Windows 10 Delayed Response

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Silverthunder, Nov 3, 2018.

  1. Silverthunder

    Silverthunder Sergeant

    tldr - not sure if my narrative sheds any light on the situation. Feel free to just skip ahead to the logs.

    Windows 10 is exhibiting a delayed response. On my previous install of Windows, I had one of my accounts set up with full admin rights. This is the full admin level, not the default one when you install Windows. Some people recommend having a true admin account, and using it for key tasks. For most tasks, I had a user account that was not even the "lower level" admin. A couple of times I got lazy (didn't feel like logging out of the admin account and into the user account) and I did some web browsing from the admin account. I then noticed some signs of malware and decided to ditch the whole idea of having the admin account and the user account, and did a complete reinstall of Windows 10. I am not sure how serious the malware was.

    Some time after the reinstall (tough to remember but I think 3 or 4 weeks), I ran into some computer problems. When I open a folder shortcut in the taskbar, it's slow to open and while doing so, some of the icons in the taskbar disappear and black/gray space take its place (like how the taskbar would look if there was no shortcut icon there). Once the folder contents do start to display on my monitor, often not everything displays at first, at it slowly loads. Even when/once the computer does display all of the contents, it might take a little longer before the icons for each file show (for example, the gray and red icon for a pdf) Another thing that I notice is that web browsers are slow to open. I haven't use other programs much but the Microsoft Office programs seemed to speed along. However, more recently I have noticed some slowness when starting those up, too. However, looking in the Windows log, it seems like those are a separate issue.

    When I did a stress test on my CPU, within a few minutes the CPU gets to a temperature of 87 degrees. I cleaned out the old thermal paste and I applied new thermal paste. That barely had any effect on the CPU temperatures.

    I have discusses the issue with a couple of people and they think that malware really could be the culprit here. So, I ran the suggested programs for that and I am posting the logs.
     

    Attached Files:

  2. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    Your upload is incomplete - the HitmanPro log and the MGlogs.zip are needed also.
     
  3. Silverthunder

    Silverthunder Sergeant

    I am not sure if the MG logs is a "full" report. I ran MGtools from the desktop and I noticed in the DOS looking window messages something like "access denied." The user access control came up many many times and I kept having to select yes. One time I accidentally clicked no. Also, I got the attached message (see attachment 3). Yet, the program seemed to still want to run its course.
     

    Attached Files:

  4. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    I'm not finding malware to be the cause of your issues.

    Since you are not having any malware problems, it is time to do our final steps:
    1. We recommend you keep Malwarebytes Anti-Malware for scanning/removal of malware.
    2. Re-enable your Disk Emulation software with Defogger if you had disabled it in step 4 of the READ & RUN ME.
    3. Go to add/remove programs and uninstall HijackThis. If you don't see it or it will not uninstall, don't worry about it. Just move on to the next step.
    4. If running Vista, Win 7 or Win 8, it is time to make sure you have re-enabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    5. Now go to the C:\MGtools folder and find the MGclean.bat file. Double click ( if running Vista, Win7, or Win 8 or 10 Right Click and Run As Administrator ) on this file to run this cleanup program that will remove files and folders related to MGtools and some other items from our cleaning procedures.
    6. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
    7. After doing the above, you should work thru the below link:
     
  5. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    One last thing -

    I'm curious about this service that's running ...."ArmouryLiveUpdate.exe" . What can you tell me about it?
    Code:
    O23 - Service: Armoury Live Update (ArmouryLiveUpdate) - Unknown owner - C:\Users\Public\Documents\ArmouryLiveUpdate.exe
     
    Silverthunder likes this.
  6. Silverthunder

    Silverthunder Sergeant

    I am not sure what that is but it's in a directory on my computer Windows\System32\DriverStore\FileRepository\rogms.inf_amd64_db97c0d1dfddabb
     
  7. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    Silverthunder likes this.
  8. Silverthunder

    Silverthunder Sergeant

    I have used a lot of mice/ mice like devices/ keyboards with my computer. I have a few computers that I use and over the last few months I have swapped these accessories around a fair bit. I sometimes notice the devices installing (reinstalling?) themselves on the computers. I have wondered if having so many different devices could cause issues. I hope I can buckle down and have more consistency with which devices a given computer is interacting with. That being said, I might be straying off topic here.

    As for an Asus gaming mouse, I think I did have one a few months ago that I ended up returning. I just tried to find it on the retailers website (I could recognize it if I saw it) but it looks like the retailer doesn't carry that product anymore. It was nice in the sense that there was a good spot where you could rest your ring finger or pinky finger on.

    With regard to what you are saying, are you suspicious that the program is malware, just using a name of a more accepted program? The site that you linked to seems like a good resource.
     
  9. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

    The directory that it's running from makes it suspicious, rather than from "Program Files", as noted by SystemLookup, a reliable resource. If you are no longer using that mouse, get rid of the unnecessary running service.
     
    Silverthunder likes this.
  10. Silverthunder

    Silverthunder Sergeant

    I have it stopped in the task manager startup. I have had it stopped all along since, in troubleshooting the issue, someone else recommended that I stop all of the startup services. Do you think I should delete the directory where the executable seems to be located? FileRepository\rogms.inf_amd64_db97c0d1dfddabb
    (delete the folder named "rogms.inf_amd64_db97c0d1dfddabb")
     
  11. dr.moriarty

    dr.moriarty Malware Super Sleuth Staff Member

  12. Silverthunder

    Silverthunder Sergeant


MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds