Need help troubleshooting a disk thrashing lockout

[davenk23]

I have a Windows7 64bit system. All Windows and other software is current. Hard drive has been cleaned and defragged. Ckdisk runs clean. Several different Av and malware scans have been run and are clean. Startup programs are at a minimum. Almost every day, the system starts to disk thrash. This will last from 10 to 15 minutes. The disk indicator light is on solid. There is usually only a light load on the system, but there is almost no response. I try to start Performance Monitor, but it does not respond. I try to start Task Manager (clt-alt-delete), but it does not respond. When the thrashing is done, then the monitors appear, too late to help. How can I troubleshoot this?

 

[Britton30]

Welcome to Seven Forums davenk23.

What you describe certainly has the marks of some sort of infection. They can and do, often disable Task Manager. By "thrashing" I assume you mean constant disk read/write activity? Lets try this.

Please download AdwCleaner:
http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner
Save to the desktop.

Close all open programs.
To run the program, right-click AdwCleaner.exe and select: Run as Administrator

Click on Search and confirm the prompt.
After the program finishes, a text file report opens.
Please post the content of the C:\AdwCleaner[Rx].txt in your reply. In the reply window click the "#" icon at the top and paste the log text between the [code ] Paste Here [ /code] tags.

Do NOT perform the delete part before I or someone else can read the log.



To delete:

Run AdwCleaner once again.
This time click on: Delete
When done, please post the content of the C:\AdwCleaner[Sx].txt in your reply as outlined above..

 

[davenk23]

Yes, there is constant disk activity. Not only Task Manager, but all other activity is locked out. As I said, I have run several Av and malware checkers. They all run clean. Any ideas on how to get a monitor going or something to help determine what the disk activity is all about?

 

[Britton30]

Your monitor doesn't work either?
Do the Adwcleaner steps then we can go on.

 

[davenk23]

The software dos not have a valid publisher signature. That is a security risk. Do you have other suggestions on troubleshooting?

 

[Britton30]

No I don't. The software is fine, we use it often here.
You could try this one.
http://www.eset.com/us/online-scanner/

 

[davenk23]

Do you know of other forums that might have expertise in complex troubleshooting?

 

[Britton30]

You can try this one, but they also will recommend ADW and want you to try suggestions.
PC Help Forum

 

[davenk23]

adw cleaner results

I ran the cleaner. Do you see anything that would cause my extreme symptoms?

 

[matts6887]

Have you tried to clean up any and all junk that may be in your system using malwarebytes and or superantispyware? If not; download, install and run the following programs:

SUPERAntiSpyware - Downloading File
https://www.malwarebytes.org/getmbam

 

[Britton30]

You have a lot of "crap" on your system, together they could be causing all the disk activity.
In addition to what Matts suggested, re-do Adwcleaner with the Clean option, and reboot, post the resulting log.

***** [ Files / Folders ] *****
File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk
Folder Found C:\Users\Hanson\AppData\Local\PackageAware
Folder Found C:\Users\Hanson\AppData\Roaming\iWin
***** [ Shortcuts ] *****
 
***** [ Registry ] *****
Key Found : HKCU\Software\AppDataLow\Software\Crossrider
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Found : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Found : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Found : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110011441193}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220022442293}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0004493.BHO
Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0004493.BHO.1
Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0004493.Sandbox
Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0004493.Sandbox.1
Key Found : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055445593}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066446693}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Found : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager
Key Found : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{44444444-4444-4444-4444-440044444493}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441193}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441193}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550055445593}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066446693}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.16521
Setting Found : HKCU\Software\Microsoft\Internet Explorer\Main [Search Bar] - hxxp://search.xetzero.xxx/search?action=minisearch&source=minisearch
Setting Found : HKCU\Software\Microsoft\Internet Explorer\Main [Search Page] - hxxp://my.xetzero.net/s/search?r=minisearch
Setting Found : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [] - hxxp://search.xetzero.xxx/search?action=minisearch&source=minisearch

 

[davenk23]

Post scan results

(Now clean) ADW cleaner log is attached. Also ran the other 2 scans which showed zero errors.
As my original post mentioned, I have run several other scans with "clean" results.
I don't know if I would call the few registry fragments a lot of "crap". Looks like
leftovers from poor uninstalls.

I am still hoping to get some troubleshooting/debugging advice to isolate my
thrashing problem.

