Slow computer and internet browser

I have a client whos computer is slow as well as internet pages loading very slowly...he says he has to twiddle his thumbs (although his speed shows 170 mbps). His CPU usage is off the charts...see attached. He runs a lot of programs simultaneously.
He says,  "Lately, it’s gotten intolerable, and is an impediment to getting any work done.
My system has gotten very very slow.  I have to wait and twiddle my thumbs while it opens a new website.  Likewise, linking to another page is a very lengthy operation.  When I look at Task Manager, CPU is near 100% at those times. The main culprits when I look at processes are WMI Provider Hosts for each browser.  Service Host: Superfetch is another.  Those processes tend to grow and gobble up all available CPU time, which slows everything else to a halt."

He has 16 GB of ram, Windows 10. Thoughts?
Mags
CPU-useage.jpg
MagsOwnerAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JohnBusiness Consultant (Owner)Commented:
Is Windows updating?
More likely scan for viruses with Windows Defender and Malwarebytes
0
MagsOwnerAuthor Commented:
I will check updates...he is running MBAM Premium I saw nothing in Quarantine.
0
JohnBusiness Consultant (Owner)Commented:
Look in Task Manager, sort by CPU , and see what process is bogging down the CPU
0
The 7 Worst Nightmares of a Sysadmin

Fear not! To defend your business’ IT systems we’re going to shine a light on the seven most sinister terrors that haunt sysadmins. That way you can be sure there’s nothing in your stack waiting to go bump in the night.

MagsOwnerAuthor Commented:
Updates were good as of this morning...found an update tonight, downloading.  JPG image was sorted by CPU...here is the most recent.
CPU usage 2
0
David Johnson, CD, MVPOwnerCommented:
goto assist also seems to be a major culprit
0
JohnBusiness Consultant (Owner)Commented:
That is not a Windows 10 app so uninstall it and test again
0
MagsOwnerAuthor Commented:
Hey David and John...GoToAssist is my remote connection...this was all happening before I connected. My end shows GoToAssist at between 0 and .3%.
0
JohnBusiness Consultant (Owner)Commented:
Three things then,

1. Ask your client to stop Go to Assist, wait a minute and capture CPU usage again.

2. Below Go to Assist there are a bunch of items in the 10% range. All zero on my machine.

3. See if Windows Defender is running (system tray and may be in the Up Arrow in the system tray). If it is, run a full scan with Windows Defender. If WD is running, try turn MBAM real time scanning OFF to avoid AV conflicts.

In a properly running machine, CPU should run <5% more than 95 % of time.
0
MagsOwnerAuthor Commented:
1. His CPU usage was maxing out without me connected, which I why he contacted me.

2. I agree, they are all zero on my machine as well.

3. He does have Bit Defender running as well...I have never had an issue with MBAM and WD conflicting...happy to turn MBAM off for testing if needed though. I think BD is overkill. I will stop that as well.

He needs to do a restart to finish the Windows Update.

Done for the night...I will check back in the morning...thanks for your assistance!
0
JohnBusiness Consultant (Owner)Commented:
Thank you. Have a good evening (I am done too) and please keep us posted tomorrow.

And yes stop Bit Defender also. ONE Anti Virus running real time.
0
Cliff GaliherCommented:
One stuck out at me: suoerfetch. While not strictly "malware"  where there is one borderline suspect program, there are ten you don't see.

Antivirus programs are good at stopping infections (good  not great.) But are bad at finding them if already infected. The infections just have too many ways to hide.

Wipe and install is usually the only option. This doesn't feel like a normal minor fixable issue.
0
Hello ThereSystem AdministratorCommented:
Does it happen immediately after reboot or after you start to run apps?
0
McKnifeCommented:
We need a screenshot of task manager without you being connected, without GoTo assist.
0
nobusCommented:
why does he needs settings to be open?
also - suggest him to close the apps he does not use regularly
0
Hello ThereSystem AdministratorCommented:
Also check Startup items and disable all you don't need.
0
JohnBusiness Consultant (Owner)Commented:
I think SuperFetch is a Windows app. It is on my machine but runs at zero (near enough).

