Pc Apps Slow/freezing/crashing

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by wayne k, Nov 12, 2025.

  1. wayne k

    wayne k Private E-2

    On around Oct 15, I went to a site

    ***Link removed***

    After a few seconds, it produced a prompt - one of those Captcha things with a message something like "Click Allow if you are not a robot." I clicked it a couple times. Then I realized that I shouldn’t have clicked it. The “Click Allow” prompt is no longer on that website.

    Now the problem I’m having is after a few hours, up to a day or two, apps on my PC start getting slow, then freezing, then crashing. The screen goes black, then eventually comes back. I Restart and the cycle begins again.

    I have attached all the logs you requested, except:
    Every time I try to download MGTools in Firefox, I get a file with 0 bytes. I temporarily disabled real time protection in Malwarebytes and Windows Security during the attempted download. I uninstalled Malwarebytes. No help. I tried Edge - I get “MGtools (3).exe can't be downloaded securely”.
     

    Attached Files:

    Last edited by a moderator: Nov 12, 2025
    wayne k, Nov 12, 2025
    #1
  2. wayne k

    wayne k Private E-2

    AdwCleaner log
     

    Attached Files:

    wayne k, Nov 12, 2025
    #2
  3. Oh My!

    Oh My! Malware Expert Staff Member

    Greetings and welcome to the Major Geeks Malware Forum.

    Please allow me some time to review what you have posted.
     
    Oh My!, Nov 12, 2025
    #3
  4. Oh My!

    Oh My! Malware Expert Staff Member

    Greetings.

    I would recommend running AdwCleaner and removing all of the Preinstalled Software.

    I would recommend running Malwarebytes and Windows Security in Side-by-Side mode.

    Are you aware of this program on your computer?

    Please do this.

    ===================================================

    Running Malwarebytes Premium in Side-by-Side Mode

    --------------------

    • Click Start, type Malwarebytes, then select Run as administrator
    • Click Settings
    • Under Windows Security Center turn off Always register Malwarebytes in the Windows Security Center
    • Close Malwarebytes then reboot your computer
    • Click Start, type Windows Security, then click Open
    • Check to see if Windows Defender is Enabled
    ===================================================

    Farbar Recovery Scan Tool Fix

    --------------------
    • Right click on the FRST64 icon and select Run as administrator
    • Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
    • There is no need to paste the information anywhere, FRST64 will do it for you
    Code:
    Start::
CreateRestorePoint:
CloseProcesses:
c:\program files\mcafee
c:\program files\common files\mcafee
c:\program files (x86)\mcafee
c:\program files (x86)\common files\mcafee
C:\DELL\FD09N'c:\programdata\mcafee
Task: {6BCE9944-2FA3-4045-A9B3-C2310110D4DC} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\wayne\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner.exe [21737944 2023-03-26] (ESET, spol. s r.o. -> ESET)
Task: {CD574D96-4203-4790-A03E-AADFAA90514D} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\wayne\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner.exe [21737944 2023-03-26] (ESET, spol. s r.o. -> ESET)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe  (No File) 
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe  (No File) 
Task: {E8114F7C-0859-4760-A058-5700C923874F} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_LogonUpdateResults => %systemroot%\system32\MusNotification.exe  LogonUpdateResults (No File) 
Task: {14F2313E-F130-40CB-A579-81F64B5A7FD0} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC ReadyToReboot (No File) 
Task: {72829A4B-1A4E-4414-B303-6D00ACB037A5} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery ReadyToReboot (No File) 
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (No File) 
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.cpdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [No File] 
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [No File] 
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [No File] 
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [No File] 
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File 
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION 
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION 
2025-11-10 22:09 - 2025-11-10 22:09 - 000377344 _____ C:\Users\wayne\Documents\~WRD1985.tmp 
2020-01-29 19:46 - 2020-01-29 19:46 - 000000171 _____ () C:\Users\wayne\AppData\Roaming\1eb766f2-fed1-4d33-9c39-2c8a972fd11f 
2020-01-29 19:46 - 2020-01-29 19:46 - 000000304 _____ () C:\Users\wayne\AppData\Roaming\4e93aa11-2d46-4980-a421-0a4ac759e5bf 
2020-02-18 11:58 - 2020-02-18 11:58 - 000000171 _____ () C:\Users\wayne\AppData\Roaming\822f02e4-9e9a-4077-a765-71edfca16ad0 
2020-01-29 19:46 - 2020-01-29 19:46 - 000000175 _____ () C:\Users\wayne\AppData\Roaming\fc19ece2-6b3f-4f22-8758-9651ab9ca388 
C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Default\Extensions\callobklhcbilhphinckomhgkigmfocg
C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\banocneifbhefcbiiahbjdaaciccmjke
C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\callobklhcbilhphinckomhgkigmfocg
SearchScopes: HKU\S-1-5-21-3409315567-1698705800-1941238463-1001 -> DefaultScope {567FB402-7351-428E-B932-86AAF28B5D92} URL =
SearchScopes: HKU\S-1-5-21-3409315567-1698705800-1941238463-1001 -> {567FB402-7351-428E-B932-86AAF28B5D92} URL =
cmd: netsh winsock reset catalog
cmd: netsh int ip reset resetlog.txt
Reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg
C:\Firewall.reg
cmd: netsh advfirewall reset
cmd: netsh advfirewall set allprofiles state ON
cmd: bitsadmin /reset /allusers
cmd: ipconfig /flushdns
Removeproxy:
hosts:
cmd: sfc /scannow
cmd: DISM /Online /Cleanup-Image /CheckHealth
Emptytemp:
End::
    • Click Fix
    • When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
    • Note: This step resets your Firewall settings and you may be asked later to grant permission for legitimate programs to pass through the Firewall. If you recognize the program agree to the request.
    • Note: The Emptytemp: command will remove cookies and may result in some websites (like banking) indicating they do not recognize your computer. It may be necessary to receive and apply a verification code.
    • Upon automatic reboot check your computer performance.
    ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
    • Aware of GlanceGuest?
    • Fixlog
    • Computer performance?
     
    Oh My!, Nov 12, 2025
    #4
  5. wayne k

    wayne k Private E-2

    Fix result of Farbar Recovery Scan Tool (x64) Version: 10-11-2025
    Ran by wayne (12-11-2025 15:05:18) Run:1
    Running from C:\Users\wayne\Desktop
    Loaded Profiles: wayne & Administrator
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    Start::
    CreateRestorePoint:
    CloseProcesses:
    c:\program files\mcafee
    c:\program files\common files\mcafee
    c:\program files (x86)\mcafee
    c:\program files (x86)\common files\mcafee
    C:\DELL\FD09N'c:\programdata\mcafee
    Task: {6BCE9944-2FA3-4045-A9B3-C2310110D4DC} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\wayne\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner.exe [21737944 2023-03-26] (ESET, spol. s r.o. -> ESET)
    Task: {CD574D96-4203-4790-A03E-AADFAA90514D} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\wayne\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner.exe [21737944 2023-03-26] (ESET, spol. s r.o. -> ESET)
    Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (No File)
    Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe (No File)
    Task: {E8114F7C-0859-4760-A058-5700C923874F} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_LogonUpdateResults => %systemroot%\system32\MusNotification.exe LogonUpdateResults (No File)
    Task: {14F2313E-F130-40CB-A579-81F64B5A7FD0} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe /RunOnAC ReadyToReboot (No File)
    Task: {72829A4B-1A4E-4414-B303-6D00ACB037A5} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe /RunOnBattery ReadyToReboot (No File)
    Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (No File)
    FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.cpdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [No File]
    FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [No File]
    FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [No File]
    FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\plugins\npFoxitPDFReaderPlugin.dll [No File]
    ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> No File
    HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
    HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
    2025-11-10 22:09 - 2025-11-10 22:09 - 000377344 _____ C:\Users\wayne\Documents\~WRD1985.tmp
    2020-01-29 19:46 - 2020-01-29 19:46 - 000000171 _____ () C:\Users\wayne\AppData\Roaming\1eb766f2-fed1-4d33-9c39-2c8a972fd11f
    2020-01-29 19:46 - 2020-01-29 19:46 - 000000304 _____ () C:\Users\wayne\AppData\Roaming\4e93aa11-2d46-4980-a421-0a4ac759e5bf
    2020-02-18 11:58 - 2020-02-18 11:58 - 000000171 _____ () C:\Users\wayne\AppData\Roaming\822f02e4-9e9a-4077-a765-71edfca16ad0
    2020-01-29 19:46 - 2020-01-29 19:46 - 000000175 _____ () C:\Users\wayne\AppData\Roaming\fc19ece2-6b3f-4f22-8758-9651ab9ca388
    C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Default\Extensions\callobklhcbilhphinckomhgkigmfocg
    C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\banocneifbhefcbiiahbjdaaciccmjke
    C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\callobklhcbilhphinckomhgkigmfocg
    SearchScopes: HKU\S-1-5-21-3409315567-1698705800-1941238463-1001 -> DefaultScope {567FB402-7351-428E-B932-86AAF28B5D92} URL =
    SearchScopes: HKU\S-1-5-21-3409315567-1698705800-1941238463-1001 -> {567FB402-7351-428E-B932-86AAF28B5D92} URL =
    cmd: netsh winsock reset catalog
    cmd: netsh int ip reset resetlog.txt
    Reg: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg
    C:\Firewall.reg
    cmd: netsh advfirewall reset
    cmd: netsh advfirewall set allprofiles state ON
    cmd: bitsadmin /reset /allusers
    cmd: ipconfig /flushdns
    Removeproxy:
    hosts:
    cmd: sfc /scannow
    cmd: DISM /Online /Cleanup-Image /CheckHealth
    Emptytemp:
    End::
    *****************