 

[Britton30]

***** [ Files / Folders ] *****
[COLOR=red]File Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk[/COLOR]
[COLOR=red]Folder Found C:\Users\Hanson\AppData\Local\PackageAware[/COLOR]
[COLOR=red]Folder Found C:\Users\Hanson\AppData\Roaming\iWin[/COLOR]
***** [ Shortcuts ] *****
 
***** [ Registry ] *****
[COLOR=red]Key Found : HKCU\Software\AppDataLow\Software\Crossrider[/COLOR]
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Found : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Found : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Key Found : HKLM\SOFTWARE\Classes\AppID\secman.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110011441193}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220022442293}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
[COLOR=red]Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0004493.BHO[/COLOR]
[COLOR=red]Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0004493.BHO.1[/COLOR]
[COLOR=red]Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0004493.Sandbox[/COLOR]
[COLOR=red]Key Found : HKLM\SOFTWARE\Classes\CrossriderApp0004493.Sandbox[/COLOR].1

Those in red are what I was mostly concerning with. Is the drive still over reacting? when did you first notice it? Have you updated your BIOs recently?

http://www.sevenforums.com/windows-...n-issue-posting-instructions.html#post1957831

 

[Gandalf]

CCleaner will probably fix you up.
Click <CCleaner> in my Signature.
Here is a tutorial, if you need it.
How to Use CCleaner: 14 Steps - wikiHow

 

[ICIT2LOL]

Mate some system specs would be very handy please as we don't know what we are dealing with here except it is an HP desktop. Info like brands of hard drive and RAM CPU etc would be really good/ If the disk is racing then I guess it would be probably the cause and I would suggest you slip in another drive ands reinstall using this even if it means we can get the monitor to work.
http://www.sevenforums.com/tutorials/180324-system-info-see-your-system-specs.html if you can get it going but a handwritten specs will do.

To do that you will need access to another machine and make an ISO and use this
http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

You could of course do a factory default but it means you lose all data.

By the way does the machine start in safe mode?? - power on tap F8?

 

[gregrocker]

Run a full Malwarebytes scan, declining the free trial upon install, to check for more serious infection. Then run SUPERAntiSpyware (also declining trial and turning off at Startup in prefs) to double-check the spyware and further root out spyware from registry.

Look at your browsers' Add-Ons and Search providers to assure only Google is allowed, disable any Add-Ons other than Flash. In Control Panel>Programs and Features uninstall any Search service, toolbar or add-on you don't need or recognize - ask if in doubt, or provide a screenshot.

In addition I'd work through the other Troubleshooting Steps for Windows 7 starting with running the HD maker's HD Diagnostic extended CD scan followed by a full Disk Check, establishing a Clean Boot, replace the bloated AV with MSE to try one which we know doesn't cause problems. You should find the cause of your problem during one or more of the steps. Report back results as you go if you want additional steps indicated.

 

[Golden]

Have you considered replacing Norton temporarily with MSE......just to test whether Norton is up to something?

 

[Anak]

It would be my opinion that the only troubleshooting davenk23 needs to do is a good scrubbing of his hard drive with an assortment of anti-malware tools to remove the malware on his machine.

Everything listed on his AdwCleaner log including the ones pointed out in red by Britton are either Adware, Pups, Trojans or browser hijackers, and his HDD is trying to keep its head above water with all that thrashing, but it looks as if its fighting a losing battle. Lord only knows what else is on his machine.

Stay away from third-party so called safety-scanners and tweakers. SearchScopes is loaded by just such program types, Windows 7 does not need them but if you really want to try something ask around here first.
Antimalware PC Safety
TROJ_BUZUS.SMUM | Low Risk | Trend Micro Threat Encyclopedia

Depending where secman.DLL is located it can be either good %ProgramFiles%\common files\outlook security manager\secman.dll or bad, AppID\secman.DLL\ can ride in with the Babylon toolbar.

The first one relates to Crossfire and the last three are MediaBack adware:
Key Found : HKLM\SOFTWARE\Classes\CLSID\{11111111-1111-1111-1111-110011441193}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220022442293}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

We need to see if someone from security can help here, this is beyond me.

 

[Britton30]

Derek found something useful, perhaps. check the size of your page file, increase it if it's less than 2GB.

Thrashing (computer science) - Wikipedia, the free encyclopedia

What is thrashing?

When referring to a computer, thrashing or disk thrashing is a term used to describe when the hard drive is being overworked by moving information between the system memory and virtual memory excessively. Thrashing is often caused when the system does not have enough memory, the system swap file is not properly configured, or too much is running on the computer and it has low system resources.
When thrashing occurs, a user will notice the computer hard drive always working and a decrease in system performance. Thrashing is bad on a hard drive because of the amount of work the hard drive has to do and if is left unfixed will likely cause an early failure of the hard drive.

 

[davenk23]

I have run all of the scan/cleaners suggested. They have found no active malware.
My page file is 6-12 GB.
I have attached my configuration.
I have looked for a new BIOS from HP, but their website is not cooperating. Any ideas?

I appreciate most of your suggestions, but some of you are obviously not
reading the problem description and jumping to conclusions. I will ignore any "shotgun approaches" to save
my time on redundant or wild guesses.

To clarify.... 90% of the time the system runs well. When this anomaly starts, any response to commands
are ignored until the highly active hard drive ("thrashing") runs its course (10-15 minutes). I am still hoping for a "rifle" approach to help identify the source of the disk activity.