unresponsive windows and constantly crashing [Solved]

hi i am back with this laptop had it sent to pc repair shop, came back unresponsive and worse than when it left me. when i open a window it takes way to long, and just freezes constantly.my mouse key disappears and it then constantly says windows not responding, shockwave flash plug in stopped. ive tried downloading the dds from this site to get a report but avg says its infected, not even sure if the avg is genuine as it came back from the pc shop with it on, any help is greatly appreciated.

Hello lisafunkypants, welcome to WhatTheTech's Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. 
 
======================================================
 
Important: I have laid out some "ground rules" I would very much appreciate you follow. Please read through the points below, to ensure this process moves as quickly and efficiently as possible.

• Please read through my instructions thoroughly, and ensure you carry out each step in the order specified.
• Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation & providing the best set of instructions for you.
• Ensure you are subscribed to this topic to receive instant email notifications of my responses.
  • ​Scroll to the top of this page and ensure you see the following: [external image: 6hgDYJ6.png]
  • If you are not set to follow this topic, click the Follow this topic button and follow the prompts.
• Please attempt to backup important documents before proceeding with my instructions.
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before you run anything.
• Topics are locked if no response is made after 5 days. Please inform me if you will require additional time to complete my instructions.

======================================================

Hello lisafunkypants,
 
I am sorry to hear you've had trouble with your PC repair shop. If you are unsatisfied with the work they've done, you are well within your rights to return and request a refund. 
 

ive tried downloading the dds from this site to get a report but avg says its infected

This is a false-positive, and not something to be concerned with. We will however use a different scan. If you receive any warnings from AVG whilst carrying out the instructions below, I would like you to temporarily disable AVG. For instructions, please refer to the following link.

 
STEP 1
[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Scan

• Please download Farbar Recovery Scan Tool (x32) or Farbar Recovery Scan Tool (x64) and save the file to your desktop.
• Note: Run the version compatible with your system. Run both if you do not know your system's bit-type. One will run.  
• Windows XP: Double-click FRST.exe / FRST64.exe to run the programme.
  Windows 8/7/Vista: Right-Click FRST.exe / FRST64.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Yes to the disclaimer.
• Ensure the Addition.txt box is checked.
• Click the Scan button and let the programme run.
• Upon completion, click OK, then OK on the Addition.txt pop up screen.
• Two logs (FRST.txt & Addition.txt) will now be open on your desktop. Copy the contents of both logs and paste in your next reply. 
   

STEP 2
[external image: aA7bkRO.png] aswMBR

• Please download aswMBR and save the file to your desktop. 
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click aswMBR.exe to run the programme.
• Right-Click aswMBR.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• If you are prompted to download the latest anti-virus definitions from avast!, click Yes.
• Click the AV Scan: drop down box and click C:\.
• Click Scan. 
• Upon completion, you will see Scan finished successfully. Click Save log. 
• Copy the contents of the log and paste in your next reply.

Note: Do NOT attempt to click Fix or FixMBR.
Note: A file (MBR.dat) will be created on your desktop. Do NOT click or delete it.
 
 ======================================================
 
STEP 3
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• FRST.txt
• Addition.txt
• aswMBR log

Hello Lisa,
 
Your logs are clean (albeit, incomplete). Have you cut the top off? 
 
This is the source of your issues: 

Percentage of memory in use: 84%
Total physical RAM: 766.42 MB

Ideally, you should have at least 1GB of RAM to run Windows 7 32-bit without issue. 
Please refer to this article. You may wish to upgrade your RAM. 
 

i may also add it constantly tells me windows is using to much memory and should be restarted…If you think it maybe worth me getting a more modern laptop please give me your honest opinion.

The message from Windows regarding memory usage is due to the issue mentioned above. I suggest you read the two articles linked. You will be better equipped to make a decision. Take note of the following statement, "Adding RAM is often the most cost-effective upgrade you can make to speed up a sluggish computer". 
 
————————————
 
In the meantime, I would like you to uninstall AVG.