I, too, am waiting the update on Viruses and AV tools.
0
MagsOwnerAuthor Commented:
Good Morning...before reading your added suggestions  - Hello everyone - I use msconfig to set his computer to start in safe mode with only my service check however I discovered that BitDefender will not allow me to turn off it's services.

It will be difficult for me not to be connected as he is deaf and not close.

Here is the new screen
CPU-useage-3.jpg
0
JohnBusiness Consultant (Owner)Commented:
I am not sure what version of Bit Defender. Here are some BD suggestions for turning it off.

https://www.bitdefender.com/consumer/support/answer/3347/

Consider uninstalling it (at least temporarily).
0
MagsOwnerAuthor Commented:
He was getting crazy high CPU output without me connected...would you need me to take off my service...this has never happened before and I've been using GoToAssist for years. Looking at one of my computers now with GoToAssist connected.
0
MagsOwnerAuthor Commented:
Thanks John...already did that...I will check with him...he is not at his computer yet.
0
JohnBusiness Consultant (Owner)Commented:
Probably all of Bit Defender, MBAM and Windows Defender are running real time. I think that need to be resolved first.
0
MagsOwnerAuthor Commented:
Able to turn off MBAM and WD...need to check with him about BD.

Windows updates were all successfully installed.
0
MagsOwnerAuthor Commented:
Removing BD now.
0
MagsOwnerAuthor Commented:
tested CPU usage for GoToAssist on another computer - 3%
0
JohnBusiness Consultant (Owner)Commented:
Understand. I think the underlying issues (at least to start) is Virus / Anti Virus.
0
McKnifeCommented:
Write him: open task manager, go to the details tab, sort by the cpu usage column. Press Alt-Gr and Print together so that task manager's screen is now in clipboard. Paste into a mail and send to you. That's all we need.
0
MagsOwnerAuthor Commented:
Will do, asap. Used Revo to remove BitDefender...didn't remove it completely. Needing to do a system restore. First time I have had an issue with Revo...used it since he already had it installed.
0
MagsOwnerAuthor Commented:
Okay...got BD uninstalled...my latest CPU.

CPU-useage-4.jpg
I disconnected and he is getting a fresh screen shot.
0
JohnBusiness Consultant (Owner)Commented:
First line SuperFetch:  Is the Disk heavily fragmented (lots of disk activity).  The user could run disk defrag but that could take an hour or two.

Antimalware service belongs to Windows Defender and high cpu there means a Defender conflict.

Either turn Defender off or MBAM off

To turn Defender OFF  Group Policy Editor (gpedit.msc) and restart the computer when done.

Group Policy Editor:
Computer configuration -> Administrative Templates -> Windows Components -> Windows Defender
Turn off Windows Defender  (set to Enabled)

Computer configuration -> Administrative Templates -> Windows Components -> Windows Defender
 -> Real-time protection
Turn off Real Time Protection (set to Enabled)

OK and exit out . Default setting is Not Configured

Personally I would disable MBAM and use only Windows Defender.
0
MagsOwnerAuthor Commented:
I disagree with disabling MBAM...it has saved my butt several times and has never caused an issue running with WD.

I believe MBAM was turned off when I looked at Task Manager's CPU

I'll send him these instructions and be back in touch.
Thanks!
0
MagsOwnerAuthor Commented:
McKnife -Press Alt-Gr and Print together...what is Gr??
0
Kapil SharmaTech Geek :)Commented:
There can be the chances of Windows update or Virus. Did you try to remove all cookies, dead files, temp files? Use Ccleaner, hope your problem is solved.
0
MagsOwnerAuthor Commented:
He has run CCleaner, I will run it again...I have not manually removed temp files. I will check if he has been infected recently (had minor PUP last September) but will probably run other scans just in case. The next time I can be on his computer is tomorrow morning.
0
McKnifeCommented:
The Alt GR key is the key next to your space bar, on the right side of it.
Your screenshot shows superfetch as the main suspect, turn off the service superfetch, for a test, in services.msc.

And now let him make that screenshot, without superfetch and without Go To Assist.
0
MagsOwnerAuthor Commented:
Hey McKnife I think the Gr key on your keyboard is Fn on ours...at least I was able to get a screen shot that way. Thanks!
0
MagsOwnerAuthor Commented:
Okay...I ran HitmanPro - it found 3 suspicious files

Hitman Pro screen shot
Here is the log. Could be legit or a virus hiding. What do you think. HitmanPro is suggesting to ignore.
HitmanPro_20180426_1157.log
0
MagsOwnerAuthor Commented:
Malwarebytes' AdwCleaner just found a file called "TOSTACK". I've never seen that before. Installed on 4/23/18 and research seems to point to malware? Thoughts?
0
JohnBusiness Consultant (Owner)Commented:
Yes. I have not seen that on any machine
0
MagsOwnerAuthor Commented:
What about what HitmanPro found...shall I ignore?
0
JohnBusiness Consultant (Owner)Commented:
You should be able to delete what hitman pro shows you
0
MagsOwnerAuthor Commented:
I would only feel comfortable deleting if I knew it was a virus...do not want to make the system unstable. HitmanPro suggests to ignore.
0
JohnBusiness Consultant (Owner)Commented:
C:\WINDOWS\system32\drivers\wd\WdBoot.sys - is probably OK

 C:\WINDOWS\system32\drivers\wd\WdFilter.sys  --- is probably OK

C:\WINDOWS\system32\drivers\wd\WdNisDrv.sys   -- I don't know for sure. Probably OK

I do not know why hitman pro picks on drivers.

You can probably leave them (not delete them) for now
0
David Johnson, CD, MVPOwnerCommented:
those wd*.sys files are signed by Microsoft and are parts of Windows Defender.

one thing that has never been stated is what are the machine properties? cpu/ram/ hard drive properties, cpu temperature
0
MagsOwnerAuthor Commented:
I'll get that info David. Best way to get CPU temp?
0
MagsOwnerAuthor Commented:
Concerned about ending Superfetch...I get this message before ending the process

End Task
0
JohnBusiness Consultant (Owner)Commented:
SuperFetch if running probably does not need to be stopped. It runs fine for me.
0
David Johnson, CD, MVPOwnerCommented:
don't end it that way, let it close cleanly by
Hold the Windows Key, while pressing “R” to bring up the Run dialog box.
Type “services.msc“, then press “Enter“.
The Services window displays. Find “Superfetch” in the list.
Right-click “Superfetch“, then select “Properties“.
Select the “Stop” button if you wish to stop the service. In the “Startup type” dropdown menu, choose “Disabled“.

cpu temperature http://www.alcpu.com/CoreTemp/  watch for included bloatware
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
MagsOwnerAuthor Commented:
K...let me see if I can jump on my clients computer...he is try to work.
Thanks
0
MagsOwnerAuthor Commented:
John I was asked by McKnife to stop SuperFetch...to see if it made a difference in CPU usage.
0
JohnBusiness Consultant (Owner)Commented:
SuperFetch causes NO issues on a machine that works properly so leave that until last to disable. Fix everything else first.
0
MagsOwnerAuthor Commented:
David here is the info requested
Dell Inspiron 3656 Desktop
Processor AMD FX-8800P Radeon R7, 12 Compute Cores 4C +8G 2.10 FHz
Ram 16 GB
64 bit system
2 T Hard Drive Toshiba DT01ACA200


Core Temp
Core Temp
0
MagsOwnerAuthor Commented:
My client is having issues getting a screen shot...here is one with SuperFetch stopped but I am logged in. He is getting frustrated but am sending him instructions with a screen shot.

TM-with-SuperFetch-stopped.png
0
MagsOwnerAuthor Commented:
Just got your message John...we'll see how his machine behaves.
0
JohnBusiness Consultant (Owner)Commented:
You have cleaned up some viruses (I think) and CPU is down 40 % . Target is 5 %.

The systems eating up the 40% do not cause issues on my or client machines.

