Windows Sort of Stops Working From Time to Time

[RC5000]

I previously started a thread about this at:

http://www.sevenforums.com/general-...ermine-what-happens-start-up.html#post3204455

But that's 9 days ago. I apologize if I should NOT start a new thread instead of adding to the old one.

The issue is that from time to time, say at least once an hour or more, certain functions on the computer stop. I cannot access the Internet. I cannot ping. I cannot launch a new application. If I am already in, say, Word, I can continue to edit that file. But of course I cannot print. Originally when this started, it seemed to last as much as 20 minutes. Now it lasts about 1 minute. I've tried to write a batch file which will ping Google endlessly and note the times but that didn't work (it echoed the time, then pinged, then echoed the time, but the time didn't change:

echo off
set i=
FOR /L %%i IN (1,1,3) DO (

echo %time%
ping Google
echo %time%
)

Anyway, a friend of mine who is in IT Support thinks this is an SMM virus. That would be very bad news (I think). I've run MalwareBytes and Kaspersky and also Combofix and they all report no problems.

Does anyone have an idea where to go from here?

As for the ping failure, the cable modem appears to continue to work in that my WiFi is not affected by this.

I am running an app called AirAndroid (just started about 3 days ago, so well after this problem started). And even though just now my session seemed to freeze, this app correctly popped up a message (it does when I get a text message on my phone). So 1) the Internet connection is working and 2) apps can work. Just not when they are initiated by user action.


(10:18AM) And this morning seems much worse. It's happened 6 times (at least), already. The last one at least 4 minutes.)


RON

 

[indianacarnie]

Just a shot in the dark here...... but have you tried running an sfc/scannow to check for any corrupted files? Heres a tutoriaal on how to do that if you haven't before : http://www.sevenforums.com/tutorials/1538-sfc-scannow-command-system-file-checker.html

have you tried a repair install? Theres excellent tutorials on that as well in our tutorial section.

 

[RC5000]

I haven't tried that. I ran a Kaspersky log utility and sent them the log. I noticed that it *seems* that when I run that batch file the system doesn't stop. Just a guess on my part as I can only know this happens from the symptoms. Right now I'm running 2500 pings of google and redirecting the output to a txt file and then examining the times for large jumps, like several minutes and so far haven't found any. When the problem starts, ping doesn't work. In fact user-initiated program start ups do not work. Like I cannot click on anything. The browser (Chrome) is the worst affected but everything is affected.

Again a friend of mine is sure it's some SMM virus but I haven't found a utility that could find a general SMM virus, let alone remove it.

IF for any reason the constant pinging somehow stops this problem then I will set the pings to run permanently. My friend thought the main symptom of the SMM was when I switched users the system went into sleep mode, but I don't see that. Then again, I'm not a sys admin.

 

[indianacarnie]

I would still suggest a system file check. Hey, it doesn't take that long and could help.

Have you tried using Malwarebytes anti-rootkit? https://www.malwarebytes.org/antirootkit/

Eset makes a very good online scanner, if you haven't tried it. Free Virus Scan | ESET Online Scanner | ESET

Thought to tell you the truth I'm not entirely convinced thats the problem yet.

 

[RC5000]

I will try them all!! THANKS!!!! And if I find something interesting I'll definitely report back.

 

[RC5000]

Nothing seems to help

Kaspesky said uninstall one version and install a new one. I did but no help. I thought briefly it might be GWX but today the interruptions happened rather frequently. Almost exactly 3 minutes each time and GWX wasn't running. I rebooted into a regular session but the reboot just sort of hung there, black screen, for a few minutes. So I turned the machine off and back on in Safe Mode with Networking, which I'm in now. That session came up quickly.

I am really at a loss, apart from buying a new computer.

I also note that in Safe Mode, other browsers (like Mozilla) come up rather quickly. When in regular mode, Mozilla can take about 30 sec to a 1 minute to come up.

RON

 

[RC5000]

I ran sfc/scannow. No issues; ran chkdsk; no issues.

Again it seems like the big difference is in normal mode, the problem occurs. Many computer functions are frozen for about 3 minutes; in Safe Mode with Networking, this problem does NOT seem to occur.

RON

Additional info: In Safe Mode, apps come up "normally" fast, like fast. In Normal Mode, they take a long time. Like Firefox, in Safe Mode, it's up and running in like 2 seconds. In normal mode, could be a minute.

 

[DavidE]

I would try a Clean Startup to try and find if it's an auto start program or service causing the problem.
http://www.sevenforums.com/tutorial...ation-conflicts-performing-clean-startup.html

 

[RC5000]

Already done. All services are unchecked except anti-Virus (Kaspersky)

 

[DavidE]

If you haven't tried it yet, you could try MS Sysinternals Process Monitor to see if that can help find what is causing the slowdown.
https://technet.microsoft.com/en-us/sysinternals/bb896645

MS Sysinternals has a suite of MANY utilities
https://technet.microsoft.com/en-us/sysinternals/bb842062

They are "portable" programs, no install needed.

