. He said it was necessary especially for banktrojans.

Lady · « **Reply #41 on:** February 29, 2016, 04:21:40 am »

Now I remember why I stopped using AdwCleaner. Because I never knew whether its findings were malware or not.

Please look over them and give me the green light.

I know MyFreeCodec. That's from a Samsung cell phone program I de-installed.

Boggin · « **Reply #42 on:** February 29, 2016, 05:17:31 am »

A rule of thumb is if you don't know what something is or the effects of deleting something, then you leave it.

As you have uninstalled MyFreeCodec then you can leave those items checked for removal as they will be registry residue.

Re, your PM, I forgot to mention that running the MS fixit to re-register IE is quite safe as I've already explained in a previous post.

Lady · « **Reply #43 on:** February 29, 2016, 07:04:07 am »

Alright, thanks.

Did you see post No. 40?

Lady · « **Reply #44 on:** February 29, 2016, 07:49:47 am »

Please comment on my post No. 40.

Strange things happening again! I let AdwCleaner remove the files and reboot. Then no log and the whole exe file had disappeared from my desktop! Had to download it again. Has AdwCleaner changed its ways in the meantime? Or is my pc really going crazy now?

Boggin · « **Reply #45 on:** February 29, 2016, 07:59:38 am »

Yes, I saw your Reply #40

I don't think you need to bother with uninstalling IObit Uninstaller as it has never caused problems for me but if you go Start - All programs and expand IObit Uninstaller, you will see that it has its own uninstaller.

Let me know if IE opens after you have run AdwCleaner, but as IE is part of Windows and if there is any corruption, a sfc /scannow may report on that.

I used to use HitmanPro.Alert v2.0 but that started telling me there was something wrong with my IE 11.

This coincided with an update to v3.0 which may have affected my v2.0

I tried v3.0 when it was a free program and found it corrupted my Teredo Tunneling adapter in Device Manager/View/Show hidden devices/Network adapters by putting a yellow alert next to it.

Some banks insist you install Trusteer Rapport but that can cause problems in itself.

While another security level is good, they can have their side effects and I think as long as you have a decent antivirus program then you should be safe.

EDIT - Just seen your last post while I was typing my reply.

Not sure what happened there but Windows should have created a restore point prior to installing AdwCleaner which you could use to restore before you ran it.

After it had completed the scan did you click on Report to see what else it had found prior to clicking on Cleaning ?

If you need help in accessing System Protection to Restore then say so or if the restore reports as unsuccessful, you will need to do it again in Safe Mode as it will be Bullguard interfering in that.

When you get a chance, check Task Manager to see if uninstalling EMET has made any difference to the memory used or your computer has benefitted from it.

Lady · « **Reply #46 on:** February 29, 2016, 10:38:19 am »

Yaaaaaaayyyyyyyyy!!!!! IE opens!!!!! What was it about then, do you know now? Closed it again quickly. I find IE scary.

Ok, I'll continue with IObit but I want to uninstall IObit Surfing Protection because I assume it's another real-time protection thing, and I don't want everything to get conflicted. Re HitmanPro: I agree, what I have with those superprograms MBAM and BullGuard (and Eset) must be enough. Thanks for sharing your experience with it. I know about Trusteer Rapport, had it for a while and got rid of it. Didn't trust it. No pun intended. Hahahaha.

AdwCleaner: with Report I thought you meant Results (because of my Dutch version). Ran AdwC again in English but I don't see any Report for the life of me. See attachment. Didn't see a restore point being made either.

Quote from: Boggin on February 29, 2016, 07:59:38 am

If you need help in accessing System Protection to Restore then say so or if the restore reports as unsuccessful, you will need to do it again in Safe Mode as it will be Bullguard interfering in that.

I'm sorry, I have no idea what you mean by this. What restore?

The Task Manager shows a better result. I attached the pic of the TM when it was slow, so you can see the difference. I don't see much difference other than much more free physical memory. I must say the pc has definitely increased in speed since AdwC, it's REALLY fast now. No slowness yet, but the pc is only on for 1.5 hours. Do you think we found the culprit? And if we did, what was it exactly? And do I still have to run JRT?