Farther back I asked you / client to run Defrag.  Was that done?
0
MagsOwnerAuthor Commented:
haven't had time...will do when I have access to his computer next. Thanks
0
David Johnson, CD, MVPOwnerCommented:
Thanks for the feedback, we now know that it isn't memory or heat issues. Personally I would not have bought this computer for mainstream use. I would have bought an intel cpu'd Laptop and not a notebook. Doing your research before purchase is always advised.  Even though it is only 3 years old the cpu benchmark is way under cpu's released 10 years ago. Until Ryzen appeared from AMD they were pretty much out of the competition as far as cpu performance was. One doesn't buy a go cart and expect lamborghini performance

Surprised that it has a 3.5" Hard drive notebooks normally have a 2.5" Hard drive (glad that it is 7200RPM not 5400rpm (good choice)
0
JohnBusiness Consultant (Owner)Commented:
That seems a reasonable desktop computer if set up properly

https://www.cnet.com/products/dell-inspiron-3656-mt-a10-8700p-1-8-ghz-8-gb-2-tb-english-with-samsung-32-inch-led-tv-un32j4000-hdtv/specs/

Would your user be able to back up Everything (including email and documents) and do a fresh install of Windows?

Tall order. Is the customer up to it?
0
David Johnson, CD, MVPOwnerCommented:
John: you are comparing an 8700 vs what he has an 8800 cpu.  These are notebook/laptop non user replaceable (almost a SOC system)  cpu's in other words a go cart cpu.  This cpu is only 83% of the performance of a cpu that was released 4 years earlier. bench marks other than replacing the system drive with an SSD he has what he has.. you can't make a silk purse out of a sow's ear.
0
JohnBusiness Consultant (Owner)Commented:
I think the system description by Mags above was a Desktop computer  

Mags - can you clarify laptop or desktop?
0
MagsOwnerAuthor Commented:
Desktop.
0
McKnifeCommented:
At least your new screenshot shows that CPU load decreases a lot with superfetch of. Of course, superfetch should not be a problem, but obviously, it is. Inform yourself what it does and consider to disable its startup type.

About the WD files: see if those are signed by microsoft - your screenshot does not say. It can be seen in the file properties.
And still we need a screenshot without GoTo assist. I guess it will show us that all there was was suprfetch running amok and without it and without an active GoToassist, the load will surely drop below 20%.
0
MagsOwnerAuthor Commented:
My client says,  "it is now routinely below 20%, sometimes sitting around 0% for seconds at a time.  I think that’s significant." This is with SuperFetch stopped and after some malware scans. I will find out how his computer performance is.

He is having issues sending me a screen shot when I'm not on. He can do it while I am watching but that "paste" doesn't work when I'm not. I will check the WD files and get back to you.

I still have some malware scans to run.
0
nobusCommented:
take a screenshot with the snipping tool - and attach the jpg to a mail
0
MagsOwnerAuthor Commented:
I'll ask him...not sure what his work schedule is...thanks nobus!
0
MagsOwnerAuthor Commented:
I am going to work on his computer tomorrow...until then.
Have a great day!
Mags
0
MagsOwnerAuthor Commented:
I have done a defrag, have run MBAM, SAS, CCleaner, AdwCleaner, HitmanPro and am now running RogueKiller. It too is finding issues. I have recommended to my client that we do a OS Refresh. He is considering it.
0
nobusCommented:
if - after running 3 or more AV scanners - it still does not work ok  - i Always do a fresh install - and wipe the whole existing system
no point in keeping parts of it
0
McKnifeCommented:
Be informed that the more malware scanners you run, the more "issues" or potential issues or suspicious things will be found. That does not mean that they are malicious. It is just the judgment of a dumb automatism that likes to call itself "Cleaner".
Maybe there is no problem at all other than superfetch. Since superfetch is not even needed, I would turn it off.

If you want to discuss the findings of your programs, that will mean some work, but so will the refresh.
0
MagsOwnerAuthor Commented:
Thank you for all your help. His computer is running much better. If that changes we will to an OS Refresh.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 10

From novice to tech pro — start learning today.