 

[RC5000]

But there are a ton of filters with Procmon. Not sure which ones I should use. Won't any significant data be lost in the torrent of info, like all the tcpip stuff?

 

[DavidE]

I really don't know, it's something you could play with to see if it can help find what causes the delay.
I'm not a Process Monitor expert, I'll ask to see if others can help with using it.

 

[UsernameIssues]

My guess is: you have a bad/flawed/broken installation of Kaspersky.

Just as a test, disconnect from the Internet and uninstall Kaspersky. Then try opening and closing Word every few minutes until you see the lockup or until you are convinced that it is no longer happening. (Maybe you can think of better test - other than opening/closing Word.) If you want, you can temporarily install MSE and spend time online again.


As for Process Monitor:
Since you might need to let Process Monitor run for a relatively long time, set a local backing file.
(Menu bar > Files > Backing Files...)

When you start Process Monitor, you might be shown the filter dialog box. If you see this, press Reset.

Let Process Monitor run while you go about normal usage of the computer. Take note of the time if/when the computer acts up. You can stop the data collection by Process Monitor and work your way up from the bottom of the data looking for anything that jumps out at you. You can stop looking if you get past the time of the lockup. Unfortunately, I cannot tell you what to look for in the data.

You might try the steps above after a clean boot. The fewer things running, the less data to sift thru.

 

[OldGrantonian]

But there are a ton of filters with Procmon. Not sure which ones I should use. Won't any significant data be lost in the torrent of info, like all the tcpip stuff?

I use procmon if my disk LED is flickering constantly. So I'm only interested in disk reads/writes.

Here's what I do.

By default, File > Capture Events is checked.

1. Ctrl+E to stop capture
2. Ctrl+X to clear screen
3. Ctrl+E to restart capture. Count to 10 seconds (or whatever)
4. Ctrl+E to stop capture.

Tools > File Summary tells me everything I need to know.

"By Path" is the default tab. "By Folder" might be more useful.
.

 

[Callender]

Process Monitor logs are huge and hard to decipher. If it doesn't help here's another idea.

Read through this:

Use Windows 7 Event Viewer to track down issues that cause slower boot times - TechRepublic

Create the Custom View in Event Viewer by carefully following the steps mentioned. Then create a second Custom View - details further down the page:

"You'll now repeat these steps and create another Custom View, and this time, you'll type 101-110 in the Includes/Excludes Event IDs box and name it Boot Degradation."

See if you can spot any obvious problems using the Event ID's.

Look for something like this:

   Note

This application took longer than usual to start up, resulting in a performance degradation in the system startup process:

Check mostly Event Id 101 & 102

Investigate and look for anything that stands out and looks as if the time measured in ms is too long.

​

What you might need to look for:

Security software load time issues or driver load time issues.

EDIT:

Reading your first post in this thread again I notice that you say that your original boot time problem is improved. Perhaps you could look back through the dates in Event Viewer logs to see if anything shows up.

 

[RC5000]

An IT technician I know examined the machine yesterday and felt it was severely compromised. He thought, for instance, that recent Windows updates were not installed (or failed) but the log files said otherwise. He wondered about a volume listed under Computer Management-Disk Management. The Volume has no name (like OS (C), but its status is the OEM Partition); it's 39 MB. Also, the name of a laptop I have appeared in a log file for yesterday but the laptop only connects via WiFi. I am not sure what that means.

As another note,it seems that the problem has abated. Since I don't know what causes it or why, a few days ago it happened every few minutes (for about 3 minutes at a time), but today and late yesterday it seems to not occur.

One other thing: Yesterday, Taskmgr showed EFS running. (Encrypting File System). I am not sure why as I did not start it and I am pretty sure I have never seen it before in Taskmgr. I haven't run cipher.exe and never used it. I have Windows 7 Home Premium and never got keys from anywhere.

 

[DavidE]

I have Windows 7 Home Premium and never got keys from anywhere.

If the PC came from Dell with pre-installed Windows 7 it should have a COA sticker.

The COA sticker looks like this:

You need a valid readable COA key (or purchase a new Win 7) to do a clean install of Win 7.

Here is a tutorial for a clean install:
http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

You could also consider a factory recovery.
If you don't have factory recovery media you could contact Dell and see if they can send you recovery media.

 

[RC5000]

That's not a bad idea. I'm sure there's such a sticker on my machine. But if this is an SMM virus, would a clean install make a difference?

 

[DavidE]

That's a good question.
I'm not a security expert so i can't answer.
It would be best to ask that question in a new thread in the Security sub-forum here:
http://www.sevenforums.com/system-security/

You could include a link to this thread so security experts there can see what has been tried so far.

 

[RC5000]

One person answered so far. He didn't think it was a problem.