Alas, more new problems:

As I looked at IObit Surfing Protection I saw I have 2 Tweaking.com WRs and I wanted to uninstall the older version 3.0.0. I couldn't, it said the tray icon was in use. So I opened the latest WR to see if I can get the tray icon out or stopped or whatever, but then I saw the latest version was already corrupted. See attachment. I only recently installed WR 3.8.3 (on Feb. 23) as I thought we would do that. How can that happen? And how do I uninstall the old WR with this tray icon running?

It's a lot of issues/questions, Boggin. Can you respond to them all, please? Thanks!

I'm really hoping this solved the slowness!! If you want to know what AdwC did, we still have the pictures.

I checked, but there isn't a log report in C\AdwCleaner of the first scan and removal either, the "S1". Strange.

Boggin · « **Reply #47 on:** February 29, 2016, 03:01:10 pm »

You would click on Logfile after the scan which will open in Notepad to show you what else it has found and it will produce another report (Logfile) after the reboot to show what it has removed.

After I've run it previously there has only been one AdwCleaner file listed in C: so don't know what has produced that many.

For IE to now open, it must have found something, but your memory usage is still way too high - I would still give JRT a run and see what things are like afterward as JRT is quite often used to supplement AdwCleaner.

You can end the WR Tray Icon in Task Manager by clicking on it under the Processes tab then on End Process which should enable you to uninstall both versions prior to a fresh install.

Are you using the free or the Pro version ?

I'm not sure if having two versions installed would disrupt anything, but check the memory usage in Task Manager after uninstalling and before the reinstall.

As for the restore - thought your computer had gone all to hell with AdwCleaner vanishing and using your restore points to prior its install may have gotten the system back to the way it should be.

I would go ahead and uninstall that Surfing Protection and again, check to see if the memory usage has improved.

Think I've covered everything....

Lady · « **Reply #48 on:** March 01, 2016, 06:41:02 am »

The other AdwC files in C: are from my attempts to find your "Report" in AdwC.

I only let it scan a few times and apparently that already gives a logfile in C:. I just performed the whole process again with AdwC, scan and clean, nothing else, didn't click on logfile. After reboot it gave a logfile and the program itself was still there. This IMHO means that AdwC cleaned something which really corrupted a lot, even with AdwC itself that first time around. What else has been corrupted??

Another thing: normally when you perform an update to a newer version of a program the program deletes the old version, right? This didn't happen with Tweaking.com. I don't suppose Tweaking.com doesn't delete the older version, so that means another corruption. I uninstalled one with IObit and then both were gone. I have the free version of WR.

I made a pic of Task Manager after I started the pc without opening any program. And then pics of Process Explorer in Virtual Memory order and then in Working Set order. See attachments. I hope that will help.

Well, IObit thinks my pc is really one big mess. Look at the message I got after uninstalling Surfing Protection. See attachment. It says: remnants of the files have been successfully removed and it gives the number of privacy problems, registry errors and waste files and that I should install their Advanced System Care. I assume this is a scare-tactics pitch?

I have to go. Will perform JRT later. Thanks, Boggin! Don't know what to do without you!

Oh, no slowness yet................ Although I saw last night in TM that free memory dropped more and more.

Boggin · « **Reply #49 on:** March 01, 2016, 07:26:15 am »

I noticed that GWX.exe is using a lot more memory than it was in your earlier pic of TM so it must be set to trigger at certain times, although you haven't experienced any slow because of it.

Because I don't want Win 10 installed again, I went into the registry, did a search for GWX - exported it so it was backed up and then deleted its entry in the registry.

While I don't have MBAME, I do have the free version of MBAM and I have its service stopped as there is no reason for it to be running in the background.

I don't know if you would have two service entries for MBAM in services and if stopping one would interfere with the other, but they are highish users.

To check, go Start - type services.msc and press enter then scroll down to the MBAM entries - one may be listed as MBAME but clicking on their names will give details of their purpose.

I believe MBAME needs to be active, so leave that one alone.

To disable, right click on the name and select Properties then use the dropdown to change its status to Disabled - Apply - OK - File - Exit

While I don't normally advocate the use of a registry cleaner, the free version of CCleaner is safe enough to use and I occasionally check my registry with it and if there are quite a lot of entries, then I'll have a clean out just for tidiness.

If you want to give that a run then uncheck the box for ActiveX and Class Issues first so they won't be in the list.