    Restore point was successfully created.
    Processes closed successfully.
    "c:\program files\mcafee" => not found
    "c:\program files\common files\mcafee" => not found
    "c:\program files (x86)\mcafee" => not found
    "c:\program files (x86)\common files\mcafee" => not found
    "C:\DELL\FD09N'c:\programdata\mcafee" => not found
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{6BCE9944-2FA3-4045-A9B3-C2310110D4DC}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6BCE9944-2FA3-4045-A9B3-C2310110D4DC}" => removed successfully
    C:\WINDOWS\System32\Tasks\EOSv3 Scheduler onLogOn => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EOSv3 Scheduler onLogOn" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CD574D96-4203-4790-A03E-AADFAA90514D}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CD574D96-4203-4790-A03E-AADFAA90514D}" => removed successfully
    C:\WINDOWS\System32\Tasks\EOSv3 Scheduler onTime => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EOSv3 Scheduler onTime" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{077BA067-7C15-40F0-B22E-C9DC2A54B4A2}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{077BA067-7C15-40F0-B22E-C9DC2A54B4A2}" => removed successfully
    C:\WINDOWS\System32\Tasks\Microsoft\Windows\Location\Notifications => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Location\Notifications" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CCDFC0B8-01A3-4E74-A820-4F13F51D269E}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CCDFC0B8-01A3-4E74-A820-4F13F51D269E}" => removed successfully
    C:\WINDOWS\System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{E8114F7C-0859-4760-A058-5700C923874F}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E8114F7C-0859-4760-A058-5700C923874F}" => removed successfully
    C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_LogonUpdateResults => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\MusUx_LogonUpdateResults" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{14F2313E-F130-40CB-A579-81F64B5A7FD0}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{14F2313E-F130-40CB-A579-81F64B5A7FD0}" => removed successfully
    C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Reboot_AC" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{72829A4B-1A4E-4414-B303-6D00ACB037A5}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{72829A4B-1A4E-4414-B303-6D00ACB037A5}" => removed successfully
    C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3E6E7ED-A196-4E44-8803-55FAB3AD4E29}" => removed successfully
    C:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => moved successfully
    "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker" => removed successfully
    HKLM\Software\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.cpdf => removed successfully
    HKLM\Software\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf => removed successfully
    HKLM\Software\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp => removed successfully
    HKLM\Software\Wow6432Node\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf => removed successfully
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00asw => removed successfully
    HKLM\SOFTWARE\Policies\Mozilla => removed successfully
    HKLM\SOFTWARE\Policies\Microsoft\Edge => removed successfully
    C:\Users\wayne\Documents\~WRD1985.tmp => moved successfully
    C:\Users\wayne\AppData\Roaming\1eb766f2-fed1-4d33-9c39-2c8a972fd11f => moved successfully
    C:\Users\wayne\AppData\Roaming\4e93aa11-2d46-4980-a421-0a4ac759e5bf => moved successfully
    C:\Users\wayne\AppData\Roaming\822f02e4-9e9a-4077-a765-71edfca16ad0 => moved successfully
    C:\Users\wayne\AppData\Roaming\fc19ece2-6b3f-4f22-8758-9651ab9ca388 => moved successfully

    "C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Default\Extensions\callobklhcbilhphinckomhgkigmfocg" Folder move:

    C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Default\Extensions\callobklhcbilhphinckomhgkigmfocg => moved successfully

    "C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\banocneifbhefcbiiahbjdaaciccmjke" Folder move:

    C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\banocneifbhefcbiiahbjdaaciccmjke => moved successfully

    "C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\callobklhcbilhphinckomhgkigmfocg" Folder move:

    C:\Users\wayne\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\callobklhcbilhphinckomhgkigmfocg => moved successfully
    "HKU\S-1-5-21-3409315567-1698705800-1941238463-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
    HKU\S-1-5-21-3409315567-1698705800-1941238463-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{567FB402-7351-428E-B932-86AAF28B5D92} => removed successfully

    ========= netsh winsock reset catalog =========


    Sucessfully reset the Winsock Catalog.
    You must restart the computer in order to complete the reset.



    ========= End of CMD: =========


    ========= netsh int ip reset resetlog.txt =========

    Resetting Compartment Forwarding, OK!
    Resetting Compartment, OK!
    Resetting Control Protocol, OK!
    Resetting Echo Sequence Request, OK!
    Resetting Global, OK!
    Resetting Interface, OK!
    Resetting Anycast Address, OK!
    Resetting Multicast Address, OK!
    Resetting Unicast Address, OK!
    Resetting Neighbor, OK!
    Resetting Path, OK!
    Resetting Potential, OK!
    Resetting Prefix Policy, OK!
    Resetting Proxy Neighbor, OK!
    Resetting Route, OK!
    Resetting Site Prefix, OK!
    Resetting Subinterface, OK!
    Resetting Wakeup Pattern, OK!
    Resetting Resolve Neighbor, OK!
    Resetting , OK!
    Resetting , OK!
    Resetting , OK!
    Resetting , OK!
    Resetting , failed.
    Access is denied.

    Resetting , OK!
    Resetting , OK!
    Resetting , OK!
    Resetting , OK!
    Resetting , OK!
    Resetting , OK!
    Resetting , OK!
    Resetting , OK!
    Resetting , OK!
    Resetting , OK!
    Restart the computer to complete this action.



    ========= End of CMD: =========


    ========= reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Defaults\FirewallPolicy\FirewallRules C:\Firewall.reg =========

    The operation completed successfully.


    ========= End of Reg: =========

    C:\Firewall.reg => moved successfully

    ========= netsh advfirewall reset =========

    Ok.



    ========= End of CMD: =========


    ========= netsh advfirewall set allprofiles state ON =========

    Ok.



    ========= End of CMD: =========


    ========= bitsadmin /reset /allusers =========


    BITSADMIN version 3.0
    BITS administration utility.
    (C) Copyright Microsoft Corp.

    0 out of 0 jobs canceled.


    ========= End of CMD: =========


    ========= ipconfig /flushdns =========


    Windows IP Configuration

    Successfully flushed the DNS Resolver Cache.


    ========= End of CMD: =========


    ========= RemoveProxy: =========

    "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
    "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
    "HKU\S-1-5-21-3409315567-1698705800-1941238463-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
    "HKU\S-1-5-21-3409315567-1698705800-1941238463-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
    "HKU\S-1-5-21-3409315567-1698705800-1941238463-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
    "HKU\S-1-5-21-3409315567-1698705800-1941238463-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully
    "HKU\S-1-5-21-3409315567-1698705800-1941238463-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => removed successfully
    "HKU\S-1-5-21-3409315567-1698705800-1941238463-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => removed successfully


    ========= End of RemoveProxy: =========

    C:\Windows\System32\Drivers\etc\hosts => moved successfully
    Hosts restored successfully.

    ========= sfc /scannow =========


    Beginning system scan. This process will take some time.

    Beginning verification phase of system scan.

