Multiple copies of same program won't run correctly and sometimes

Let's see what we can do.

Start Farbar Recovery Scan Tool with Administrator privileges
(Right click on the FRST icon and select Run as administrator)

highlight on the text below and select Copy.
beginning with Start:: and finishing with End::


Start::
CloseProcesses:
CreateRestorePoint:
GroupPolicy: Restriction <==== ATTENTION
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - No File
Handler: WSAllMyTubechrome - No CLSID Value
CustomCLSID: HKU\S-1-5-21-933687366-1884772992-1401314039-1001_Classes\CLSID\{144DF3B2-2402-47AE-9583-5A045929A8D4}\InprocServer32 -> C:\Users\ericjs\AppData\Local\Google\Update\1.3.33.5\psuser_64.dll => No File
ContextMenuHandlers4-x32: [MSSE] -> {0365FE2C-F183-4091-AC82-BFC39FB75C49} => -> No File
ShortcutWithArgument: C:\Users\ericjs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\AirMirror.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> –profile-directory=Default –app-id=macmgoeeggnlnmpiojbcniblabkdjphe
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8 [496]
AlternateDataStreams: C:\Users\ericjs\Downloads\EmsisoftEmergencyKit.exe:BDU [0]
AlternateDataStreams: C:\Users\ericjs\Downloads\googledrivesync.exe:BDU [0]
AlternateDataStreams: C:\Users\ericjs\Downloads\jdk-8u131-windows-x64.exe:BDU [0]
AlternateDataStreams: C:\Users\ericjs\Downloads\jre-8u131-windows-x64.exe:BDU [0]
AlternateDataStreams: C:\Users\ericjs\Downloads\KindleForPC-installer-1.20.47037.exe:BDU [0]
AlternateDataStreams: C:\Users\ericjs\Downloads\Zemana.AntiMalware.Setup.exe:BDU [0]
AlternateDataStreams: C:\Users\Public\DRM:احتضان [48]
Hosts:
Emptytemp:
CMD: ipconfig /flushdns
CMD: netsh winsock reset all
CMD: netsh int ipv4 reset
CMD: netsh int ipv6 reset
End::


Press the Fix button.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

~~~~~~~~~~~~~~~~~~`

[external image: RQKuhw1.png]RogueKiller

• Download the right version of RogueKiller for your Windows version (32 or 64-bit)
• Once done, move the executable file to your Desktop, right-click on it and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Click on the Start Scan button in the right panel, which will bring you to another tab, and click on it again (this time it'll be in the bottom right corner)
• Wait for the scan to complete
• On completion, the results will be displayed
• Check every single entry (threat found), and click on the Remove Selected button
• On completion, the results will be displayed. Click on the Open Report button in the bottom left corner, followed by the Open TXT button (also in the bottom left corner)
• This will open the report in Notepad. Copy/paste its content in your next reply

[external image: zcMPezJ.png]AdwCleaner - Fix Mode

• If you already have AdwCleaner on your computer, please delete it and download a fresh/updated version.
• Download AdwCleaner and move it to your Desktop
• Right-click on AdwCleaner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users)
• Accept the EULA (I accept), then click on Scan
• Let the scan complete. Once it's done, make sure that every item listed in the different tabs is checked and click on the Clean button. This will kill all active processes
  🖼Click to load external image (V7SD4El.png)
• Once the cleaning process is complete, AdwCleaner will ask to restart your computer, do it
• After the restart, a log will open when logging in. Please copy/paste the content of that log in your next reply

created by Aura

 

in your next reply please post
Fixlog.txt
RogueKiller log
AdwCleaner log

I saw several instances of Google Chrome open, did you close Chrome when you started the scans?, also, temporarily disabling antivirus is a good idea of which I forgot to mention.

FRST crashed once shutting down RT (or RTS) Ultramon.dll.
UltraMon from Realtime Soft, unlock the full potential of multiple monitors
This suggest that to me, to many thing are attached and need to be disconnected before running any scans.

~~~~~~~~~~~~~~~~~~~~~~
Have you had any alerts from your antivirus?

Have you added any new extensions for your browsers?

~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Can you turn on System Restore?
https://www.sevenforums.com/tutorials/330-system-protection-turn-off.html

~~~~~~~~~~~~~~~~~~~~~~~
Before using the below scanner please temporarily disable your antivirus, close all windows and browsers

[external image: G0tu5D9.png]Emsisoft Emergency Kit - Fix Mode
Follow the instructions below to run a scan using the Emsisoft Emergency Kit.

• Download the Emsisoft Emergency Kit and execute it. From there, click on the Install button to extract the program in the EEK folder;
• Once the extraction is complete, the EEK folder will open. Right-click on [external image: G0tu5D9.png]start emergency kit scanner.exe and select [external image: Spcusrh.png]Run as Administrator (for Windows Vista, 7, 8, 8.1 and 10 users);
• EEK will suggest that you run an online update before using the program. Click on Yes to launch it.
• After the update, click on Malware Scan under 2. Scan and accept to let EEK detect PUPs (click on Yes).
• Once the scan is complete, make sure that every item in the list is checked, and click on the Quarantine selected button;
• If it asks you for a reboot to delete some items, click on Ok to reboot automatically;
• After the restart, open EEK again (in the C:\EEK folder);
• This time, click on Logs;
• From there, go under the Quarantine Log tab, and click on the Export button;
• Save the log on your desktop, then open it, and copy/paste its content in your next reply;

No alerts from BitDefender.

 

I have AdBlock Plus in Chrome and Flash Video Downloader.

 

System restore is enabled for C: only.

 

I did not see this step " accept to let EEK detect PUPs (click on Yes)."

 

No problems found:

 

Emsisoft Emergency Kit 2017.12.0.8334 stable [en-us]

I can see Windows Defender as enabled, when installing BitDefender it should had disabled that ….in theory they will fight each other and might be doing so here.
Turn off Windows Defender Antivirus
https://support.microsoft.com/en-us/help/4027187/windows-turn-off-windows-defender-antivirus



Let's update and run a scan with Malwarebytes Anti-Malware

launch it and let it update his database. You might have to click on the little arrow by Scan Status in the middle right pane for it to do so
Once the database update is complete, click on the Scan tab, then select the Threat Scan button and click on Start Scan

Let the scan run, the time required to complete the scan depends of your system and computer specs
Once the scan is complete, make sure that the first checkbox at the top is checked (which will automatically check every detected item), then click on the Quarantine Selected button

If it asks you to restart your computer to complete the removal, do so

Click on Export Summary after the deletion (in the bottom-left corner) and select Copy to Clipboard.
Paste the content in your next reply

Tell me what the computer is doing now.

