Soooo slow and Blue screen [Solved]

Hello, 

My computer is incredibly soooo slow, takes forever to startup on login and takes forever to do anything.  I tried running the requested downloads to post with this message but got the Blue Screen shutdown screen twice and it won't allow me to run the  aswMBR.

Hoping you can help me!!

Hello thoran and welcome back to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Run Farbar Recovery Scan Tool

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

• right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
• press Scan button
• it will produce a log called Frst.txt in the same directory the tool is run from
• please copy and paste log back here.
• the first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the Frst.txt into your reply.

Logs to include with next post:

Frst.txt
Addition.txt

Thanks

Satchfan

I have looked through your log but am now busy for a while so will send instructions later.

Satchfan

You need to move Farbar Recovery Scan Tool to your desktop otherwise fixes will not work.

• go to your Downloads folder and locate FRST64
• right click and select Cut
• go to an empty spot on your desktop, right click and select Paste

Farbar Recovery Scan Tool should now be on your desktop.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
HKLM\…\Run: [CL-23-2872C50A-40A2-4405-BC3F-1B038A041BEE] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-23-2872C50A-40A2-4405-BC3F-1B038A041BEE\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-23-2872C50 (the data entry has 44 more characters).
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {EF623357-922B-42A0-957D-1B8B92EF4B44} - System32\Tasks\{365FFA08-95DB-41A5-8DE7-F4224AADEFFB} => C:\windows\system32\pcalua.exe -a D:\setup.exe -d D:\
Task: C:\windows\Tasks\HP Photo Creations Messager.job => C:\ProgramData\HP Photo Creations\MessageCheck.exe
SearchScopes: HKU\S-1-5-21-3101223633-2765994983-3815756064-1000 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxps://us.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wbf_kjpjs68acegi17p_19_19¶m1=1¶m2=f%3D4%26b%3DIE%26cc%3Dus%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzuyE0CzztDzytAyE0CtByByC0DzzyC0DyEtN0D0Tzu0StByCzzyCtN1L2XzuyEtFyDtCtFtDtFtCtAtBtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StBzztB0BtC0F0F0AtGtD0DyC0AtGzytC0CtBtGtAyCyDtBtG0Ezy0BzzyCtC0EyD0BtBzy0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2S1OtB1RyEyCtAzz1OtGtByD1RzztGyE1Q1Q1TtG1StDzy1QtGtBtBzytB1QtA1QtCtCtCtCyD2QtN0A0LzutBtN1B2Z1V1T1S1NzutBtCzztAzytN1Q2Z1B1P1RzutCyDyDyByEzyzzyDyDyB%26cr%3D795786994%26a%3Dwbf_kjpjs68acegi17p_19_19%26os_ver%3D6.1%26os%3DWindows%2B7%2BHome%2BPremium&p={searchTerms
CHR DefaultSearchURL: Default -> hxxp://srchbar.com/?q={searchTerms}
CHR DefaultSearchKeyword: Default -> sse
CHR DefaultSuggestURL: Default -> hxxp://srch.bar/?s={searchTerms}
CHR HKLM\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\…\Chrome\Extension: [pdpcpceofkopegffcdnffeenbfdldock] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\…\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3101223633-2765994983-3815756064-1000\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3101223633-2765994983-3815756064-1000\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [pdpcpceofkopegffcdnffeenbfdldock] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3101223633-2765994983-3815756064-1000\SOFTWARE\Google\Chrome\Extensions\…\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [mbckjcfnjmoiinpgddefodcighgikkgn] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [nahhmpbckpgdidfnmfkfgiflpjijilce] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [pdpcpceofkopegffcdnffeenbfdldock] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\…\Chrome\Extension: [pilplloabdedfmialnfchjomjmpjcoej] - hxxps://clients2.google.com/service/update2/crx
S3 aswVmm; \??\C:\Users\Tami\AppData\Local\Temp\aswVmm.sys [X] <==== ATTENTION
S3 CtClsFlt; system32\DRIVERS\CtClsFlt.sys [X]
2019-07-16 10:49 - 2019-07-20 20:19 - 000018485 ____H C:\Users\Tami\Desktop\~WRL1445.tmp
2019-07-16 10:49 - 2019-07-16 11:21 - 000018279 ____H C:\Users\Tami\Desktop\~WRL1256.tmp
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers3: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
FirewallRules: [{D822F178-BD08-4B92-9ABC-9243C7AC43BB}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe No File
FirewallRules: [{02E14A49-E136-48FA-97DA-97524D815CD0}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe No File
FirewallRules: [{22F4253E-C7D0-47E1-A97D-F4979988D7E3}] => (Allow) C:\Program Files\dell stage\dell stage\accuweather\accuweather.exe No File
FirewallRules: [{88FBBAB2-B0D7-41B1-9859-D812504B3097}] => (Allow) C:\Program Files\dell stage\musicstage\musicstageengine.exe No File
FirewallRules: [{59CE2640-80C3-4C91-859E-FDA38AE1C06F}] => (Allow) C:\Program Files\dell stage\dell stage\stage_primary.exe No File
FirewallRules: [{7FCBC720-D309-406C-8998-93A2399AE91F}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe No File
FirewallRules: [{5044BBB2-0556-4FA4-A277-14868431FB01}] => (Allow) C:\Program Files (x86)\AVG\AVG2013\avgmfapx.exe No File
FirewallRules: [{5837CAAA-2109-430B-AD3D-2B7620F542DE}] => (Allow) C:\Program Files (x86)\Anvsoft\Syncios\pdt_syncios.exe No File
FirewallRules: [TCP Query User{10BACBE5-047A-45F3-8DE3-09AD8B7C24A6}C:\program files (x86)\premieropinion\pmropn.exe] => (Block) C:\program files (x86)\premieropinion\pmropn.exe No File
FirewallRules: [UDP Query User{B285A22C-A47D-4DAD-A453-E68EE1B19964}C:\program files (x86)\premieropinion\pmropn.exe] => (Block) C:\program files (x86)\premieropinion\pmropn.exe No File
C:\Program Files\Common Files\Bitdefender
C:\Users\Tami\AppData\Roaming\FotoSketcher.ini
C:\Users\Tami\AppData\Local\5678c43253f8bbb5ed82a9.59421958
C:\Users\Tami\AppData\Local\fusioncache.dat
C:\Users\Tami\AppData\Local\resmon.resmoncfg
C:\Program Files\Common Files\mcafee
CMD: ipconfig /flushdns
CMD: ipconfig /release
CMD: ipconfig /renew
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Download and run Tweaking.com - Windows Repair

