Re-Open Issue with Laptop. Was resolved, but back to poor performance. Did something reinstall?

[Peccant]

Hi @Malnutrition. Our previously resolved case of the slow HP Pavilion Gaming Laptop seems to have re-occured when I returned to the office after vacation. I'm now wondering if there is something sitting on one of my three external HD backups that, when I plugged back in, whatever was slowing my computer before may have re-installed? I don't even know if that is a thing, but where we had the laptop working like a rocket, it's now back to slow performance to the point I can barely use Sage 50 Accounting to post entries.

Should this be re-opened here or should I try a different forum board?

 

[Malnutrition]

We can check here first, then move the thread if needed.

Download Autologger to your desktop.
Disable your Anitivirus/Defender prior to running.

• Unzip it there. -- If you are unsure how to unzip a program, then use ---- http://www.7-zip.org/ ----
• Right click Autologger and run as administrator. (Xp user double click)
• AVZ4 will open and scan your machine, allow this to complete.
• Upload Collectionlog.zip to your next reply.

---

Please download the FRST 32 bit or FRST 64bit version to suit your operating system. It is important FRST is downloaded to your desktop.
If you are unsure if your operating system is 32 or 64 Bit please go HERE.
Once downloaded right click the FRST desktop icon and select "Run as administrator" from the menu
If you receive any security warnings, or the User Account Control warning opens at any time whilst using FRST you can safely allow FRST to proceed.
FRST will open with two dialogue boxes, accept the disclaimer.

1. Accept the default whitelist options,
2. If the additions.txt options box is not checked please select it.
3. Then select Scan
4. Frst will take a few minutes to scan your computer, and when finished will produce two log files on your desktop, FRST.txt, and Addition.txt. They will display immediately on the desktop, but can be reopened later as a notepad file.

Please Attach the contents of these logs in your next post for review by our Security Team

 

[Peccant]

Thanks a lot. Here are the logs.

 

[Malnutrition]

Disable these scheduled task, as they only eat resources, you can update these programs manually.
Download TaskSchedulerView (64-bit) Unzip it to the desktop.
Right click and run as admin!!
Seek out and disable each of the task below.
Also, disable anything else you see that is not of use to you.

C:\WINDOWS\system32\tasks\Adobe Creative Cloud
C:\WINDOWS\system32\tasks\AdobeGCInvoker-1.0
C:\WINDOWS\system32\tasks\GoogleUpdateTaskMachineCore
C:\WINDOWS\system32\tasks\GoogleUpdateTaskMachineUA
C:\WINDOWS\system32\tasks\MicrosoftEdgeUpdateTaskMachineCore
C:\WINDOWS\system32\tasks\MicrosoftEdgeUpdateTaskMachineUA
C:\WINDOWS\system32\tasks\NvDriverUpdateCheckDaily_\NvContainerDriverUpdateCheck.log
C:\WINDOWS\system32\tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} -
C:\WINDOWS\system32\tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
C:\WINDOWS\system32\tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
C:\WINDOWS\system32\tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
C:\WINDOWS\system32\tasks\NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
C:\WINDOWS\system32\tasks\NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
C:\WINDOWS\system32\tasks\NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
C:\WINDOWS\system32\tasks\NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
C:\WINDOWS\system32\tasks\OneDrive Reporting Task-S-1-5-21-1586263983-1164605689-3317866451-1001
C:\WINDOWS\system32\tasks\OneDrive Reporting Task-S-1-5-21-1586263983-1164605689-3317866451-1004
C:\WINDOWS\system32\tasks\OneDrive Standalone Update Task-S-1-5-21-1586263983-1164605689-3317866451-1001
C:\WINDOWS\system32\tasks\OneDrive Standalone Update Task-S-1-5-21-1586263983-1164605689-3317866451-1004
C:\WINDOWS\system32\tasks\OneDrive Standalone Update Task-S-1-5-21-1586263983-1164605689-3317866451-500
C:\WINDOWS\system32\tasks\OneDrive Standalone Update Task-S-1-5-21-1785876445-2331437723-178080249-500
C:\WINDOWS\system32\tasks\OneDrive Standalone Update Task-S-1-5-21-3948449565-1973883119-2500807518-500
C:\WINDOWS\system32\tasks\OneDrive Standalone Update Task-S-1-5-21-913737145-1433743232-4147240673-500
C:\WINDOWS\system32\tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Update Notice -
C:\WINDOWS\system32\tasks\Hewlett-Packard\HP Support Assistant\HP Support Solutions Framework Report
C:\WINDOWS\system32\tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker
C:\WINDOWS\system32\tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan -
C:\WINDOWS\system32\tasks\Microsoft\Windows\Customer Experience Improvement Program\Consolidator

---

Download ClearLNK utility
Unzip it to your desktop.
Right click run as admin.
Copy and paste the two lines below in red into the UI of the program, and then hit cure.

>>> "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP Audio Switch.lnk" -> ["C:\Program Files (x86)\HP\HPAudioSwitch\HPAudioSwitch.exe"]
>>> "C:\Users\Mark Wainman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitTorrent Web.lnk" -> ["C:\Users\Mark Wainman\AppData\Roaming\BitTorrent Web\btweb.exe"]

---

Run HijackThis! as admin! (located in the folder ...Autologger\HijackThis)
Do a system scan, then check each item below, make sure and only check the items listed!!
Then click Fix checked.
The computer will need to reboot, allow it to do so.

O2 - HKLM\..\BHO: (no name) - AutorunsDisabled - (no file)
O2-32 - HKLM\..\BHO: (no name) - AutorunsDisabled - (no file)
O4 - HKLM\..\SafeBoot: [AlternateShell] = (no file) (disabled)
O9 - Button: HKLM\..\AutorunsDisabled: (no name) - (no file)
O9-32 - Button: HKLM\..\AutorunsDisabled: (no name) - (no file)
O15 - Trusted Zone: *.localhost
O15 - Trusted Zone: https://rddunhamca-files.sharepoint.com
O15 - Trusted Zone: https://rddunhamca-myfiles.sharepoint.com
O15 - Trusted Zone: https://sequelsfashion-files.sharepoint.com
O15 - Trusted Zone: https://sequelsfashion-myfiles.sharepoint.com
O21 - HKLM\..\ShellIconOverlayIdentifiers\AutorunsDisabled: (no name) - - (no file)
O22 - Tasks: (disabled) Adobe Creative Cloud - "C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe --showwindow=false --onOSstartup=true (file missing)
O22 - Tasks_Migrated: \Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser - C:\WINDOWS\System32\MbaeParserTask.exe (file missing)
O22 - Tasks_Migrated: Adobe Creative Cloud - "C:\Program Files\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe --showwindow=false --onOSstartup=true (file missing)
O22 - Tasks_Migrated: HPAudioSwitch - C:\Program Files (x86)\HP\HPAudioSwitch\HPAudioSwitch.exe (file missing)

---

Copy the content of the code box below.
Do not copy the word code!!!
Right Click FRST and run as Administrator.
Click Fix once (!) and wait. The program will create a log file (Fixlog.txt).
Attach it to your next message.
Two Zipped folders will appear on your desktop, attach those as well.

Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
RemoveProxy:
HKLM\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
HKU\S-1-5-21-1586263983-1164605689-3317866451-1004\SOFTWARE\Policies\Microsoft\Edge: Restriction <==== ATTENTION
S4 HP Comm Recover; "C:\Program Files\HPCommRecovery\HPCommRecovery.exe" [X]
VirusTotal: C:\WINDOWS\system32\nlansp_c.dll
File: C:\WINDOWS\system32\nlansp_c.dll
Zip:C:\Program Files (x86)\LMIR0CCBA001.tmp_r.bat
Zip:C:\Program Files (x86)\LMIR0CCBA001.tmp.bat
C:\Users\Mark Wainman\Downloads\DriverEasy_Setup.exe
C:\Users\Mark Wainman\AppData\Roaming\Easeware
FirewallRules: [{F7535B92-5120-494A-9012-D4F48906263A}] => (Allow) C:\Users\Mark Wainman\AppData\Roaming\Zoom\bin\airhost.exe => No File
FirewallRules: [{9204B6FD-E9D6-4C96-A37A-AB3AF3C10281}] => (Allow) C:\Users\Mark Wainman\AppData\Roaming\Zoom\bin\airhost.exe => NoFile
sc stop sysmain
sc config sysmain start= disabled
sc stop DiagTrack
sc config DiagTrack start= disabled
sc stop dmwappushservice
sc config dmwappushservice start= disabled
sc stop lfsvc
sc config lfsvc start= disabled
cmd: netsh winsock reset catalog
cmd: netsh int ip reset C:\resettcpip.txt
cmd: net stop bits
Move: C:\ProgramData\Microsoft\Network\Downloader\qmgr*.db C:\ProgramData\Microsoft\Network\Downloader\qmgr*.db.old
cmd: net start bits
cmd:  bitsadmin /list /allusers
CMD: "%WINDIR%\SYSTEM32\lodctr.exe /R"
CMD: "%WINDIR%\SysWOW64\lodctr.exe /R"
CMD: "C:\Windows\SYSTEM32\lodctr.exe /R"
CMD: "C:\Windows\SysWOW64\lodctr.exe /R"
CMD: del /f /s /q %windir%\prefetch\*.*
CMD: del /s /q C:\Windows\SoftwareDistribution\download\*.*
CMD: del /s /q "%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cache\*.*"
cmd: del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\*.*"
cmd: del /s /q "%userprofile%\AppData\Local\Opera Software\Opera Stable\Cache\Cache_Data\*.*"
CMD: del /s /q "%userprofile%\AppData\Local\temp\*.*"
CMD: ipconfig /flushdns
C:\Windows\Temp\*.*
C:\WINDOWS\system32\*.tmp
C:\WINDOWS\syswow64\*.tmp
ExportKey: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions
emptytemp:
Reboot:
End::