• AVG is considered a 'resource hog', which requires numerous running processes and other components. 
• In 2010, AVG partnered with LimeWire and promoted the use of peer-to-peer (P2P) file sharing.
• Since the release of AVG 2011, there have been numerous complaints about conflict issues with other security programmes. 
• AVG promotes the use of registry cleaners/optimization tools by bundling PC Tuneup.
   

To uninstall AVG:

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for the following programmes, right-click and click Uninstall one at a time.
  • AVG 2014
  • Any programmes with 'AVG'
• ​Having uninstalled AVG, please install Microsoft Security Essentials (MSE), which is very light on resources. 
   

————————————
 
I can also see you are running FRST from your downloads folder (C:\Users\Admin\Downloads). After completing the steps above, please delete each copy of FRST, download a fresh one and save the file to your desktop. This is important!
 
Please run a new FRST scan and post the two logs. 
 
 
======================================================

In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Thoughts on your RAM issue?
• Did AVG uninstall successfully? Did MSE install successfully?
• FRST.txt
• Addition.txt

Hello Lisa,
 
Uninstalling AVG appears to have reduced your memory in use: 
Percentage of memory in use: 73%
 
​Excluding a few AVG remnants and other orphans, there is nothing in your log that requires removing. You should see a noticeable difference in performance once you have upgraded your RAM.
 
STEP 1
[external image: xlK5Hdb.png] Farbar Recovery Scan Tool (FRST) Script

• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type Notepad and click OK.
• Copy the entire contents of the codebox below and paste into the Notepad document.
  

  start
  HKLM\…\Run: [] => [X]
  HKU\S-1-5-21-2347572414-1306700944-569078958-1000\…\Run: [AVG-Secure-Search-Update_0913b] => C:\Users\Admin\AppData\Roaming\AVG 0913b Campaign\AVG-Secure-Search-Update-0913b.exe /PROMPT –mid c5995cdd0b5647d381aba113f09d87db-06ce4fc639803a2e3563922518183d8e94088cb9 –CMPID 0913b
  HKU\S-1-5-21-2347572414-1306700944-569078958-1000\…\MountPoints2: {4cf15741-2482-11e3-b1a6-705ab6796e28} - E:\LaunchU3.exe -a
  HKU\S-1-5-21-2347572414-1306700944-569078958-1000\…\MountPoints2: {f58b096e-657a-11e3-9d8c-705ab6796e28} - E:\iLinker.exe
  SearchScopes: HKLM - DefaultScope value is missing.
  S2 vToolbarUpdater18.1.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.0\ToolbarUpdater.exe [X]
  R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [42272 2014-05-04] (AVG Technologies)
  C:\Windows\system32\drivers\avgtpx86.sys
  2014-05-04 18:23 - 2014-05-18 11:59 - 00000000 ____D () C:\Users\Admin\AppData\Local\AVG SafeGuard toolbar
  Folder: C:\38b960cec41efa1d4d
  Folder: C:\a71e1a1af861537a1469285b4380cc88
  AlternateDataStreams: C:\ProgramData\TEMP:C6AA1BF2
  end

• Click File, Save As and type fixlist.txt as the File Name. 
• Important: The file must be saved in the same location as FRST.exe. 

NOTICE: This script is intended for use on this particular machine. Do not use this script on any other machine; doing so may cause damage to your Operating System.

• Right-Click FRST.exe and select [external image: AVOiBNU.jpg] Run as administrator to run the programme.
• Click Fix.
• A log (Fixlog.txt) will open on your desktop. Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 2
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Fixlog.txt
• Do you have any outstanding issues (excluding slowness caused by low RAM)?

hi adam before i clean using adw, this is in the log in the registry Key Found : HKCU\Software\AppDataLow\Software just want to check thats ok to delete and that its not virus etc 

Hi Lisa, 

Please uncheck that item, and proceed with my instructions.

Hi Lisa,
 
Logs are looking good. Please continue with these last two scans, and you should be all set (but don't forget to wait for my "All Clean" speech)! 
 