    Verification 0% complete.
    Verification 1% complete.
    Verification 1% complete.
    Verification 2% complete.
    Verification 2% complete.
    Verification 3% complete.
    Verification 4% complete.
    Verification 4% complete.
    Verification 5% complete.
    Verification 5% complete.
    Verification 6% complete.
    Verification 6% complete.
    Verification 7% complete.
    Verification 8% complete.
    Verification 8% complete.
    Verification 9% complete.
    Verification 9% complete.
    Verification 10% complete.
    Verification 11% complete.
    Verification 11% complete.
    Verification 12% complete.
    Verification 12% complete.
    Verification 13% complete.
    Verification 13% complete.
    Verification 14% complete.
    Verification 15% complete.
    Verification 15% complete.
    Verification 16% complete.
    Verification 16% complete.
    Verification 17% complete.
    Verification 18% complete.
    Verification 18% complete.
    Verification 19% complete.
    Verification 19% complete.
    Verification 20% complete.
    Verification 20% complete.
    Verification 21% complete.
    Verification 22% complete.
    Verification 22% complete.
    Verification 23% complete.
    Verification 23% complete.
    Verification 24% complete.
    Verification 24% complete.
    Verification 25% complete.
    Verification 26% complete.
    Verification 26% complete.
    Verification 27% complete.
    Verification 27% complete.
    Verification 28% complete.
    Verification 29% complete.
    Verification 29% complete.
    Verification 30% complete.
    Verification 30% complete.
    Verification 31% complete.
    Verification 31% complete.
    Verification 32% complete.
    Verification 33% complete.
    Verification 33% complete.
    Verification 34% complete.
    Verification 34% complete.
    Verification 35% complete.
    Verification 36% complete.
    Verification 36% complete.
    Verification 37% complete.
    Verification 37% complete.
    Verification 38% complete.
    Verification 38% complete.
    Verification 39% complete.
    Verification 40% complete.
    Verification 40% complete.
    Verification 41% complete.
    Verification 41% complete.
    Verification 42% complete.
    Verification 43% complete.
    Verification 43% complete.
    Verification 44% complete.
    Verification 44% complete.
    Verification 45% complete.
    Verification 45% complete.
    Verification 46% complete.
    Verification 47% complete.
    Verification 47% complete.
    Verification 48% complete.
    Verification 48% complete.
    Verification 49% complete.
    Verification 49% complete.
    Verification 50% complete.
    Verification 51% complete.
    Verification 51% complete.
    Verification 52% complete.
    Verification 52% complete.
    Verification 53% complete.
    Verification 54% complete.
    Verification 54% complete.
    Verification 55% complete.
    Verification 55% complete.
    Verification 56% complete.
    Verification 56% complete.
    Verification 57% complete.
    Verification 58% complete.
    Verification 58% complete.
    Verification 59% complete.
    Verification 59% complete.
    Verification 60% complete.
    Verification 61% complete.
    Verification 61% complete.
    Verification 62% complete.
    Verification 62% complete.
    Verification 63% complete.
    Verification 63% complete.
    Verification 64% complete.
    Verification 65% complete.
    Verification 65% complete.
    Verification 66% complete.
    Verification 66% complete.
    Verification 67% complete.
    Verification 67% complete.
    Verification 68% complete.
    Verification 69% complete.
    Verification 69% complete.
    Verification 70% complete.
    Verification 70% complete.
    Verification 71% complete.
    Verification 72% complete.
    Verification 72% complete.
    Verification 73% complete.
    Verification 73% complete.
    Verification 74% complete.
    Verification 74% complete.
    Verification 75% complete.
    Verification 76% complete.
    Verification 76% complete.
    Verification 77% complete.
    Verification 77% complete.
    Verification 78% complete.
    Verification 79% complete.
    Verification 79% complete.
    Verification 80% complete.
    Verification 80% complete.
    Verification 81% complete.
    Verification 81% complete.
    Verification 82% complete.
    Verification 83% complete.
    Verification 83% complete.
    Verification 84% complete.
    Verification 84% complete.
    Verification 85% complete.
    Verification 86% complete.
    Verification 86% complete.
    Verification 87% complete.
    Verification 87% complete.
    Verification 88% complete.
    Verification 88% complete.
    Verification 89% complete.
    Verification 90% complete.
    Verification 90% complete.
    Verification 91% complete.
    Verification 91% complete.
    Verification 92% complete.
    Verification 92% complete.
    Verification 93% complete.
    Verification 94% complete.
    Verification 94% complete.
    Verification 95% complete.
    Verification 95% complete.
    Verification 96% complete.
    Verification 97% complete.
    Verification 97% complete.
    Verification 98% complete.
    Verification 98% complete.
    Verification 99% complete.
    Verification 99% complete.
    Verification 100% complete.

    Windows Resource Protection found corrupt files and successfully repaired them.
    For online repairs, details are included in the CBS log file located at
    windir\Logs\CBS\CBS.log. For example C:\Windows\Logs\CBS\CBS.log. For offline
    repairs, details are included in the log file provided by the /OFFLOGFILE flag.


    ========= End of CMD: =========


    ========= DISM /Online /Cleanup-Image /CheckHealth =========


    Deployment Image Servicing and Management tool
    Version: 10.0.26100.5074

    Image Version: 10.0.26200.7171

    The component store is repairable.
    The operation completed successfully.


    ========= End of CMD: =========


    =========== EmptyTemp: ==========

    FlushDNS => completed
    BITS transfer queue => 0 B
    DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 553702380 B
    Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 0 B
    Windows/system/drivers => 57656161 B
    Edge => 0 B
    Chrome => 112822882 B
    Firefox => 534731791 B
    Opera => 0 B

    Temp, IE cache, history, cookies, recent:
    Default => 9216 B
    ProgramData => 9216 B
    Public => 9216 B
    systemprofile => 9216 B
    systemprofile32 => 9216 B
    LocalService => 71260 B
    NetworkService => 459162 B
    wayne => 190281726 B
    defaultuser100000.DESKTOP-3BLPTLN => 190288894 B
    Administrator.DESKTOP-3BLPTLN => 190313860 B

    RecycleBin => 9291957336 B
    EmptyTemp: => 10.4 GB temporary data Removed.