Please temporarily disable your antivirus.

Download Windows Repair from here and save it to your desktop.

• install and then run the programme
• when it starts, it will check that all its files are present
• when the next window opens,click on the middle tab, ‘Jump to Repairs’
• in the next window click on ‘Open Repairs’, (the programme will make a backup of your registry)
• place a checkmark next to 05, Repair WMI
• click Start
• leave the default selected items as they are and check Restart System When Finished
• now press Start Repairs.

===================================================

Run Malwarebytes Anti-Malware

Please download and run the installer for Malwarebytes 3.0.

• follow the prompts to install the program, (Malwarebytes 3.0 will automatically upgrade Malwarebytes Anti-Malware 2.x to Malwarebytes 3.0)
• run the program
• click on the ‘Dashboard’ to make sure everything is up to date, (it is not necessary to upgrade to the premium version of MBAM)
• click on the ‘Scan’ tab, (directly below the Dashboard tab)
• select the Threat Scan option
• click the Scan Now button
• ’Threat Scan’ will begin
• when the scan has completed and if malware was found, click the Quarantine Selected button to allow MBAM to quarantine what was found
• if prompted to restart the computer, close all other programs and click Yes to restart your computer
• once you are back at your desktop, open MBAM once more
• click on the ‘Reports’ tab
• double-click on the most recent Scan Report
• click on Export, then Copy to Clipboard

Please paste the contents of the clipboard into your next reply.

Logs to include with next post:

Fixlog.txt
Mbam.txt

Thanks

Satchfan

Question, when I do the Tweaking.com - Windows repair……do I ONLY check box #5 for Repair WMI, or do I leave all 33 boxes checked and repair everything?

Remove all the others - we only need 05, Repair WMI

There were many entries marked "delete on reboot". Did you do that? If not, please reboot and run Malwarebytess again and send the new log.

I rebooted it several times and continued to get the notification that it needed to be rebooted.  I reran the program and here is the most recent log.

That looks better.

===================================================

Note: Please complete these tasks in the order given in the instructions.

===================================================

Download and run AdwCleaner

Download AdwCleaner from here and save it to your desktop.

• run AdwCleaner by clicking on Scan Now
• when it has finished, leave everything that was found checked, (ticked), then click on Clean and Repair
• if it asks to reboot, allow the reboot
• on reboot a log will be produced; please attach the content of the log to your next reply.

===================================================

Please run FRST again and make sure there is a checkmark next to ‘Addition.txt’ before you hit Scan.

Logs to include with next post:

AdwCleaner log
New Frst.txt
New Addition.txt

Can you tell me how your computer is now.

Thanks

Satchfan

Hi thoran

I'm afraid a family issue has cropped up and I won't be able to reply until Monday.

There is no threat to your computer, just some issues that are needed to resolve the slowness so there is no need to concern yourslf until I reply.

Apologies for the delay

Satchfan

Thanks for your patience.
 

C:\Users\Tami\Desktop\Fix

You need to stop renaming tools otherwise fixes will not work. Please rename the ‘fix’ file to FRST64.

================================================

Run Farbar Recovery Scan Tool

Open notepad. Please copy the contents of the code box below and paste it into Notepad.

CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-3101223633-2765994983-3815756064-1000\…\Run: [Chromium] => c:\users\tami\appdata\local\chromium\application\chrome.exe [4195328 2017-10-06] (The Chromium Authors) [File not signed]
HKU\S-1-5-21-3101223633-2765994983-3815756064-1000\…\MountPoints2: {21baa9b2-b7cf-11e1-9847-4c80934c276d} - E:\ToolLauncher-Bootstrap.exe
HKU\S-1-5-21-3101223633-2765994983-3815756064-1000\…\MountPoints2: {37ee0435-6edd-11e9-bd6a-4c80934c276d} - E:\VZW_Software_upgrade_assistant.exe
HKU\S-1-5-21-3101223633-2765994983-3815756064-1000\…\MountPoints2: {65ee1464-f310-11e2-a1ea-4c80934c276d} - E:\VZW_Software_upgrade_assistant.exe
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {9DE19BB1-F752-4480-8DBE-96793D7E9A97} - System32\Tasks\Tweaking.com - Windows Repair Tray Icon => C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\WR_Tray_Icon.exe [218336 2017-05-02] (Tweaking LLC -> Tweaking.com)
S2 DellDigitalDelivery; "C:\Program Files (x86)\Dell Digital Delivery\DeliveryService.exe" [X]
2019-07-29 21:11 - 2019-07-29 21:11 - 005198336 _____ (AVAST Software) C:\Users\Tami\Downloads\aswMBR (3).exe
2019-07-29 20:56 - 2019-07-29 20:56 - 000266288 _____ C:\windows\Minidump\072919-40513-01.dmp
2019-07-29 20:56 - 2019-07-29 20:56 - 000262144 _____ C:\windows\Minidump\072919-37502-01.dmp
2019-07-29 20:14 - 2019-07-29 20:14 - 005198336 _____ (AVAST Software) C:\Users\Tami\Downloads\aswMBR (2).exe
FirewallRules: [{D822F178-BD08-4B92-9ABC-9243C7AC43BB}] => (Allow) C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe No File
FirewallRules: [{5837CAAA-2109-430B-AD3D-2B7620F542DE}] => (Allow) C:\Program Files (x86)\Anvsoft\Syncios\pdt_syncios.exe No File
FirewallRules: [{98B940D4-0D20-4530-AABE-11CD9EFF026F}] => (Allow) C:\Users\Tami\AppData\Local\Temp\7zS5A2D\HP.EasyStart.exe No File
FirewallRules: [{B82E7603-E4BE-4A3B-B75F-2073047536E3}] => (Allow) C:\Users\Tami\AppData\Local\Temp\7zS7B54\HPDiagnosticCoreUI.exe No File
FirewallRules: [{7D4C30B2-24C1-4FBE-847D-4DF80B2E6FE2}] => (Allow) C:\Users\Tami\AppData\Local\Temp\7zS7B54\HPDiagnosticCoreUI.exe No File
FirewallRules: [{0C5C3C03-FB18-4E9F-AB7A-D9D5C2FA25D6}] => (Allow) C:\Users\Tami\AppData\Local\Temp\7zS02CC\HPDiagnosticCoreUI.exe No File
FirewallRules: [{F98B8967-CE82-4875-B99D-490EED72234E}] => (Allow) C:\Users\Tami\AppData\Local\Temp\7zS02CC\HPDiagnosticCoreUI.exe No File
C:\Program Files (x86)\Anvsoft
EmptyTemp:

NOTE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

• save the files as fixlist.txt in the same folder as FRST – NOTE: It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work
• run FRST64 then click Fix just once and wait
• it will create a log on your desktop, (Fixlog.txt); please post it to your reply.

================================================

Let’s run an online scan to be sure nothing is left.

Download ESET Online Scanner and save it to your desktop.

• right-click on esetonlinescanner_enu.exe and select Run as Administrator.
• when the tool opens, click Get Started.
• read and accept the license agreement.
• at the Welcome to ESET Online Scanner window, click Get Started.
• select whether you would like to send anonymous data to ESET.
• Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
• click on the Full Scan option.
• select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
• ESET will now begin scanning your computer. This may take some time.
• when the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
• ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature: click on Continue.
• on the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
• open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.

Logs to include with next post:

Fixlog.txt
eset.txt

Thanks

Satchfan