STEP 1
[external image: CXrghb6.png] Update/Remove Java

• Download the latest version of [external image: j8JVMVP.jpg] Java from here.
• Press the Windows Key [external image: pdKOQKY.png] + r on your keyboard at the same time. Type appwiz.cpl and click OK.
• Search for and uninstall the following programmes (if present):
  • Java 7 Update 51
     

STEP 2
[external image: GfiJrQ9.png] Malwarebytes Anti-Malware (MBAM)

• Please download Malwarebytes Anti-Malware Free to your desktop.
• Double-click mbam-setup.x.x.xxxx.exe (x represents the version #) and follow the prompts to install the programme. 
• Launch the programme and select Update.
• Once updated, click the Settings tab and tick Scan for rootkits.
• Click the Scan tab, ensure Threat Scan is checked and click Scan Now.
• Note: You may see the following message, "Could not load DDA driver". Click Yes, allow your PC to reboot and continue afterwards. 
• If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.
• Upon completion of the scan (or after the reboot), click the History tab.
• Click Application Logs and double-click the Scan Log.
• Click Copy to Clipboard and paste the log in your next reply. 
   

STEP 3
[external image: GzlsbnV.png] ESET Online Scan
Note: This scan will take a significant amount of time to complete. Please do not browse the Internet whilst your resident protection is disabled.

• Please download ESET Online Scan and save the file to your desktop.
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Double-click esetsmartinstaller_enu.exe to run the programme. 
• Agree to the EULA by placing a checkmark next to Yes, I accept the Terms of Use. Then press Start.
• Agree to the Terms of Use once more and click Start. Allow components to download.
• Click Hide advanced settings. Your settings should match that of the image below.
• Ensure Remove found threats is unchecked.
  [external image: 3Crnyln.png]
• Allow virus signature database to download and for the scan to finish. Please be patient as this can take some time.
• Upon completion, click [external image: esetListThreats.png]. If no threats were found, skip the next two bullet points. 
• Click [external image: esetExport.png] and save the file to your desktop, naming it something unique such as MyEsetScan.
• Push the Back button.
• Place a checkmark next to [external image: KN1w2nv.png] and click [external image: SzOC1p0.png].
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 4
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Did Java update/remove successfully? 
• MBAM Scan log
• ESET Online Scan log

Hi Adam, i think the sooner i get more RAM the better, that was a long haul with non responding tasks….Eset found nothing and java installed correctly:

Hi Lisa,
 
ESET finding nothing is very good. MBAM only found a few remnants in your Temp folder, which we would have cleared in any case. Once you've completed these steps, I will be ready to remove our tools and issue the "All Clean". 
 
STEP 1
[external image: CXrghb6.png] Update Outdated Software
Outdated software contain security risks that must be patched. Please download and install the latest version of the programmes below.

• [external image: u9DsAVv.png] Follow these instructions to check for download the latest Windows Updates.
   

STEP 2
[external image: zANS9oB.png] Disable Java in Your Browser
Due to frequent exploits we recommend you disable Java in your browser. For information on Java vulnerabilities, please read the followingarticle (point #7).

• Click the Windows Start Button [external image: 29Fou9c.jpg] and type Java Control Panel (or javacpl) in the search bar. 
• Press the Windows Key [external image: pdKOQKY.png] + w on your keyboard at the same time. Type Java Control Panel (or javacpl) in the search bar. 
• Click on the Java Control Panel. Once opened, click the Security tab.
• Deselect the check box for Enable Java content in the browser. This will disable the Java plug-in in the browser. 
• Click Apply. When the Windows User Account Control (UAC) [external image: AVOiBNU.jpg] appears, allow permissions to make the changes. 
• Click OK in the Java Plug-in confirmation window.
• Restart your browser(s) for changes to take effect.
• More information can be found here and here.
   

STEP 3
[external image: oxliOQk.png] Security Check

• Please download SecurityCheck and save the file to your desktop.
• Double-click SecurityCheck.exe and follow the onscreen instructions inside the black box.
• A log (checkup.txt) will automatically open on your desktop.
• Copy the contents of the log and paste in your next reply.
   

======================================================
 
STEP 4
[external image: pfNZP4A.png] Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• Confirmation you had no issues with the instructions. 
• checkup.txt
• Comments on how your computer is performing. 

Note: There are important steps to follow. Please ensure you continue following this topic until I give you the "All Clean".