    ================================


    The system needed a reboot.

    ==== End of Fixlog 15:10:07 ====
     
    wayne k, Nov 12, 2025
    #5
  6. wayne k

    wayne k Private E-2

    I would recommend running AdwCleaner and removing all of the Preinstalled Software….Those programs appeared to be Dell Support tools. Since my PC is out of warranty, I clicked Quarantine.

    GlanceGuest version 4.17.1.19
    Are you aware of this program on your computer?.......The only screen sharing I’ve ever done is with Dell Support using their console. Could this be their back-end program?


    Check to see if Windows Defender is Enabled……..Looks like all protection is on, including Real Time protection. “Security at a glance” page shows all icons with “No action needed”. Is that what you mean?


    Upon automatic reboot check your computer performance………It’s good now, but too soon to tell. I should know for sure in four days.


    I keep getting ads popping up on your site. Is that typical?
     
    wayne k, Nov 12, 2025
    #6
  7. Oh My!

    Oh My! Malware Expert Staff Member

    GlanceGuest might have been used by Dell. We should remove it since it was installed for a temporary purpose.

    Windows Defender settings are good.

    Ads are common, I receive them as well.

    We need to run another command to correct some system errors.

    Please do this.

    ===================================================

    Uninstalling Programs Using Revo Uninstaller Free Portable

    --------------------

    • Download Revo Uninstaller Free Portable and save it to your Desktop
    • Right click on the folder and select Extract All..., then click Extract
    • Double click on the RevoUninstaller-Portable folder
    • Right click on RevoUPort and select Run as administrator
    • Click OK on the License Agreement
    • From the list of programs double click on the listed program(s), or anything similar, to remove it (if it exists)
    Code:
    GlanceGuest
    • If the program's uninstaller appears work through the steps to remove the program(s)
    • Be sure the Advanced option is selected then click Scan
    • For each window that may appear identifying leftover items click Select All, Delete, then confirm the deletion
    • Once done click Finish
    • Reboot your computer
    ===================================================

    Farbar Recovery Scan Tool Fix

    --------------------
    • Right click on the FRST64 icon and select Run as administrator
    • Highlight the below information then hit the Ctrl + C keys at the same time and the text will be copied
    • There is no need to paste the information anywhere, FRST64 will do it for you
    Code:
    Start::
cmd: DISM /Online /Cleanup-Image /RestoreHealth
End::
    • Click Fix
    • When completed the tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
    ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
    • GlanceGuest removed?
    • Fixlog
     
    Oh My!, Nov 12, 2025
    #7
  8. wayne k

    wayne k Private E-2

    Fix result of Farbar Recovery Scan Tool (x64) Version: 10-11-2025
    Ran by wayne (12-11-2025 18:26:57) Run:2
    Running from C:\Users\wayne\Desktop
    Loaded Profiles: wayne
    Boot Mode: Normal
    ==============================================

    fixlist content:
    *****************
    Start::
    cmd: DISM /Online /Cleanup-Image /RestoreHealth
    End::
    *****************


    ========= DISM /Online /Cleanup-Image /RestoreHealth =========


    Deployment Image Servicing and Management tool
    Version: 10.0.26100.5074

    Image Version: 10.0.26200.7171


    [== 3.8% ]

    [== 4.8% ]

    [=== 5.7% ]

    [=== 6.7% ]

    [==== 7.7% ]

    [===== 8.7% ]

    [===== 9.7% ]

    [====== 10.6% ]

    [====== 11.6% ]

    [======= 12.6% ]

    [======= 13.6% ]

    [======== 14.6% ]

    [========= 15.5% ]

    [========= 16.5% ]

    [========== 17.5% ]

    [========== 18.5% ]

    [=========== 19.0% ]

    [=========== 19.5% ]

    [=========== 19.7% ]

    [=========== 20.5% ]

    [============ 21.5% ]

    [============= 22.5% ]

    [============= 23.5% ]

    [============== 24.5% ]

    [============== 25.4% ]

    [=============== 26.4% ]

    [=============== 27.4% ]

    [================ 28.3% ]

    [================ 28.4% ]

    [================ 28.4% ]

    [================ 29.1% ]

    [================= 29.7% ]

    [================= 30.4% ]

    [================= 31.0% ]

    [================== 31.4% ]

    [================== 32.2% ]

    [=================== 33.2% ]

    [=================== 34.2% ]

    [==================== 35.2% ]

    [==================== 35.5% ]

    [===================== 36.3% ]

    [===================== 36.4% ]

    [===================== 37.3% ]

    [===================== 37.4% ]

    [====================== 38.1% ]

    [====================== 39.1% ]

    [======================= 40.1% ]

    [======================= 40.8% ]

    [======================== 41.7% ]

    [======================== 42.0% ]

    [======================== 42.5% ]

    [======================== 43.0% ]

    [========================= 43.6% ]

    [========================= 44.6% ]

    [========================== 45.5% ]

    [========================== 45.8% ]

    [========================== 46.2% ]

    [===========================47.2% ]

    [===========================48.2% ]

    [===========================49.1% ]

    [===========================50.1% ]

    [===========================51.1% ]

    [===========================52.1% ]

    [===========================53.0% ]

    [===========================53.1% ]

    [===========================53.1% ]

    [===========================53.1% ]

    [===========================53.2% ]

    [===========================53.5% ]

    [===========================53.6% ]

    [===========================53.7% ]

    [===========================53.7% ]

    [===========================53.8% ]

    [===========================53.9% ]

    [===========================53.9% ]

    [===========================54.0% ]

    [===========================54.0% ]

    [===========================54.1% ]

    [===========================54.2% ]

    [===========================54.2% ]

    [===========================54.3% ]

    [===========================54.3% ]

    [===========================54.5% ]

    [===========================54.6% ]

    [===========================54.6% ]

    [===========================54.7% ]

    [===========================54.7% ]

    [===========================54.8% ]

    [===========================54.9% ]

    [===========================54.9% ]

    [===========================54.9% ]

    [===========================55.0% ]

    [===========================55.0% ]

    [===========================55.1% ]

    [===========================55.2% ]

    [===========================55.2% ]

    [===========================55.2% ]

    [===========================55.3% ]

    [===========================55.3% ]

    [===========================55.4% ]

    [===========================55.5% ]

    [===========================55.5% ]

    [===========================55.7% ]

    [===========================55.8% ]

    [===========================55.9% ]

    [===========================56.0% ]

    [===========================56.2% ]

    [===========================56.2% ]

    [===========================56.3% ]

    [===========================56.5% ]

    [===========================56.5% ]

    [===========================56.5% ]

    [===========================56.6% ]

    [===========================57.1%= ]

    [===========================58.0%= ]

    [===========================59.0%== ]

    [===========================59.4%== ]

    [===========================59.5%== ]

    [===========================59.5%== ]

    [===========================60.0%== ]

    [===========================62.3%==== ]

    [===========================84.9%================= ]

    [==========================100.0%==========================]
    The restore operation completed successfully.
    The operation completed successfully.


    ========= End of CMD: =========


    ==== End of Fixlog 18:29:25 ====
     
    wayne k, Nov 12, 2025
    #8
  9. wayne k

    wayne k Private E-2

    GlanceGuest removed?.....Yes.

    “Lord, to whom shall we go? You have the words of eternal life. We have come to believe and to know that you are the Holy One of God.”.....I agree.
     
    wayne k, Nov 12, 2025
    #9
  10. Oh My!

    Oh My! Malware Expert Staff Member

    Thanks, that last system repair was successful.

    He is the reason I do this.

    Please run Windows Update until there are no more updates available or you receive an error message. If your receive an error, provide the error information in your reply.
     
    Oh My!, Nov 12, 2025
    #10
  11. wayne k

    wayne k Private E-2

    He is the reason I do this....God “will repay each person according to what they have done.” Romans 2:6

    Please run Windows Update ...I have my PC set for Get the latest updates as soon as they're available. Top banner states: "You're up to date."
     
    wayne k, Nov 12, 2025
    #11
  12. Oh My!

    Oh My! Malware Expert Staff Member

    Great.

    Let's monitor things for a few days to see how we are doing. Touch base then, or sooner if something comes up.
     
    Oh My!, Nov 12, 2025
    #12
  13. wayne k

    wayne k Private E-2

    Will do. Thank you.
     
    wayne k, Nov 12, 2025
    #13
  14. wayne k

    wayne k Private E-2

    I just thought: I have an external drive that I plug in once a week to do a backup. Should we scan that for malware? I always leave it unplugged unless I'm doing the backup, at which time all other apps are closed.
     
    wayne k, Nov 12, 2025
    #14
  15. wayne k

    wayne k Private E-2

    Unfortunately the freezing just happened again, with Word and Firefox.
     
    wayne k, Nov 14, 2025
    #15
  16. Oh My!

    Oh My! Malware Expert Staff Member

    My apologies, I was not notified of your post on Wednesday.

    We can run a malware scan on the external drive but I doubt that is the issue.

    Please do this.

    ===================================================

    ESET Online Scanner with Attached External Drive

    --------------------

    Note: You can expect this process to take a long time, up to several hours or more.
    • Download ESET Free Online Scanner and save it to your Desktop
    • Right click on esetonlinescanner.exe and select Run as administrator
    • NOTE: If the program immediately crashes rename esetonlinescanner.exe to ESET.exe and attempt it again
    • Select Computer Scan
    • Click Custom Scan
    • Place a check mark in every drive you wish to scan
    • Click Save and continue
    • Select Enable ESET to detect and quarantine potentially unwanted applications
    • Click Start scan
    • Once completed click View detailed results
    • Review the list of detected items for things you don't want to remove (sometimes Potentially Unwanted Applications)
    • If there entries you would like to keep click Restore cleaned files
    • Place a check mark in each entry you would like to restore then click Restore files then confirm the action
    • Click Finish
    • Save scan log and save it to your Desktop as ESETScan.txt
    • Click Continue then finally click Close
    • Copy and paste the ESETScan.txt file contents in your reply
    ===================================================

    Testing Computer Memory Using MemTest86 USB

    --------------------

    Warning! This step will remove all existing information from your USB device.
    • Download MemTest86 Free for USB and and save it to your Desktop
    • Unzip the folder onto your Desktop
    • Open the memtest86-usb folder
    • Right click on imageUSB.exe and select Run as administrator
    • Insert your USB into your affected computer then click Refresh Drives
    • Place a check mark in the USB drive now listed under Step 1
    • Confirm the image of the downloaded file is listed as Desktop\memtest86-usb\memtest86-usb.img under Step 3
    • Click Write under Step 4, then click Yes twice to confirm
    • Once completed click OK, then Exit
    • Close all open windows
    • Boot your compromised computer to your MemTest86 USB device
    • Allow the program to load, start automatically and complete the 4 passes. This process may take some time to complete
    • Report the results of the test
    ===================================================

    Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it.
    • ESETScan report
    • Memtest results
     
    Last edited: Nov 16, 2025
    Oh My!, Nov 15, 2025
    #16
  17. wayne k

    wayne k Private E-2

    Since it takes that long, I'll start it before I go to bed this evening. I assume it's best that I not be running anything else while the scan is going on. Is that right?
     
    wayne k, Nov 16, 2025
    #17
  18. Oh My!

