29 replies to this topic

[Mr Stark]

My laptop's disk usage stays 100% most of the time, even when no program is opened. When I turn on it starts with 100%, then slowly comes down to 0% after a few minutes. When I open chrome, android studio, photoshop, or any game it climb to 100%. Even opening image or mp3 file makes it reach 100%. The weird thing is system never goes above 1.5-2MB/s. I've tried disabling superfetch, windows search and a few more things that I've seen on youtube and some forums but none of them worked. I've tried scanning whole system with windows defender, scanned with malwarebytes and defragmented all disks but still this didn't solved the problem. My laptop is very slow and it's so annoying.Can anyone help me out. I'll really appreciate.

[Satchfan]

Hello Mr Stark and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Note: Please run these in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner by clicking on Scan
• when it has finished, leave everything that was found checked, (ticked), then click on Clean
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

AdwCleaner log
Frst.txt
Addition.txt

Thanks

Satchfan

 

[Mr Stark]

Hey Satchfan, I'm glad that you are helping me out. I've attached the logs that you asked for.

Attached Files

•  Addition.txt   49.5KB   1574 downloads
•  AdwCleanerC00.txt   1.42KB   1267 downloads
•  FRST.txt   51.86KB   1326 downloads

[Satchfan]

There are no signs of malware on your computer but some things are in need of tidying up.


P2P - I see you have P2P software, (uTorrent), installed on your machine.

We are not here to pass judgment on file-sharing as a concept but we will warn you that engaging in this activity will always make your computer very susceptible to infection and re-infection.

If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. Those who write malware use P2P file-sharing as a major vehicle to spread their wares.

If you still think about using it, please see the link below for information about CryptoLocker Ransomware, a type of Ransomware which can be delivered via P2P file transfers.

CryptoLocker Ransomware.

The newest variation of Ransomware can make it impossible to recover the files that it encrypts. In other words, you will probably lose most, if not all of your files, including pictures. In addition, it has recently been reported that P2P downloads may be tracked, resulting in your IP address being monitored by copyright authorities.

I would strongly recommend that you uninstall it now.

Should you decide to keep it, please don’t use it until we have finished up here.

================================================

I’m taking it that you know about this proxy so have ignored it:

37.187.16.186:80

If not, please let me know.

================================================

You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to F:\Applications\Fix High Disk Usage and locate FRST64
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll No File
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [No File]
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [No File]
2018-10-11 17:07 - 2017-07-07 16:24 - 000007613 _____ C:\Users\sahil pandit\AppData\Local\resmon.resmoncfg
2018-07-07 22:36 - 2018-07-07 22:36 - 000000000 _____ () C:\Users\sahil pandit\AppData\Local\{3B62D924-D79A-4AD0-A547-0935F5AC8BC7}
Avast Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.4.136.333 - AVAST Software) Hidden
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
Task: {740A64E2-2EF7-423F-86FD-00CCACE132D1} - \FreeDownloadManagerNetworkMonitor -> No File <==== ATTENTION
Task: {769F1A30-517F-4C05-A016-250BACEBFEF5} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [2018-09-20] (AVAST Software)
Task: {CB6AA27F-B635-4131-BDE3-FA6A8DCD92E8} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {D8759CFF-8ADE-478D-87BF-7E0281B36186} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe
Task: {ECBF4B04-1CA5-4B32-A5FD-EDB4A75E0D64} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
Task: {F0FA5D69-0BD9-4EBC-B170-38B622DAE9C4} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879 [135]
AlternateDataStreams: C:\Users\Public\AppData:CSM [474]
FirewallRules: [{C3B912D9-1204-46C9-87DF-3DD68DAE79EF}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe
FirewallRules: [{783DD092-383A-49CF-BD44-4B30048993EF}] => (Allow) C:\Program Files (x86)\Common Files\Mcafee\MMSSHost\MMSSHost.exe
FirewallRules: [{381EC105-BEE9-4367-8C8C-495797D32438}] => (Allow) C:\Users\sahil pandit\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{5A955E64-85C0-447E-8D0F-2D1996B75374}] => (Allow) C:\Users\sahil pandit\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files\Common Files\McAfee
C:\Program Files (x86)\Common Files\Mcafee
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

Thanks

Satchfan

 

[Mr Stark]

Hey Satchfan, I'm currently downloading something but I'll uninstall utorrent once it's finished. Thanks for the cryptoLocker Ransomware link. I've read the whole article, I'll be more alert while downloading files.

Also you said about this proxy - 37.187.16.186:80. I don't know what it is. 

 

You said to run Far Bar Recovery tool and fix, but I'm not sure if it is safe. I mean I tried this other software aswMBR 2 times and my laptop crashed both the time(2 months ago). Also you've written a warning to not try this on other computer as it might damage the operating system. So just want to know is it safe for my pc and my files?

[Satchfan]

The FRST fix is perfectly safe as it is tailored to your machine's specifications, which is why it would not only be stupid, but could cause problems run on a different machine.

 

When you have relocated FRST to your desktop, I have revised the 'fix' to include the 'proxy':

 

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== ATTENTION
ProxyServer: [S-1-5-21-1966562623-1207937322-2391361035-1002] => 37.187.16.186:80
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll No File
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [No File]
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [No File]
2018-10-11 17:07 - 2017-07-07 16:24 - 000007613 _____ C:\Users\sahil pandit\AppData\Local\resmon.resmoncfg
2018-07-07 22:36 - 2018-07-07 22:36 - 000000000 _____ () C:\Users\sahil pandit\AppData\Local\{3B62D924-D79A-4AD0-A547-0935F5AC8BC7}
Avast Update Helper (HKLM-x32\...\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}) (Version: 1.4.136.333 - AVAST Software) Hidden
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} =>  -> No File
ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} =>  -> No File
Task: {740A64E2-2EF7-423F-86FD-00CCACE132D1} - \FreeDownloadManagerNetworkMonitor -> No File <==== ATTENTION
Task: {769F1A30-517F-4C05-A016-250BACEBFEF5} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [2018-09-20] (AVAST Software)
Task: {CB6AA27F-B635-4131-BDE3-FA6A8DCD92E8} - \Microsoft\Windows\UNP\RunCampaignManager -> No File <==== ATTENTION
Task: {D8759CFF-8ADE-478D-87BF-7E0281B36186} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe
Task: {ECBF4B04-1CA5-4B32-A5FD-EDB4A75E0D64} - System32\Tasks\AvastUpdateTaskMachineCore => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
Task: {F0FA5D69-0BD9-4EBC-B170-38B622DAE9C4} - System32\Tasks\AvastUpdateTaskMachineUA => C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879 [135]
AlternateDataStreams: C:\Users\Public\AppData:CSM [474]
FirewallRules: [{C3B912D9-1204-46C9-87DF-3DD68DAE79EF}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe
FirewallRules: [{783DD092-383A-49CF-BD44-4B30048993EF}] => (Allow) C:\Program Files (x86)\Common Files\Mcafee\MMSSHost\MMSSHost.exe
FirewallRules: [{381EC105-BEE9-4367-8C8C-495797D32438}] => (Allow) C:\Users\sahil pandit\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{5A955E64-85C0-447E-8D0F-2D1996B75374}] => (Allow) C:\Users\sahil pandit\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files\Common Files\McAfee
C:\Program Files (x86)\Common Files\Mcafee
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

Thanks

Satchfan

[Mr Stark]

Done

Attached Files

•  Fixlog.txt   13.08KB   1389 downloads

[Satchfan]

Please uninstall the following programmes:

Avast Update Helper
Java 8 Update 111
Java 8 Update 131
Java 8 Update 144
Java 8 Update 162
Java 8 Update 172

Install the latest version of Java:

Java

Even though I just had you get the latest version of Java, there is a vulnerability with regards to Java and web browsers, therefore I recommend that you disable java in web browsers.

More information can be found here.

================================================

Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

Logs to include with next post:

New Frst.txt
New Addition.txt

Thanks

Satchfan

[Mr Stark]

Done

Attached Files

•  Addition.txt   46.43KB   1326 downloads
•  FRST.txt   46.9KB   1306 downloads

[Satchfan]

One of the errors found in your log is that the Netlogon service does not need to run in the current configuration - it's telling you that you don't need the NETLOGON service running because this computer is configured as a member of a workgroup, not as a member of a domain. If you are part of a workgroup, go to Start/Control Panel/Administrative Tools/Services/NETLOGON and change it from automatic to manual and then stop it.

A few more bits to tidy up.

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
BHO: No Name -> {13D67BB7-DB5F-48AA-884D-7A5D94168509} -> No File
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [478]
C:\WINDOWS\system32\SRU\SRUDB.dat
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

Thanks

Satchfan

 

[Mr Stark]

Done

Attached Files

•  Fixlog.txt   2.11KB   1275 downloads

[Satchfan]

Sorry for the delay but somehow missed that post.
 

What is the situation now?

 

Satchfan

[Mr Stark]

Still the same. Check the screenshot

 

Attached Thumbnails

• 

[Satchfan]

Please see this.

[Mr Stark]

Wait, is the help over??

And it's not about wsappx. Any program that I run make it reach to 100% whether it is photoshop, winzip, google chrome, music, videos or a game.