 

[Peccant]

completed. To avoid adding more variables to this fix, I'm going to leave my laptop at work for the evening and will continue with next steps when I return in the morning.

Thank you

 

[Malnutrition]

Ok, do you use a cooling pad for your laptop? If not you should definitely be using one, no matter what a laptop needs a cooling pad, especially when using CPU intensive programs. Or just in general...

Something like this would be optimal!

https://www.amazon.com/IETS-Powerful-Turbo-Fan-Infinitely-13-17-3inch/dp/B09B7CWT63?th=1

There are cheaper models available, depends on how much you want to spend, but this is something IMO you should not buy bargain.

The best laptop cooling pads of 2024: Expert tested

We went hands-on with some of the best laptop cooling pads that keep your computer running cool. Here are our top picks.

www.zdnet.com

• Disable your antivirus/defender prior to downloading.
• Please download Core Temp and save it to your desktop
• If you receive a warning the file is malicious you can ignore the warning and download the file anyway
• Right click on the icon and select Run as administrator
• Select I accept the agreement
• Uncheck every item except for Create a desktop shortcut then click Next
• Click Install then Next
• Uncheck View Readme.txt then click Finish
• Now screen shot the temps when you are using the computer normally.
• Attach the screen shot here.

---

I want you to run this tool under normal operation please: I.E. All programs you use during normal day Sage Etc...
Download Process Explorer.
Unzip to your desktop.
Right click and run as admin.
Go to options.
Virus Total.
Make sure Check At virusTotal is ticked.
Now screen shot everything, no matter how many screen shots it takes, upload them all here so that I can see everything.
We will see what is chewing up resources with this tool.

---

Kaspersky Virus Removal Tool

• Download Kaspersky Virus Removal Tool and save it to your Desktop
• Hit the Windows Key + R at the same time
• Drag and drop the KVRT icon on your Desktop into the Run box to the right of Open:
• Add -dontencrypt so that it looks like C:\Users\**Your User Name***\Desktop\KVRT.exe -dontencrypt (with a space between .exe and "-")
• 
• Click OK
• Review and place check marks in all 3 I confirm boxes then click Accept
• Click Change parameters
• Place check marks in the following categories:
• System memory
• Startup objects
• Boot sectors
• System drive
• Click OK
• Click Start scan
• When completed click Continue
• Close the program
• Hit the Windows Key + E at the same time
• Navigate to the C:\KVRT2020_Data\Reports folder
• Right click on KLR File which looks similar to report_2022.09.12_06.27.09 and select Open
• Copy and paste the contents of the file in your reply

---

Copy the content of the code box below.
Do not copy the word code!!!
Right Click FRST and run as Administrator.
Click Fix once (!) and wait. The program will create a log file (Fixlog.txt).
Attach it to your next message.

Start::
Startbatch:
sc stop sysmain
sc config sysmain start= disabled
sc stop DiagTrack
sc config DiagTrack start= disabled
sc stop dmwappushservice
sc config dmwappushservice start= disabled
sc stop lfsvc
sc config lfsvc start= disabled
EndBatch:
End::

 

[Peccant]

I got as far as Kaspersky but cannot find the free virus removal download. Is one of their free trial packages what I should be downloading? I will complete the rest of the list in order once I hear back. Screenshots from the first steps are attached.