    Oh My! Malware Expert Staff Member

    Correct.
     
    Oh My!, Nov 16, 2025
    #18
  19. wayne k

    wayne k Private E-2

    Warning! This step will remove all existing information from your USB device..........There is a file on there that I need.
     
    wayne k, Nov 16, 2025
    #19
  20. Oh My!

    Oh My! Malware Expert Staff Member

    Transfer the file to your Desktop then once we are done you can transfer it back.
     
    Oh My!, Nov 16, 2025
    #20
  21. wayne k

    wayne k Private E-2

    Will do.
    ESET...What I have is not matching your instructions.
    1. File is called esetonlinescanner.exe.
    2. First page does not contain the items you are referring to.
    Please see screen shot.
     

    Attached Files:

    wayne k, Nov 16, 2025
    #21
  22. Oh My!

    Oh My! Malware Expert Staff Member

    Sorry about that. Sometimes it is hard to keep up with program changes :(

    I updated the instructions. If there are other differences let me know.
     
    Oh My!, Nov 16, 2025
    #22
  23. wayne k

    wayne k Private E-2

    ESET - there is no Custom Scan option. See screen shot.
    I left it on the main screen and when I came back it looks like it ran on its own. The message stated "no threats detected" , yet there was one item in Quarantine which I have attached a screen shot of.
     

    Attached Files:

    wayne k, Nov 16, 2025
    #23
  24. Oh My!

    Oh My! Malware Expert Staff Member

    That looks like a prior detection.

    Click Computer Scan and you should be presented with the Custom Scan option.
     
    Oh My!, Nov 17, 2025
    #24
  25. wayne k

    wayne k Private E-2

    ESET found nothing. See attached.

    MemTest86 - I got to this step (below) in the How To Boot instructions and I got no messages. I had the usual swirly blue and white Windows screen. I pressed a key, entered my password, and got in as usual.
    Restart your computer and wait for that first screen to pop up. Often, it’ll say something like “Press F12 to Choose Boot Device” somewhere on the screen—the requested function key could vary depending on your machine. Press that key now.
     

    Attached Files:

    wayne k, Nov 18, 2025
    #25
  26. Oh My!

    Oh My! Malware Expert Staff Member

    Glad we got through ESET. Your external drive is clean.

    There are various ways to get to where we want to be depending on operating systems and individual computers. I modified the instructions to hopefully make the steps more universal. No need to recreate the USB.

    Please attempt this.

    ===================================================

    Testing Computer Memory Using MemTest86 USB

    --------------------

    Warning! This step will remove all existing information from your USB device.
    • Download MemTest86 Free for USB and and save it to your Desktop
    • Unzip the folder onto your Desktop
    • Open the memtest86-usb folder
    • Right click on imageUSB.exe and select Run as administrator
    • Insert your USB into your affected computer then click Refresh Drives
    • Place a check mark in the USB drive now listed under Step 1
    • Confirm the image of the downloaded file is listed as Desktop\memtest86-usb\memtest86-usb.img under Step 3
    • Click Write under Step 4, then click Yes twice to confirm
    • Once completed click OK, then Exit
    • Close all open windows
    • Hit the Windows Key + R at the same time
    • Copy and paste shutdown /r /o /f /t 0 after the command prompt then hit Enter to restart your computer
    • Select Use a device
    • Select USB HDD:
    • Allow the program to load, start automatically and complete the 4 passes. This process may take some time to complete
    • Report the results of the test
    ===================================================

    Things I would like to see in your next reply.
    • Results
     
    Oh My!, Nov 18, 2025
    #26
  27. wayne k

    wayne k Private E-2

    My external drive was not connected. You had that in the original instructions then they were gone after you modified it. You originally had:
    "While holding down the Shift Key attach your external drive."

    Only my flash drive was connected.

    Sorry if I misunderstood.
     
    wayne k, Nov 18, 2025
    #27
  28. Oh My!

    Oh My! Malware Expert Staff Member

    I confused things. Sorry about that.

    Hold down the Shift Key and attach whatever drive you want to scan.
     
    Oh My!, Nov 18, 2025
    #28
  29. wayne k

    wayne k Private E-2

    ESET scan of backup drive completed. No threats detected. Now on to MemTest86 USB.
     
    wayne k, Nov 19, 2025
    #29
  30. wayne k

    wayne k Private E-2

    Reminder that I tried to run memtest86-usb on that flash drive. So now when I plug it in, File Explorer shows two drives - D and F. Same with memtest86. I guess I check that box at the top for HP v125w, right?
     

    Attached Files:

    wayne k, Nov 19, 2025
    #30
  31. Oh My!

    Oh My! Malware Expert Staff Member

    While in File Explorer right click on USB Drive (D: ) then select Format
    Leave the Default settings and click Start
    If formatting was successful attempt to run the Memtest steps again
    If it does not format or still shows multiple drive letters stop and let me know
     
    Oh My!, Nov 20, 2025 at 9:32 AM
    #31
  32. wayne k

    wayne k Private E-2

    D Format appeared to be successful. No errors. In File Explorer, the contents side states "This folder is empty." However, D and F still appear in File Explorer as well as Memtest. See attached.
     

    Attached Files:

    wayne k, Nov 20, 2025 at 8:55 PM
    #32
  33. Oh My!

    Oh My! Malware Expert Staff Member

    I'm not comfortable with those results.

    Please format the USB using the below instructions.

    ===================================================

    Formatting USB Using Diskpart

    --------------------
    • Attach the USB drive to your computer
    • Click Start, type cmd, then select Run as administrator
    • Type diskpart then hit Enter
    • Type list disk then hit Enter
    • Identify the Disk number representing the USB drive (I will use Disk 1 as an example but use the Disk number you identify)
    • Type select disk 1 then hit Enter
    • Type clean then hit Enter
    • Close the File Explorer window
    • Type create partition primary then hit Enter
    • Type format fs=fat32 quick then hit Enter
    • Once successfully formatted type Exit then hit Enter
    • Attempt to create the Memtest USB
    ===================================================

    Things I would like to see in your next reply.
    • Results
     
    Oh My!, Nov 20, 2025 at 10:01 PM
    #33
  34. wayne k

    wayne k Private E-2

    See attached.
     

    Attached Files:

    wayne k, Nov 20, 2025 at 10:20 PM
    #34
  35. Oh My!

    Oh My! Malware Expert Staff Member

    There are a few possible causes for this error, including the USB going bad. Do you have another USB drive you can use?
     
    Oh My!, Nov 20, 2025 at 10:27 PM
    #35
  36. wayne k

    wayne k Private E-2

    I used another USB drive. BTW, none of the USB ports on the front of my PC would recognize any flash drive. I tried a couple different drives. I had to put it in a port in the rear. It's been a long time since I put a flash drive in the front, so maybe it's been like that for some time. My PC does recognize my external (backup) drive from a front port.

    On to your instructions in post #26. I got to:
    Copy and paste shutdown /r /o /f /t 0 after the command prompt then hit Enter to restart your computer

    The computer powered back on but would not wake up from me moving the mouse or pressing keys. I had to power it off and back on again to get it to wake up. This is not unusual. If there is a sudden power outage at my house, I go through the same routine. I entered my PIN and it brought me to my desktop as usual. No prompt for "Select Use a device".
     
    wayne k, Nov 21, 2025 at 10:28 AM
    #36
  37. Oh My!

    Oh My! Malware Expert Staff Member

    Boy oh boy, we are having a time of it!

    Let's use another memory test method, although it is not my first pick. Please do this.

    ===================================================

    Windows Memory Diagnostics

    --------------------
    • Click Start, type mdsched, then select Run as administrator
    • Select Restart now and check for problems (recommended)
    • Following the completion of the test your system will reboot
    • Complete the below instructions
    ===================================================

    Event Viewer - System Information

    --------------------
    • Press Windows Key + R at the same time
    • Type eventvwr.msc and press Enter
    • Click on the arrow to the left of Windows Logs to expand the category
    • Left click on System
    • On the right side click Save All Events As...
    • Under File Name: please type System then save it to your desktop
    • Please zip and upload the file to GoFile or the file hosting site of your choice and post the download link in your reply.
    ===================================================

    Things I would like to see in your next reply.
    • Memory Diagnostics run?
    • Download link
     
    Oh My!, Nov 21, 2025 at 10:40 AM
    #37
  38. wayne k

    wayne k Private E-2

    Under File Name: please type System then save it to your desktop....
    Now which option do I pick? Please see attached. My guess is "Display Information" but want to make sure.
     

    Attached Files:

    wayne k, Nov 21, 2025 at 11:37 AM
    #38
  39. Oh My!

    Oh My! Malware Expert Staff Member

    Click OK on that screen with No display information selected.
     
    Oh My!, Nov 21, 2025 at 2:13 PM
    #39
  40. wayne k

    wayne k Private E-2

    wayne k, Nov 21, 2025 at 4:49 PM
    #40
  41. Oh My!

    Oh My! Malware Expert Staff Member

    Thank you.

    Your memory passed.

    Please run a new FRST Scan and attach the reports to your reply. Also, update me on whether or not your computer is continuing to freeze.
     
    Oh My!, Nov 21, 2025 at 8:13 PM
    #41
  42. wayne k

    wayne k Private E-2

    Please run a new FRST Scan and attach the reports to your reply. ...Done
    Also, update me on whether or not your computer is continuing to freeze....I think after four days we will know for sure.
     

    Attached Files:

    wayne k, Nov 22, 2025 at 5:35 AM
    #42
  43. Oh My!

    Oh My! Malware Expert Staff Member

    The reports look good. Let me know if you experience system freezing or crashing.
     
    Oh My!, Nov 23, 2025 at 9:03 AM
    #43
  44. wayne k

    wayne k Private E-2

    Thank you. Will do.
    Can you help me with my USB port problem, i.e. the front ones won't recognize flash drives?
     
    wayne k, Nov 24, 2025 at 12:43 PM
    #44
  45. Oh My!

    Oh My! Malware Expert Staff Member

    Let's see if we have resolved the freezing/crashing issue first then we will tackle the USB ports.

    While we wait, please run this so I can gather some system information.

    ===================================================

    System Summary Information

    --------------------

    • Press the Windows Key + R at the same time
    • Type msinfo32 then select Run as administrator
    • Left click on System Summary
    • Click File, Save, name the file Summary and save it to your Desktop
    • Zip and attach the file to your reply
     
    Oh My!, Nov 24, 2025 at 3:28 PM
    #45
  46. wayne k

    wayne k Private E-2

    Type msinfo32 then select Run as administrator...."Run as administrator" did not appear. The System Information window just opened.

    ***File deleted***
     
    Last edited by a moderator: Nov 25, 2025 at 1:05 PM
    wayne k, Nov 25, 2025 at 11:12 AM
    #46

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds