[Closed] IT help pretty please; suddenly slow laptop?

I prefer malware bytes to spybot these days.
Also have you run Ms configuration and nuked any pointless start up services etc?

Check installed apps and again nuke anything unneeded.

There's guides in optimising win 10 online.. If you've done a big update recently, it may well have reversed any optimisation you've done so far, as they've pushed out a few sneaky updates recently.. Do it may well be worth googling an up to date win 10 tweak guide.

Really appreciate your input. Could you idiots guide Ms configuration for me? I'm very much in the kids paddling pool of IT savviness. I'll try malware bytes, and I'll google win10 optimisation. Cheers.

This flickering blue circle is driving me nuts!

I've got the same issue in the same timeframe. Laptop that was running fine has suddenly started slowing down and the fan runs lots.
I've run some clean up software and checked for malware but not solved anything yet.

Hhmmm ... something must be going on with your system but I am not sure what ...

Calling Cougar!

Calling Cougar!

😯

cyclistm - are you getting the blue circle flicker too? About once a second? It's bloody irritating isn't it? I bet a w10 'update' has buggered our previously fine computers. Grrrrr

Yeah I do. I also think it's related to an upgrade as I can't see its doing anything else

I might be tempted to try a System Restore there.

Then Malwarebytes as suggested. And get rid of AVG, that could be what's causing it.

if fan is running a lot it suggests a cooling issue rather than software. youre not sat with it on you lap are you?

@botk, nope, it's on the kitchen table same as always. I'd think cooling if it was just the fan, but it's the flickering busy cursor at rest that makes me think there's something odd going on.
@Cougar; happy to bin AVG, it is a lot more pop uppy trying to sell you premium than it used to be. What to replace it with though? I'm malware bytesing as I type.

Scan complete; it found 13 'potentially unwanted objects' which I've removed, but no difference. System restore it is then...

Ah. Apparently system protection is turned off, which means I haven't got any restore points to go to. Thanks, Microsoft.

I gave up on avg a few years back as it got a bit demanding on resources for no apparent reason, with pointless real time scanning and other gumph, now I run nothing, or just standard Ms security, but my browsing habits are pretty safe.. If you have teenagers streaming illegal football matches and porn, that's a different story!

What to replace it with though?

Windows Defender will kick in if you remove AVG. Use that.

if fan is running a lot it suggests a cooling issue rather than software.

Yeah, a gummed up air vent can do that. I had it with mine for months, until after umpteen teardowns I finally found a dust bunny the size of my thumb wedged out of sight in one of the cooling ducts.

How old is it? Not terribly I'd guess, given the spec?

Check the resource monitor to see what's using the CPU

http://www.howtogeek.com/school/using-windows-admin-tools-like-a-pro/lesson6/all/

Google for other windows versions.

Use Regedit to check there are no suspicious entries that are starting up is always my first port of call;

[url= http://vlaurie.com/computers2/Articles/startupreg.htm ]Tutorial[/url]

With respect, that's a really bad idea if a) you aren't sure what you're doing and b) trying to follow a tutorial written for Windows XP when you're running Windows 10. By their own admission the OP is "no IT expert"; how does one identify a "suspicious entry"?

You start randomly tearing out anything you don't understand from the Registry and you're going to have a Really Bad Day. And that's before we get into the realms of things like 64-bit Registry Redirection. Things have changed since 2002.

@cougar; it's about a year and a half old, but with light usage. And whilst I may investigate further, I don't think it's cooling duct issues, as previously, it was ridiculously quiet with no fan whatsoever 'at rest'. Now the fan is on and off constantly, even when it's supposedly not doing anything. Plus, if it was a cooling issue, I wouldn't be getting the flickering busy circle would I? Dunno.

I've run the resource monitor as Mol suggested (ta) but nothing is admitting to using the CPU. There is a blue line that says that it's at 137% maximum frequency, but I don't actually understand what that means, so I'll let someone else comment or disregard that.

Windows defender won't kick in. It notifies me that it's turned off, and to click to activate it, so I do and nothing happens. I've gone to its control panel thingy and it is greyed out, but in the on position. I've restarted the machine several times now.

Okay; anyone heard of 'killernetmanager.exe'? It's hammering my network connection and I've never heard of it. I'm watching my network use in real time without any browsers open and I'm seriously considering the prospect of nuking from orbit. WTF is BFNSservice? And why is it using my data? 😯

Apparently both of the above are talking to '007guard.com'. I have no idea what this is but I'm thinking that it does not involve Daniel Craig...

There is a blue line that says that it's at 137% maximum frequency, but I don't actually understand what that means, so I'll let someone else comment or disregard that.

It should be at about 3% or so, low single figures. So yes, something is battering your CPU.

Those things sound like bloatware or something. You can google for the name of an exe and there are loads of sites that tell you what's ok and what's not.

http://www.file.net/process/bfnservice.exe.html

The answer regarding 007guard.com is a little more complex. Maybe open a command prompt and type nslookup, then put in 007guard.com and see what it says. It'll say something like 'response from 1.2.3.4 is 5.6.7.8' - post both of them up.

With respect @cougar the registry keys for checking startup applications is still the same XP/10 nothing has changed since 2002 in that respect. Your reference to win32/win64 application calls is irrelevant to my suggestion.

Entries can easily be googled, I doubt it will be a long list. Its a quick easy way to see what is starting up on your PC. Spyware/Bloatware/Virii are sometimes hidden and do not show under MSConfig hence the need to check the registry.

I stand by that link with its caveat that a restore point is made and a backup is made of any deleted keys.

OP I would say you have definitely been snagged by spyware/bloatware

Mine has been slow with the fan churning like a washing machine for the last week. Then there was a Windows update and now it is OK again.

Don't know if the two are connected.

You haven't stuck a large folder on the desktop, have you? (Can you even do that with the Win8/10??

I stuck a folder on my desktop a while back that contained a memory card dump from one of my cameras, which was getting on for 2Gb.

It massively slowed down my computer - can't remember why, although I did Google it at the time, but Windows (this was on Win7) really doesn't like large items being placed onto the desktop.

Removed the folder from desktop & instantly solved the problem.

There have been a lot of boobytrapped adverts around recently, served by big name websites.

http://www.theregister.co.uk/2016/03/15/massive_us_malvertising_campaign/

That *could* be a cause of slowdowns. Make sure you give your computers a good anti-malware scan and keep apps like Flash and Silverlight up to date if you need to have them installed.

Windows defender won't kick in.

That probably implies that you still have some other AV installed. That or an infection which is blocking it.

anyone heard of 'killernetmanager.exe'? It's hammering my network connection and I've never heard of it. I'm watching my network use in real time without any browsers open and I'm seriously considering the prospect of nuking from orbit. WTF is BFNSservice? And why is it using my data?

Both of these are relating to the Qualcomm network card.

The answer regarding 007guard.com is a little more complex. Maybe open a command prompt and type nslookup, then put in 007guard.com and see what it says. It'll say something like 'response from 1.2.3.4 is 5.6.7.8' - post both of them up.

007guard is a side effect of Spybot's immunisation. It adds a load of 'known bad' sites into your HOSTS file and 007guard is the first alphabetically.

With respect @cougar the registry keys for checking startup applications is still the same XP/10 nothing has changed since 2002 in that respect. Your reference to win32/win64 application calls is irrelevant to my suggestion.

Neither of those statements are correct I'm afraid.

Entries can easily be googled, I doubt it will be a long list. Its a quick easy way to see what is starting up on your PC. Spyware/Bloatware/Virii are sometimes hidden and do not show under MSConfig hence the need to check the registry.

I stand by that link with its caveat that a restore point is made and a backup is made of any deleted keys.

Would've been much more helpful (and less dangerous) to include that in your first post. (-:

OP I would say you have definitely been snagged by spyware/bloatware

I admire your confidence but it's hard to say anything for definite at this point.

Malware is still a possibility of course. Malware often impersonates legit files. So they rename themselves to one of the normal filenames and do their bad shit. The pages that come up when you Google a process often tell you if there are known attacks affecting that file though .

I often find it's simply easier not to question why and just backup your files and reinstall the OS, it's like a new computer again.

Yes, it is always good to be in a position that you can re-install the OS without 'too' much pain, makes sure your backups are healthy.

I've had similar problems recently with win10 updates, leading to 100% disk usage. Googling the problem led me to delete certain apps and settings such as superfetch which has solved the problem (until the next update)

My laptop ran terribly when I upgraded from windows 8 to Window 10. I had loads of issues, performance for starters, it forgot my user account and I couldn't log in. It was shocking. i bought a fresh copy of Windows 10 and reinstalled. it's been great ever since.

Was your Win 10 an upgrade or a fresh install?

i bought a fresh copy of Windows 10 and reinstalled. it's been great ever since.

It's a bit late for you but you can "upgrade" to W10 with a fresh install for free.

aaargh. I really wanted to fix this without starting again, up unti last week I was really quite happy with my setup. Bloody computers.

@cbmotorsport, it was an upgrade from 8, but its been stable and a vast improvement on 8 for months now.

@cougar, re windows defender, I get the notification that says 'computer unprotected, click to start windows defender' which i then do, and nothing happens. This is a bad thing, isn't it? 🙁

Have you still got the log from the MBAM scan? Could you post it here / email it to me?

Is your date / time / timezone set correctly?

Does Windows Update work?

It's a bit late for you but you can "upgrade" to W10 with a fresh install for free.

I bought it through work so free essentially, I also like to have the disc, call me old fashioned!

How very 20th Century of you. (-:

Yes, old skool me.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 15/03/2016
Scan Time: 22:27
Logfile:
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.03.15.07
Rootkit Database: v2016.03.12.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 10
CPU: x64
File System: NTFS
User: Chris

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 406423
Time Elapsed: 6 min, 26 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 11
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\INTERFACE\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}, Quarantined, [7a99abddd5c49b9bd36c23a3768c8080],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}, Quarantined, [8d86ec9c7e1bd1652f105e6823df2ed2],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\INTERFACE\{9B41579A-1996-42F9-8F84-7B7786818CEF}, Quarantined, [8d86ec9c7e1bd1652f105e6823df2ed2],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}, Quarantined, [8d86ec9c7e1bd1652f105e6823df2ed2],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{9B41579A-1996-42F9-8F84-7B7786818CEF}, Quarantined, [8d86ec9c7e1bd1652f105e6823df2ed2],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}, Quarantined, [8d86ec9c7e1bd1652f105e6823df2ed2],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{9B41579A-1996-42F9-8F84-7B7786818CEF}, Quarantined, [8d86ec9c7e1bd1652f105e6823df2ed2],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}, Quarantined, [27ec65233960bb7bb78804c23fc32ad6],
PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}, Quarantined, [73a008802970df573d02e5e1e220da26],
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE, Quarantined, [23f00088e2b7f93dc0d5a3c98e76f30d],
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE, Quarantined, [4bc8c5c38f0a13233c5972fa43c19070],

Registry Values: 2
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, Quarantined, [23f00088e2b7f93dc0d5a3c98e76f30d]
PUM.Optional.DisableChromeUpdates, HKLM\SOFTWARE\WOW6432NODE\POLICIES\GOOGLE\UPDATE|DisableAutoUpdateChecksCheckboxValue, 1, Quarantined, [4bc8c5c38f0a13233c5972fa43c19070]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

(I have no idea what any of that means, and I'm really grateful for all your input)

I've tried to start Defender from 'services', but it tells me;

Error 577: Windows cannot verify the digital signature for this file. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

PUP.Optional.MultiPlug, HKLM\SOFTWARE\CLASSES\INTERFACE\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}, Quarantined, [7a99abddd5c49b9bd36c23a3768c8080],
...
etc.

https://toolslib.net/downloads/viewdownload/1-adwcleaner/

WTactualF? this is a Microsoft product?

Uninstall Spybot and try again.

Removing spybot has allowed Defender to kick in, nice one 😀 I've run adwcleaner; it says it's removed some stuff but I am still getting the busy circle monentarily every second. Any clues on how to get rid of spybot properly? It's left an annoying startup reinstaller that asks me to reinstall every time I boot up. A shame that a program that used to be useful to stop annoyng programs has become what it was designed to combat.

I'm running a 'full scan' on windows defender now; it may take some time... 😯

It's left an annoying startup reinstaller

Windows 10 has a good startup manager - it's one of the tabs in the task manager. You should be able to see in that what's causing spybot to try to reinstall itself, plus anything else that's having an impact. Disable things in there that you don't want by right-clicking them and selecting disable - much safer than registry edits!

Awesome, done, thanks. Would kind of like to bin it completely, mind you. It's proper cheeky isn't it?

A shame that a program that used to be useful to stop annoyng programs has become what it was designed to combat.

I believe this is something to do with a W10 upgrade; the point is that if you've got W7 / W8 installed, you uninstall Spybot before upgrading to W10, then the installer pops up to let you put it back post-install.

Regardless. See here:
https://www.safer-networking.org/faq/prompt-post-windows-10-spybot-install/

You might need to terminate the installer in Task manager first. I think it's called "test" or something equally intuitive. EDIT: or not, if you've killed it in msconfig / startup manager.

Failing that, I've never used it myself but have heard things about Revo Uninstaller. That might kill it.

I am still getting the busy circle monentarily every second.

Is it a HP machine by any chance?

Would kind of like to bin it completely

If you're feeling brave one of the options startup manager gives you is to open the file location. You can then just delete it.

Is it a HP machine by any chance?

Do you want me to take a look at it remotely perhaps, see if I can suss it out?

Cougar, that would be awesome. I'm at a loss, but that's not surprising...

Hang on; you're not from 'Windows security in Mumbai' are you? 😉

It seems that a recent Windows 10 update has been nuking installations of Spybot. You end up with an icon on the desktop to re-install and Spybot *mostly* uninstalled.

What I did was run the installer, let it complete, then did an uninstall. That seems to have done the job nicely.

I just watched this, I hope you have all the MS spyware disabled too!

Cougar's fixed it. Thank you!

Yatta!

For future reference if anyone else happens across this issue: it was the Qualcomm Killer Network Manager app / service.

It's not 100% clear to me what this app does, it appears to be some sort of network configurator which gets side-loaded with the NIC driver. I've since found this (fairly damning) review on [url= http://www.pcgamer.com/motherboards-with-killer-network-adapters-arent-worth-your-money/ ]PC Gamer[/url] which suggests that it's attempting to team together different adapters to increase throughput. When I looked at the app on v8ninety's PC it looked like it was continually cycling through different adapters rather than doing anything useful.

Potentially this could be a compatibility issue between W10 and the driver suite, and there's every chance that there's updated software available for it. However, we couldn't immediately see any benefit to the app, and making changes to the network whilst connected remotely is akin to sawing through a tree branch you're sitting on, so for simplicity we've just disabled it in Services.

From the PCG link there:

Don’t waste your time with the Killer Network Manager or DoubleShot. They cause more problems than they solve.

Bloody typical. Just found this.

https://service.msicomputer.com/msi_user/support/techfaqdetail.aspx?formid=3082

Heh. Typical. Do you reckon it's worth reinstalling to see if it can be made to work properly? Or just keep it binned? I don't see as if it really adds anything to my computing experience; not sure I entirely understand what it does to be honest...

Yeah, TBH I'd be inclined to agree. You could reinstall it and it'd probably work, but that PCG article makes me think you'd be better off without it anyway.

Seems like there are loads of 'network manager' apps that come with every card or manufacturer. Why the f...? Windows manages networks perfectly well, without shitty pop up bollocks installed. Grr...

Yeah. It works in the server world (well, sometimes). Like, the HP network utility lets you team NICs for performance / load balancing / redundancy reasons. On a home machine it just smacks of a branding exercise to me.

It was ever thus, mind. Remember when signing up to an ISP netted you a CD that at best did the square route of Jeff all, and at worst utterly rogered your winsock stack? (I'm looking at you, AOL.) Ditto printer drivers. I've lost count of the number of "yes, but I've got this CD..." conversations I've had with people over the years. Best thing you can do with that is stick it under your coffee cup.

Yes, remember those well!

People clicking on their AOL icon instead of simply dialling up to the internet - resulting in them thinking that AOL was something different and special.

AOL was something different and special.

It was most certainly both of those things, but probably not in the sense you mean.

I remember troubleshooting a slow AOL install one time. Transpired that whilst the Point Of Presence (christ, remember those?) was Manchester, all the web traffic was routed via AOL's servers somewhere in the US (West Coast IIRC). Yeah, you've thought about that one lads.