 

[Peccant]

Oh, and I'm looking into cooling pads. I do not currently use one.

 

[Malnutrition]

Free Virus Removal Tool | Free Virus Scanner and Cleaner | Kaspersky

Click here to download free virus removal tool from Kaspersky. Protect yourself from malware, viruses and cyber threats.

www.kaspersky.com

Kaspersky link. I’ll check everything else when I get home from work.

 

[Peccant]

Thanks, keeps bringing me to the French Kaspersky page - I've clicked your link and typed it out manually but it keeps autodirecting.

 

[Malnutrition]

K. I’ll have to take care of that after work: It will be 7 o’clock tonight eastern time.

 

[Peccant]

No problem, thanks. I'll check it first thing in the morning. Should I move ahead with the other steps of your instructions or keep them in order once we have Kaspersky figured out?

 

[Malnutrition]

Finish whatever you can. And if you want, go to yandex.com and search for the kaspersky tool. May have Better luck.

 

[Malnutrition]

@Peccant Here it is Zipped and uploaded for you, Click here to download KVRT. Alternate link is here. Just need to unzip to your desktop.

Your computer seems to be handling the apps that are running just fine. System Idle process is running at 89 percent which means you could be running a lot more programs with ease on this machine.

---

Windows Key and R at the same time.
Type or Copy and paste powercfg.cpl
Hit OK
Set your laptop to high performance.
Or Ultimate Performance if that option is available.

---

Let's unpark all of the cores on your computer to see if we can free up some performance.

Press Windows Key + R to open the Run dialog box. Type in 'Regedit' in the text field and hit Enter
Then click Edit >>> Find.
Now type (copy and paste) the following code in the text field (without the quotes): “ 0cc5b647-c1df-4637-891a-dec35c318583 ” and click on ‘Find Next’.

A new window will open showing various registry items. All we need to look at are the ‘ValueMax’ and ‘ValueMin’ items.
Double-click on ValueMax and type the number 0 in the Value data field and press OK. Repeat the same for ValueMin.
Now reboot the computer and test the machine as normal.

---

---

Let me know how things turn out, after changing the Performance mode. and unparking the cores.

 

[Peccant]

FRST64 won't run the code you asked me to copy earlier. See error in Screenshot.
I downloaded KVRT, input the run command and the computer asked me what program to open "Mark" with. Could not move forward.
Power Config CPL doesn't give me any options other than HP Recommended and Balanced. Maybe new to Windows 11? Alternatives? See screenshot.
RegEdit didn't give me the expected results (no MinValue/MaxValue - see screenshot). I see LowRange and HighRange but I didn't want to change if it wasn't a different term for the same thing, expecially since the HighRange value is ffffff and not a numerical value.

I'm not having much luck with these latest instructions. I'm heading home for the evening but will be back in the morning to check on alternate paths forward. I really appreciate your time on this.

Thanks!

 

[Malnutrition]

For FRST make sure and copy from Start:: To End:: I forgot one colon at the end of End it was End: now it's End:: So now it will work. My fault on that, sometimes it happens. lol
As far as the registry edit skip that. I do not have a windows 11 machine to test on, so we will not be messing with anything that I am not 100 percent certain about.
As far as Kaspersky Make Certain KVRT is on the deskop!!, open elevated command prompt and copy and paste:

C:\Users\Mark Wainman\Desktop\KVRT.exe -dontencrypt

into it and hit enter.

If this does not work......just right click and run as admin do not worry about the -dontencrypt if there are any detections just screen shot them. Make sure and run it with the parameters I suggested.

• Place check marks in the following categories:
• System memory
• Startup objects
• Boot sectors
• System drive

---

Download and run Quick CPU to unpark your Cores.

Quick CPU Tutorial.................

To view this content we will need your consent to set third party cookies.
For more detailed information, see our cookies page.

Accept third party cookies

---

Run this fix with FRST at the end of the day tomorrow. This will run a check disk on the machine, which may take several hours to complete.