~~~~~~~~~~~~~~

Let's see if there are any startup items we can disable to improve performance.

Go here to download HJT
http://www.bleepingcomputer.com/download/hijackthis/

• Save HJTsetup.exe to your desktop.
• Doubleclick on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
• Put a check by Create a desktop icon then click Next again.
• Continue to follow the rest of the prompts from there.
• At the final dialogue box click Finish and it will launch Hijack This.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.

Looking good.

Typically, these entries are infrequently used tasks that can be started manually, if necessary.
Removing/disabling these items from statup will help with system resources.

Open HijackThis, Click Do a system scan only, checkmark these. Then close all other windows and browsers except HijackThis and press fix checked.

O4 - HKLM\..\Run: [Wondershare Helper Compact.exe] C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
O4 - HKLM\..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\\isuspm.exe -scheduler
O4 - HKLM\..\Run: [EaseUS EPM tray] C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.0\bin\EpmNews.exe
O4 - HKLM\..\Run: [EaseUS EPM Tray Agent] "C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.0\bin\TrayPopupE\TrayTipAgentE.exe"
O4 - HKLM\..\Run: [DNS7reminder] "C:\Program Files (x86)\Nuance\NaturallySpeaking12\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking12\Ereg.ini"
O4 - HKLM\..\Run: [Display] C:\Program Files (x86)\APC\PowerChute Personal Edition\DataCollectionLauncher.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"


Reboot the computer to set the registry.

How's the computer now?

Much worse but I don't see how anything we just removed would do this.  At the same time, my computer has acted this way before so maybe I'm infected with something.

 

After running HJT, the PC took a long time to shut down.  Then after reboot, every response was extremely slow, from 15 seconds to minutes. I also got an Action Center message that I had no AV and it shows that BitDefender and MalwareBytes are Off and I can't turn them on.  (I'm using my laptop now.)  I then tried to Restart and it hung showing the Task Manager running and finally cleared that but then got to a black screen and nothing else happened.  After waiting at least several minutes, I hard booted and started in Safe Mode, which was fine, but then after restarting normally, it is just the same, extremely slow to non-responsive. AV is still off.  Not sure what to do.  I seem to have internet access now, but also very slow to respond.

 

EDIT:  After 3 reboots, it is functioning normally, but still I'm concerned.

When your booting off or restarting, before using a browser or anything else and the machine has calmed down, open task manager and see if there is an .exe thats using a tremendous amount of CPU
like windows update or some other program (if bet defender is off I can't see why it would be the culprit)

What we removed from the startup list had nothing to do with bootup, if anything it would had sped it up.


Let's see if we can use task manager to turn on services for BitDefender and MalwareBytes, (hope there isn't a compatibility problem here)

Right-click an empty area of the taskbar, and then click Task Manager.

Locate the service for BitDefender, does it say stopped?, if it does, right click on that to start the service
Now look for the service for MalwareBytes, does it say stopped?

~~~
Please create new restore point before proceeding!
Vista and Seven - http://windows.microsoft.com/en-gb/windows7/create-a-restore-point

I think it would be a good idea to run Disk Check
https://support.microsoft.com/en-us/help/2641432/check-your-hard-disk-for-errors-in-windows-7

Also, System File Checker
https://support.microsoft.com/en-us/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system

Please note that after using chkdsk and system file checker the computer can be slow to boot after using the tools but should return back to normal after a couple boot off and boot up again.

I did not check for BitDefender after the system rebooted and started responding, but it is enabled again.  Also, when it has been (VERY) slow to respond, there is virtually no CPU usage showing in Task Manager.  I will run the checkers soon but I now see this strange performance rocket thing on the left side that pops out when I hover the mouse there.  Have no idea what it is or how to get rid of it.

 

EDIT: it only shows up on this WTT tab, no others.

 

📎Chrome AddOn.png

Let me ask about the performance rocket thing, I know it comes with the web site and shouldn't be an issue.

I asked about the performance rocket
 

 

It's part of the "Smart" skin so it only exists if that is the one the OP is using.  (I use the Blue Tech skin so I don't see it)

 

As for what it does - performance or normal - performance removes javascript which is supposed to make the page "cleaner" and work better on mobile devices.

 

Ran both.  Not sure of the results on the ChkDsk because I ran it while I was out and returned to a Windows login prompt.  Where would the log file be for that?  I ran the SFC with no errors found.

In theory, after a couple normal reboots your computer should start acting better…..yeah, it's one of those theory thing you know

 

Use your computer for a day, doing normal activities as best you can….let me know how it goes.