Start::
CloseProcesses:
SystemRestore: On
CreateRestorePoint:
StartBatch:
  ECHO Y|CHKDSK C: /F /R
  pushd c:\windows\system32
  bcdedit.exe /set {default} recoveryenabled yes
  net stop bits
  net stop cryptSvc
  net stop wuauserv
  net stop msiserver
  del /s /q C:\Windows\SoftwareDistribution\download\*.*
  del /s /q "%userprofile%\AppData\Local\Google\Chrome\User Data\Default\Cache\*.*"
  del /s /q "%userprofile%\AppData\Local\Microsoft\Edge\User Data\Default\Cache\*.*"
  del /s /q "%userprofile%\AppData\Local\Opera Software\Opera Stable\Cache\Cache_Data\*.*"
  netsh winsock reset catalog
  netsh int ipv4 reset reset.log
  netsh int ipv6 reset reset.log
  ipconfig /release
  ipconfig /renew
  ipconfig /flushdns
  ipconfig /registerdns
  net start bfe
  net start bits
  net start cryptSvc
  net start eventsystem
  net start msiserver
  net start rpcss
  net start sdrsvc
  net start trustedinstaller
  net start vss
  net start winmgmt
  net start wuauserv
  bitsadmin /list /allusers
  bitsadmin /reset /allusers
EndBatch:
cmd: DISM.exe /Online /Cleanup-image /Restorehealth
cmd: sfc /scannow
cmd: winmgmt /salvagerepository
cmd: winmgmt /verifyrepository
cmd: "%WINDIR%\SYSTEM32\lodctr.exe" /R
cmd: "%WINDIR%\SysWOW64\lodctr.exe" /R
cmd: "%WINDIR%\SYSTEM32\lodctr.exe" /R
cmd: "%WINDIR%\SysWOW64\lodctr.exe" /R
EmptyTemp:
Reboot:
End::

 

[Peccant]

Thanks. I was able to run FRST, see attached log.
Was also able to run Kaspersky but the report file isn't recognized by Windows and I can't get it open in notepad or anything else I tried, but it's not an allowed extension to attach here. There were no detections but there were a few errors in processing after the 3.5 hour run time.
None of my cores were parked, but I completed the tutorial. Everything seems to be reporting fine except the CPU Clock doesn't go over 0.40GHz, but I don't know anything about that, so perhaps it's ok? I screen captured and posted the QuickCPU dashboard in case you see anything that sticks out.
I'll run the longer FRST scan at end of day.

 

[Peccant]

Update on Quick CPU. Seems to have woke up. I reset the computer (a Windows Update from today was forced), I opened the back of my computer and manually spun the two fans, unplugged both, started the PC which gave me a "no fan detected" error, so I shut it off again, plugged the two back in, replaced the back, fired it up again, started Sage back up, fired up QuickCPU. Windows had reverted to Balanced Power performance, so I Maxed it again with QuickCPU and these are the results. Reason for the long story is so you have all potential variables, despite some likely being irrelevant. Performance seems faster so far, but I'll process some payroll entries which always seem to bog down the laptop and I'll report back after that.

 

[Peccant]

I ran payroll - no issue. Worked at light speed! Monitored with QuickCPU - clocked at Max 3.98GHz, Avg CPU Utilization 5.6%. Awesome! I was about to screenshot the results to you and my eye caught the "System Power State" data point, which said Battery. So I thought, shoot, I only set the power plan to QuickCpuScheme when it's on battery. Which made me think...hmmm...why is it fast then if I'm plugged in yet only set the fast scheme to Battery? A quick glance at the taskbar and I realized when I flipped my computer back over from going in to play with the fans, I didn't fully plug in the adapter so it was running on battery. Oops!

So I plugged in the power bar and BAM! - 0.40 GHz Clock. Everything else stayed roughly the same in the QuickCPU dashboard. My computer though, is back to sloth speed. No response time, lags everywhere. So I unplug it again. BAM! back to normal Clocking. everything un-freezes and the laptop works perfectly. Maybe if I reset my computer I can make the new power scheme work when plugged in. But then I start thinking, what if this means I need a new power adapter. I'm not sure how a new one would speed up the laptop, but plugging in clearly bogs it down. So I start to inspect the adapter. The pin is bent to the side. No way it's making the correct contact. So I straighten it out, plug it back in: no negative impact on the CPU Clocking.

Unfortunately, now the power adapter won't hold a charge, so this pin must actually be broken from being bent. Now when I plug it in the laptop bogs back to 400MHz and then the laptop loses its charge and the Clocking goes right back up but the battery won't charge.

Is this something that makes sense to you at all? I will order another adapter for sure, but it keeps bogging down the laptop when plugged in. Thoughts on that one?

 

[Malnutrition]

Just logging in to say , don’t put the charger back on the laptop, something may possibly short out and fry something. I’ll have a more detailed reply when I get home, but put that charger adapter in the trash immediately.