ndis.sys latency

[gVega]

hello, i'm new here. i'm sorry if i do something wrong, i don't know what i'm doing and i'm not the best at technology. sorry if i don't make sense, i'm trying my best but i don't speak english well and don't really know what i'm talking about. i'm trying my best please be patient with me

• Write a brief description of your problem.
  You can also include the steps you tried.

my audio is stuttering horribly, it is uncommon when i'm using my pc normally, but when i open any game (especially when i'm also using voice chat on discord, specifically when i'm speaking too) it's almost constant and i can't understand anything anyone says. it seems to be when i'm transmitting data online, like voice chats +gaming like i mentioned, sometimes seeding torrents makes it stutter a bit but i don't know if it's a coincidence or not. youtube makes it stutter very badly sometimes. i also use blender and have done a lot of renders since (usually maxes out my cpu) and it doesn't seem to stutter from high cpu use. i also have issues with holding mouse buttons that don't carry over when i'm using a stylus on my drawing tablet usually (i've checked, it's not the mouse that's the issue). sometimes my pc freezes for a few seconds at a time but i don't know what triggers this or why. it also seems to "forget" settings sometimes, like the power plan i set it to, but i don't know if that's related because it's been doing that since i bought this pc and it was fine for the past 6 years.

this all started when i got a virus that made my pc temporarily unusable, it limited the amount of ram i could use to 4gb somehow (i fixed it later with windows memory diagnostic, but don't know exactly what the virus did. it also corrupted some files i think. i don't know if the issue started here because i didn't use my pc in the ways that make it stutter. then after a while i reset it (stupidly not a full factory reset) and my pc came preinstalled with mcaffee and i accidentally corrupted a lot of windows files trying to remove it a stupid way. i didn't go long enough without resetting to see if the dpc issue started here or not. i reset again, (not a factory reset again, i'm stupid and have a lot of files to transfer because my pc is old) and after that i noticed that ndis.sys has had very high dpc and my pc was stuttering.

i've done everything i can find to try to fix it, nothing's helped.
- reinstalled my OS a lot in all of the different ways i can (dell OS recovery, windows built in reset tool, from a usb, and a in-place upgrade (from windows 10 to windows 10 still) none have been factory resets and i'm not going to factory reset unless i'm 100% certain that it'll fix it
- reset bios settings to default (i'm not sure if it was successful or not, honestly i'm scared to mess with bios at all)
- updated bios with dell's tool that does it for you
- updated windows
- updated drivers
- changed driver settings
- i bought a usb network adapter (my main issue used to be with ndis.sys and i'm running out of options), it fixed the ndis.sys issue when i use it and have my original card disabled, but it causes dpc issues with a lot of other system files instead and all of my problems are still there. (all of my logs should be from when it's turned off, let me know if i accidentally had it on while doing logs.)
- disabled dynamic ticking and a few other settings that i got told to disable
- sfc and dism
- removed a few apps, including malwarebytes, which seemed to help a little bit, but not much
- switched out ndis.sys for one from a clean, working pc (that i checked and made sure it was compatible with) when it was just ndis.sys that was an issue
- messing with audio drivers, changing audio formats(?) and restarting audio service. these work sometimes as a VERY very temporary solution. the fix only lasts a few minutes at most.
- probably a lot more that i've forgotten, i've really tried everything i could find to fix it

• OS ? (Windows 10, 8.1, 8, 7, Vista)

windows 10

• x86 (32bit) or x64 (64bit)?

x64

• What was original installed OS on system?

windows 10

• Is the OS an OEM version (came pre-installed on system) or full retail version (YOU purchased it from retailer)?

it came pre-installed

• Age of system? (hardware)

~6-7 years, some parts like the gpu and a few ram are a bit newer, maybe 4-5 years old or so. i know that's very old, but i don't have the money for new parts and it was working perfectly until a couple of months ago

• Age of OS installation?

since purchase, so ~7 years. i've reinstalled a few times, last one was about a month ago.

• Have you re-installed the OS?

6 times, yes

• System Manufacturer?

dell

• Laptop or Desktop?

desktop

• Exact model number (if laptop, check label on bottom)

XPS8930

• MotherBoard - (if NOT a laptop)

Dell Inc. 0DF42J (U3E1)

• CPU

Intel Core i7 @ 3.20GHz

• RAM (brand, EXACT model, what slots are you using?)

i ran wmic memorychip get devicelocator, manufacturer, partnumber in cmd and it said
XMM3 009C36160000 KHX2666C13/8GX
XMM1 009C36160000 KHX2666C13/8GX
XMM4 009C36160000 KHX2666C13/8GX
XMM2 009C36160000 KHX2666C13/8GX
bing ai says this means i have 8gb kingston's hyperx in all 4 slots.

• Video Card

4095MB NVIDIA GeForce GTX 1070 (Dell)

• Power Supply - brand & wattage (if laptop, skip this one)

just the usual power supply for an xps8930, which i looked up and it seems to be a dell with 460W

• Is driver verifier enabled or disabled?

disabled

• What security software are you using? (Firewall, antivirus, antimalware, antispyware, and so forth)

malwarebytes (currently uninstalled, but i installed it around when the problems started) and bitdefender

• Are you using proxy, vpn, ipfilters or similar software?

yes, expressvpn, but the issue is there whether i have it on or not and it was there before i installed it

• Are you using Disk Image tools? (like daemon tools, alcohol 52% or 120%, virtual CloneDrive, roxio software)

no

• Are you currently under/overclocking? Are there overclocking software installed on your system?

no


speccy link:
http://speccy.piriform.com/results/C8ykEegCu8PFR6wqBMAGKQT

sysnativefilecollection:
Proton Drive

trace:
Proton Drive

 

[gVega]

i want to add that the mouse issues are constant even when there aren't audio issues and don't get better or worse no matter what i do. i've read that it's related to dpc latency problems. i don't know how to edit my post if i can

 

[gVega]

please can someone help? my pc is almost unusable

 

[DR M]

Hello.

Although you said that you reset the computer after the virus infection, at the same time you mentioned that you are using torrents. We could proceed with a check of the system, if you like, to make sure that you are clean, and then check anything else.

To check the system:

Download Farbar Recovery Scan Tool and save it to your desktop. --> IMPORTANT

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your antivirus software detects the tool as malicious, it’s safe to allow FRST to run. It is a false-positive detection.

If English is not your primary language, right click on FRST.exe/FRST64.exe and rename to FRSTEnglish.exe/FRST64English.exe

• Double-click the FRST icon to run the tool. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produced two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach the content of these two logs in your next reply.

 

[gVega]

here they are, there's a lot of stuff on there sorry

 

[DR M]

Hi, gVega.

You have some infection signs. If you would like to clean the computer first and then check about the other issues, let me know.

In case you would like to clean the computer first, please adhere to the guidelines below. Have in mind, that you must check on this topic at least once a day.


1. Always ask before acting. Do not continue if you are not sure, or if something unexpected happens!

2. Do not run any tools unless instructed to do so. Also, do not uninstall or install any software during the procedure, unless I ask you to do so.

3. Cracked or pirated programs are not only illegal, but also can make your computer a malware target. Having such programs installed, is the easiest way to get infected. Thus, no need to clean the computer, since, soon or later, it will get infected again. If you have such programs, please uninstall them now, before we start the cleaning procedure.

4. If your computer seems to start working normally, don't abandon the topic. Even if your system is behaving normally, there may still be some malware remnants left over. Additionally, malware can re-infect the computer if some remnants are left. Therefore, please complete all requested steps to make sure any malware is successfully eradicated from your PC.

5. You have to reply to my posts within 3 days. If you need some additional time, just let me know. Otherwise, I will leave the topic due to lack of feedback. If you are able, I would request you to check this thread at least once per day so that we can resolve your issues effectively and efficiently.

6. Logs from malware diagnostic or removal programs can take some time to get analyzed. Also, have in mind that all the experts here are volunteers and may not be available to assist when you post. Please, be patient, while I analyze your logs.

 

[gVega]

sorry man, i just started college recently and could not reply for a while. i don't live at home anymore so i can only use my desktop on the weekends.
i'd still like to try to start cleaning it if you are still willing to even though i can only do things on it once a week

 

[DR M]

I understand. It will certainly take longer than expected, but at least we know that you won't use the computer in the meantime.

I'll review the logs and you will have instructions for Saturday.

 

[gVega]

thank you, i appreciate your help

 

[DR M]

Hello.

I have a lot of work for you, since you said that you have access to the computer only during the weekends. I hope you will be able to go through all the steps below, so I can give you the next set of instructions.

1. Warning about Deluge

This is a P2P program. P2P programs form a direct conduit on to a computer. They have always been a target of malware writers and are increasingly so of late. P2P security measures are easily circumvented and if your P2P program is not configured correctly, you may be sharing more files than you realize. There have been cases where people's passwords, address books and other personal, private, and financial details have been exposed to the file sharing network by a badly configured program. If you don't uninstall it, your computer will probably get infected again, as soon as you use it again. But it is your computer and of course your decision.

• If you decide to keep it, DON'T use it during the cleaning procedure.
• If you decide to uninstall it, uninstall it now.

2. FRST fix

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

Start::
CreateRestorePoint:
CloseProcesses:
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [9382]
HKLM\...\Policies\Explorer: [NoWindowsUpdate] 1
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKU\S-1-5-21-701922003-442001361-2209526973-1001\...\RunOnce: [Delete Cached Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\franz\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" (No File)
HKU\S-1-5-21-701922003-442001361-2209526973-1001\...\RunOnce: [Uninstall 23.246.1127.0002] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\franz\AppData\Local\Microsoft\OneDrive\23.246.1127.0002" [0 2024-02-04] () <==== ATTENTION [zero byte File/Folder]
HKU\S-1-5-21-701922003-442001361-2209526973-1001\...\MountPoints2: {8b42fa88-fa4b-11e7-9d94-806e6f6e6963} - "F:\AutoRunMorrowind.exe"
IFEO\EOSnotify.exe: [Debugger] /
IFEO\InstallAgent.exe: [Debugger] /
IFEO\MoNotificationUx.exe: [Debugger] /
IFEO\MusNotification.exe: [Debugger] /
IFEO\MusNotificationUx.exe: [Debugger] /
IFEO\remsh.exe: [Debugger] /
IFEO\SihClient.exe: [Debugger] /
IFEO\UpdateAssistant.exe: [Debugger] /
IFEO\UsoClient.exe: [Debugger] /
IFEO\WaaSMedic.exe: [Debugger] /
IFEO\WaasMedicAgent.exe: [Debugger] /
IFEO\Windows10Upgrade.exe: [Debugger] /
IFEO\Windows10UpgraderApp.exe: [Debugger] /
Task: {3CB1C5AF-AAF6-4B3C-8960-C91B3D918EF2} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe  --automatic (No File)
Task: {2DA1F8EB-F009-419E-84BB-2F22D9065D2C} - System32\Tasks\Microsoft\Windows\CUAssistant\CULauncher => %ProgramFiles%\CUAssistant\culauncher.exe  (No File)
Task: {D445BEA2-ADB6-4C22-9375-35228F9AF2CE} - System32\Tasks\Microsoft\Windows\rempl\shell => %ProgramFiles%\rempl\sedlauncher.exe  (No File)
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
S3 BraveElevationService; "C:\Program Files\BraveSoftware\Brave-Browser\Application\121.1.62.156\elevation_service.exe" [X]
S3 HipShieldK; C:\WINDOWS\System32\drivers\HipShieldK.sys [218336 2017-10-10] (McAfee, Inc. -> McAfee, Inc.)
C:\WINDOWS\System32\drivers\HipShieldK.sys
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2
EmptyTemp:
End::

• Right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.
• Post the log in your next reply.

3. Run AdwCleaner

Download AdwCleaner and save it to your desktop.

• Double click AdwCleaner.exe to run it.
• Click Scan Now.
• When the scan has finished a Scan Results window will open.
• Please check all the boxes and then click Quarantine.
• Click Next.
  • If any pre-installed software was found on your machine, a prompt window will open. Click OK to close it.
  • Check any pre-installed software items you want to remove. Your computer, so your decision which items you will keep or remove at this step.
  • Click Quarantine.
• A prompt to save your work will appear.
  • Click Continue when you're ready to proceed.
• A prompt to restart your computer will appear.
  • Click Restart Now.
• Once your computer has restarted:
  • If it doesn't open automatically, please start AdwCleaner.
  • Click the Log Files tab.
  • Double click on the latest Clean log (Clean logs have a [C0*] suffix, where * is replaced by a number, the latest scan will have the largest number)
  • A Notepad file will open containing the results of the removal.
  • Please post the contents of the file in your next reply.

4. Run Malwarebytes

• Download Malwarebytes and save it to your Desktop.
• Once downloaded, close all programs and Windows on your computer.
• Double-click on the icon on your desktop named MBSetup.exe. This will start the installation of MBAM onto your computer.
• Follow the instructions to install the program.
• When finished, double click the program's icon created on your Desktop.
• Click the little gear on the top right (Settings) and when it opens, click the Security tab and make sure about the following:
  

  Under the title Scan Options, all the options are checked.
  Under the title Windows Security Center (Premium only) the option is NOT checked.
  Under the title Potentially unwanted items all options are set to Always.

• Click on the little gear to return to the main menu and select Scan. The program will start scanning your computer. This may take about 10 minutes, but in some cases it may be take longer.
• When finished, you will see the Threat Scan Summary window open.
• If threats are not found, click View Report and proceed to the two last steps below.
  
  
• If threats are found, make sure that all threats are selected, and click on Quarantine/Remove selected.
• You may need to restart the computer.
• Open Malwarebytes again, click on the Scanner, and then on the Reports tab.
• Find the report with the most recent date and double click on it.
• Click on Export and then Copy to Clipboard.
• Paste its content here, in your next reply.

In your next reply, please post:

1. What did you decide and do with Deluge
2. The fixlog.txt
3. The AdwCleaner[C0*].txt
4. The Malwarebytes report

 

[gVega]

i think the detection from the malwarebytes scan is wrong, it's just a niche game modding tool. other people don't have issues with it. but i quarantined it anyway just in case
i couldn't uncheck the windows security center setting in malwarebytes , it was stuck on and when i tried to turn it off it said i needed premium to change it. i hope that didn't mess anything up

i decided to keep deluge, it hasn't given me any problems before and i've had it for almost as long as i've had my pc

 

[DR M]

i think the detection from the malwarebytes scan is wrong, it's just a niche game modding tool. other people don't have issues with it.

i decided to keep deluge, it hasn't given me any problems before

Have in mind that our experience or others' experience in doing specific things is not a criterion or a guide. See that you are having issues now. Someone may have issues later or never. What is important is to keep some basic rules for our safety. I don't know if Malwarebytes detection was a false-positive, but here it is what Malware page notes about Generic.Malware/Suspicious detections: Generic.Malware/Suspicious | Malwarebytes Labs

Moving on.

1. ESET Online Scan

Download ESET Online Scanner and save it to your desktop.

• Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
• When the tool opens, click Get Started.
• Read and accept the license agreement.
• At the Welcome to ESET Online Scanner window, click Get Started.
• Select whether you would like to send anonymous data to ESET.
• Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
• Click on the Full Scan option.
• Select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
• ESET will now begin scanning your computer. This may take some time.
• When the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
• ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. Click on Continue.
• On the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
• Open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.

2. Fresh FRST logs

• Double-click on the FRST icon to run it, as you did before. When the tool opens click Yes to disclaimer.
• Press Scan button and wait for a while.
• The scanner will produce two logs on your Desktop: FRST.txt and Addition.txt.
• Please attach these two logs in your next reply.

In your next reply please post:

1. The eset.txt
2. The fresh logs, FRST and Addition.
3. Feedback: please let me know about your issues now, in the form of 1 .... 2.... 3....

 

[gVega]

here they are, i guess i forgot to remove two of the pirated things i had. there were a lot to remove when you told me to because i don't always have the money to buy software, i hope you understand. it also flagged something that i did pay for from the real source (zbrush), i don't know why but i did quarantine it anyway to be safe.

i'm still having all of the issues in my original post

 

[DR M]

i'm still having all of the issues in my original post

When I asked you to let me know about your issues now, in the form of 1 .... 2.... 3...., I considered that as important step. Since the communication takes place once a week, I needed a list of your problems instead of going to the initial post, trying to note what a problem is and what is not among all the info you provided. So please, let me know about your issues, in the form of 1.....2.........3.......... It will be helpful for me and for anyone trying to help you here.

The computer is clean.

Some maintenance now with the following fix:

Please do the following to run a FRST fix.

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

• Select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy ". No need to paste anything to anywhere.

Start::
CreateRestorePoint:
CloseProcesses:
FirewallRules: [{42F5C39D-8B2F-47F8-B301-62F330C5F24E}] => (Allow) G:\overwolf\0.240.0.6\OverwolfBrowser.exe => No File
FirewallRules: [{13E641C3-4272-4F87-9241-7A96ED6B1679}] => (Allow) G:\overwolf\0.240.0.6\OverwolfBrowser.exe => No File
FirewallRules: [{5970DA4F-1789-4F36-90EC-78C3C49FEE3C}] => (Block) G:\overwolf\0.240.0.6\OverwolfBrowser.exe => No File
FirewallRules: [{4B0A7124-F739-4D61-999A-899193AC2C44}] => (Block) G:\overwolf\0.240.0.6\OverwolfBrowser.exe => No File
HKU\S-1-5-21-701922003-442001361-2209526973-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\WINDOWS\system32\cmd.exe /q /c del /q "C:\Users\franz\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File)
Task: {3C6AE5E2-2371-446C-A741-23A74E8211C3} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe  --automatic (No File)
Task: {164FF6CC-5F17-4681-AEEF-C1B954294C20} - System32\Tasks\PCDDataUploadTask => "uaclauncher.exe"  -lloc dataupload --ignoresecondarysplash --runsilently --skipidlewait (No File)
Task: {B993D6D1-3E4A-4A2F-93CF-782DFA2E7672} - System32\Tasks\PCDEventLauncherTask => "C:\Program Files\Dell\SupportAssist\sessionchecker.exe"  (No File)
Task: {D0D3AFF9-3F1C-484F-9A9B-BC2BF1A5D859} - System32\Tasks\SystemToolsDailyTest => "uaclauncher.exe"  -silentenumeration -st SystemToolsDailyTest --ignoresecondarysplash --runsilently (No File)
S3 BraveElevationService; "C:\Program Files\BraveSoftware\Brave-Browser\Application\121.1.62.165\elevation_service.exe" [X]
S2 Dell SupportAssist Remediation; "C:\Program Files\Dell\SARemediation\agent\DellSupportAssistRemedationService.exe" [X]
CMD: DISM /Online /Cleanup-Image /RestoreHealth
CMD: SFC /scannow
EmptyTemp:
End::

• Right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.
• Post the log in your next reply.

 

[gVega]

When I asked you to let me know about your issues now, in the form of 1 .... 2.... 3...., I considered that as important step. Since the communication takes place once a week, I needed a list of your problems instead of going to the initial post, trying to note what a problem is and what is not among all the info you provided. So please, let me know about your issues, in the form of 1.....2.........3.......... It will be helpful for me and for anyone trying to help you here.

my bad, sorry.
1. severe audio crackling/stuttering
2. mouse lag/stuttering, when i hold either of the buttons it will click multiple times instead of one held click
3. ndis.sys still has high latency (measured with latencymon)
4. pc sometimes freezes/stutters for 30 seconds to a minute

 

[DR M]

Hello, and thanks for summarizing the issues.

Let's perform a disk check.

Check disk

• Click on the Start button and in the search box, type Command Prompt.
• When you see Command Prompt on the list, right-click on it and select Run as administrator.
• Enter the command below and press on Enter and wait for it to finish (~15 minutes).
  

     chkdsk C: /r

• You will receive a message that the operation cannot be performed while the system is in use and ask if you want to check when you restart your computer. Choose Yes, and then restart the computer, allowing disk check to run at startup.
• The process will take some time, depending on the disk condition.
• Download ListChkdskResult by SleepyDude and save it on your Desktop.
• Double click on the created icon.
• A notepad file will open. Copy its content and paste it in your next reply.

 

[gVega]

ListChkdskResult by SleepyDude v0.1.7 Beta | 21-09-2013

------< Log generate on 02/03/2024 14:34:39 >------
Category: 0
Computer Name: DESKTOP-6AVKQR9
Event Code: 1001
Record Number: 16884
Source Name: Microsoft-Windows-Wininit
Time Written: 03-02-2024 @ 19:34:12
Event Type: Information
User:
Message:

Checking file system on C:
The type of the file system is NTFS.
Volume label is WINRETOOLS.

A disk check has been scheduled.
Windows will now check the disk.

Stage 1: Examining basic file system structure ...
1027584 file records processed.


File verification completed.
Phase duration (File record verification): 9.32 seconds.
20369 large file records processed.


Phase duration (Orphan file record recovery): 0.00 milliseconds.
0 bad file records processed.


Phase duration (Bad file record checking): 1.55 milliseconds.

Stage 2: Examining file name linkage ...
477 reparse records processed.


1428428 index entries processed.


Index verification completed.
Phase duration (Index verification): 21.10 seconds.
0 unindexed files scanned.


Phase duration (Orphan reconnection): 3.35 seconds.
0 unindexed files recovered to lost and found.


Phase duration (Orphan recovery to lost and found): 93.91 milliseconds.
477 reparse records processed.


Phase duration (Reparse point and Object ID verification): 7.75 milliseconds.

Stage 3: Examining security descriptors ...
Cleaning up 111 unused index entries from index $SII of file 0x9.
Cleaning up 111 unused index entries from index $SDH of file 0x9.
Cleaning up 111 unused security descriptors.
Security descriptor verification completed.
Phase duration (Security descriptor verification): 42.10 milliseconds.
200423 data files processed.


Phase duration (Data attribute verification): 1.77 milliseconds.
CHKDSK is verifying Usn Journal...
38004888 USN bytes processed.


Usn Journal verification completed.
Phase duration (USN journal verification): 196.48 milliseconds.

Stage 4: Looking for bad clusters in user file data ...
1027568 files processed.


File data verification completed.
Phase duration (User file recovery): 10.69 minutes.

Stage 5: Looking for bad, free clusters ...
16252705 free clusters processed.


Free space verification is complete.
Phase duration (Free space recovery): 0.00 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

234986126 KB total disk space.
168427172 KB in 656350 files.
398840 KB in 200424 indexes.
0 KB in bad sectors.
1149294 KB in use by the system.
65536 KB occupied by the log file.
65010820 KB available on disk.

4096 bytes in each allocation unit.
58746531 total allocation units on disk.
16252705 allocation units available on disk.
Total duration: 11.26 minutes (675802 ms).

Internal Info:
00 ae 0f 00 d0 12 0d 00 10 b6 16 00 00 00 00 00 ................
80 00 00 00 5d 01 00 00 00 00 00 00 00 00 00 00 ....]...........

-----------------------------------------------------------------------
Category: 0
Computer Name: DESKTOP-6AVKQR9
Event Code: 26226
Record Number: 15727
Source Name: Chkdsk
Time Written: 02-12-2024 @ 01:14:47
Event Type: Information
User:
Message: Chkdsk was executed in scan mode on a volume snapshot.

Checking file system on \Device\HarddiskVolume7
Volume label is WINRETOOLS.

Stage 1: Examining basic file system structure ...
Found corrupt basic file structure for "\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl <0x5,0x1210>"
... queued for offline repair.
Found corrupt basic file structure for "\ProgramData\Intel\DSA\Logs\Service\Service20240204.log <0xc,0x20a0>"
... repaired online.
Found corrupt basic file structure for "\Users\franz\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db-wal <0x2,0x26b51>"
... repaired online.
904192 file records processed.

File verification completed.
Phase duration (File record verification): 10.80 seconds.
19877 large file records processed.

Phase duration (Orphan file record recovery): 0.00 milliseconds.
0 bad file records processed.

Phase duration (Bad file record checking): 0.01 milliseconds.

Stage 2: Examining file name linkage ...
475 reparse records processed.

1300624 index entries processed.

Index verification completed.
Phase duration (Index verification): 21.84 seconds.

Phase duration (Orphan reconnection): 0.00 milliseconds.
Found 2 missing entries (\Windows\LiveKernelReports\PoW32kWatchdog-20240210-1823.dmp <0xca,0x299c>, ...) in index "$I30" of directory "\Windows\LiveKernelReports <0x2,0xccbb>"
... repaired online.

Phase duration (Orphan recovery to lost and found): 1.30 milliseconds.
475 reparse records processed.

Phase duration (Reparse point and Object ID verification): 3.95 milliseconds.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
Phase duration (Security descriptor verification): 63.72 milliseconds.
198220 data files processed.

Phase duration (Data attribute verification): 3.17 milliseconds.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
Windows has found problems and some were fixed online;
the remaining problems must be fixed offline.
Please run "chkdsk /spotfix" to fix the issues.

234986126 KB total disk space.
162663008 KB in 651980 files.
392180 KB in 198218 indexes.
988430 KB in use by the system.
65536 KB occupied by the log file.
70942508 KB available on disk.

4096 bytes in each allocation unit.
58746531 total allocation units on disk.
17735627 allocation units available on disk.
Total duration: 41.55 seconds (41550 ms).

----------------------------------------------------------------------


Stage 1: Examining basic file system structure ...
The attribute of type 0x80 and instance tag 0x0 in file 0x1210
has allocated length of 0x2d00000 instead of 0x2e00000.
Deleted corrupt attribute list entry
with type code 80 in file 1210.
Unable to locate attribute with instance tag 0x0 and segment
reference 0x9000000068b26. The expected attribute type is 0x80.
Deleting corrupt attribute record (0x80, "")
from file record segment 0x68B26.
The attribute of type 0x80 and instance tag 0x4 in file 0x20a0
has allocated length of 0xa0000 instead of 0x85000.
Deleting corrupt attribute record (0x80, "")
from file record segment 0x20A0.
The attribute of type 0x80 and instance tag 0x4 in file 0x26b51
has allocated length of 0x2d0000 instead of 0x310000.
Deleting corrupt attribute record (0x80, "")
from file record segment 0x26B51.

Stage 2: Examining file name linkage ...
CHKDSK is scanning unindexed files for reconnect to their original directory.
Recovering orphaned file POW32K~1.DMP (299C) into directory file CCBB.
Recovering orphaned file PoW32kWatchdog-20240210-1823.dmp (299C) into directory file CCBB.
Recovering orphaned file POW32K~1.DMP (299C) into directory file CCBB.
Recovering orphaned file PoW32kWatchdog-20240210-1823.dmp (299C) into directory file CCBB.
Recovering orphaned file WATCHD~1.DMP (29AC) into directory file CCBB.
Recovering orphaned file WATCHDOG-20240210-1823.dmp (29AC) into directory file CCBB.
Recovering orphaned file WATCHD~1.DMP (29AC) into directory file CCBB.
Recovering orphaned file WATCHDOG-20240210-1823.dmp (29AC) into directory file CCBB.
2 unindexed files recovered to original directory.

Stage 3: Examining security descriptors ...
Inserting data attribute into file 1210.
Inserting data attribute into file 20A0.
Inserting data attribute into file 26B51.

-----------------------------------------------------------------------
Category: 0
Computer Name: DESKTOP-6AVKQR9
Event Code: 26228
Record Number: 15516
Source Name: Chkdsk
Time Written: 02-10-2024 @ 23:53:39
Event Type: Information
User:
Message: Chkdsk was executed in verify mode on a volume snapshot.

Checking file system on \Device\HarddiskVolumeShadowCopy5
The specified object was not found.

A snapshot error occured while scanning this drive. Run an offline scan and fix.

-----------------------------------------------------------------------
Category: 0
Computer Name: DESKTOP-6AVKQR9
Event Code: 26228
Record Number: 15515
Source Name: Chkdsk
Time Written: 02-10-2024 @ 23:53:39
Event Type: Information
User:
Message: Chkdsk was executed in verify mode on a volume snapshot.

Checking file system on \Device\HarddiskVolume7
Volume label is WINRETOOLS.

Examining 2 corruption records ...

Record 1 of 2: Corrupt File "\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl <0x5,0x1210>" ... The attribute of type 0x80 and instance tag 0x0 in file 0x1210
has allocated length of 0x2d00000 instead of 0x2e00000.
Deleted corrupt attribute list entry
with type code 80 in file 1210.
Unable to locate attribute with instance tag 0x0 and segment
reference 0x9000000068b26. The expected attribute type is 0x80.
Attribute record (80, "") from file record segment 68B26
is corrupt.
corruption found.

Record 2 of 2: Corrupt File "\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl <0x5,0x1210>" ... The attribute of type 0x80 and instance tag 0x0 in file 0x1210
has allocated length of 0x2d00000 instead of 0x2e00000.
Deleted corrupt attribute list entry
with type code 80 in file 1210.
Unable to locate attribute with instance tag 0x0 and segment
reference 0x9000000068b26. The expected attribute type is 0x80.
Attribute record (80, "") from file record segment 68B26
is corrupt.
corruption found.

2 corruption records processed in 0.1 seconds.

Windows has examined the list of previously identified potential issues and found problems.
Please run chkdsk /scan to fully analyze the problems and queue them for repair.

-----------------------------------------------------------------------
Category: 0
Computer Name: DESKTOP-6AVKQR9
Event Code: 26228
Record Number: 15122
Source Name: Chkdsk
Time Written: 02-10-2024 @ 23:25:20
Event Type: Information
User:
Message: Chkdsk was executed in verify mode on a volume snapshot.

Checking file system on \Device\HarddiskVolume4
Volume label is games.

Examining 2 corruption records ...

Record 1 of 2: Unneeded index entry in index "$I30" of directory "\dropbox\Dropbox\.dropbox.cache <0x10,0x10d8>" ... no corruption found.

Record 2 of 2: Unneeded index entry in index "$I30" of directory "\dropbox\Dropbox\.dropbox.cache <0x10,0x10d8>" ... no corruption found.

2 corruption records processed in 0.1 seconds.

Windows has examined the list of previously identified potential issues and found no problems.
No further action is required.

-----------------------------------------------------------------------
Category: 0
Computer Name: DESKTOP-6AVKQR9
Event Code: 26228
Record Number: 15119
Source Name: Chkdsk
Time Written: 02-10-2024 @ 23:24:32
Event Type: Information
User:
Message: Chkdsk was executed in verify mode on a volume snapshot.

Checking file system on \Device\HarddiskVolume7
Volume label is WINRETOOLS.

Examining 1 corruption record ...

Record 1 of 1: Unneeded index entry in index "$I30" of directory "\Windows\System32\sru <0x2,0xd50a>" ... no corruption found.

1 corruption record processed in 0.1 seconds.

Windows has examined the list of previously identified potential issues and found no problems.
No further action is required.

-----------------------------------------------------------------------
Category: 0
Computer Name: DESKTOP-6AVKQR9
Event Code: 26228
Record Number: 15118
Source Name: Chkdsk
Time Written: 02-10-2024 @ 23:24:31
Event Type: Information
User:
Message: Chkdsk was executed in verify mode on a volume snapshot.

Checking file system on \Device\HarddiskVolume7
Volume label is WINRETOOLS.

Examining 6 corruption records ...

Record 1 of 6: Corrupt File "\Users\franz\AppData\Local\Dropbox\metrics\store.bin <0xf,0x1a4e>" ... no corruption found.

Record 2 of 6: Corrupt File "\Users\franz\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db-wal <0x2,0x26b51>" ... The attribute of type 0x80 and instance tag 0x4 in file 0x26b51
has allocated length of 0x2d0000 instead of 0x310000.
Attribute record (80, "") from file record segment 26B51
is corrupt.
corruption found.

Record 3 of 6: Corrupt File "\Windows\System32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl <0x5,0x1210>" ... The attribute of type 0x80 and instance tag 0x0 in file 0x1210
has allocated length of 0x2d00000 instead of 0x2e00000.
Deleted corrupt attribute list entry
with type code 80 in file 1210.
Unable to locate attribute with instance tag 0x0 and segment
reference 0x9000000068b26. The expected attribute type is 0x80.
Attribute record (80, "") from file record segment 68B26
is corrupt.
corruption found.

Record 4 of 6: Corrupt File "\ProgramData\NVIDIA Corporation\nvtopps\nvtopps.log <0x5,0x9ebf>" ... The attribute of type 0x80 and instance tag 0x3 in file 0x9ebf
has allocated length of 0x1000 instead of 0x4000.
Attribute record (80, "") from file record segment 9EBF
is corrupt.
corruption found.

Record 5 of 6: Unneeded index entry in index "$I30" of directory "\Users\franz\AppData\Roaming\discordcanary\Local Storage\leveldb <0x5,0x28354>" ... no corruption found.

Record 6 of 6: Unneeded index entry in index "$I30" of directory "\Users\franz\AppData\Roaming\discordcanary\Local Storage\leveldb <0x5,0x28354>" ... no corruption found.

6 corruption records processed in 0.1 seconds.

Windows has examined the list of previously identified potential issues and found problems.
Please run chkdsk /scan to fully analyze the problems and queue them for repair.

-----------------------------------------------------------------------
Category: 0
Computer Name: DESKTOP-6AVKQR9
Event Code: 26226
Record Number: 6122
Source Name: Chkdsk
Time Written: 12-07-2023 @ 03:56:06
Event Type: Information
User:
Message: Chkdsk was executed in scan mode on a volume snapshot.

Checking file system on C:
Volume label is WINRETOOLS.

Stage 1: Examining basic file system structure ...
876544 file records processed.

File verification completed.
Phase duration (File record verification): 9.02 seconds.
29967 large file records processed.

Phase duration (Orphan file record recovery): 0.00 milliseconds.
0 bad file records processed.

Phase duration (Bad file record checking): 1.00 milliseconds.

Stage 2: Examining file name linkage ...
493 reparse records processed.

1264636 index entries processed.

Index verification completed.
Phase duration (Index verification): 25.09 seconds.

Phase duration (Orphan reconnection): 7.40 seconds.

Phase duration (Orphan recovery to lost and found): 9.99 milliseconds.
493 reparse records processed.

Phase duration (Reparse point and Object ID verification): 8.09 milliseconds.

Stage 3: Examining security descriptors ...
Security descriptor verification completed.
Phase duration (Security descriptor verification): 243.08 milliseconds.
194047 data files processed.

Phase duration (Data attribute verification): 1.81 milliseconds.
CHKDSK is verifying Usn Journal...
38831968 USN bytes processed.

Usn Journal verification completed.
Phase duration (USN journal verification): 171.91 milliseconds.

Windows has scanned the file system and found no problems.
No further action is required.

234986126 KB total disk space.
175690756 KB in 645366 files.
411792 KB in 194048 indexes.
1000086 KB in use by the system.
65536 KB occupied by the log file.
57883492 KB available on disk.

4096 bytes in each allocation unit.
58746531 total allocation units on disk.
14470873 allocation units available on disk.
Total duration: 41.97 seconds (41970 ms).

----------------------------------------------------------------------


Stage 1: Examining basic file system structure ...

Stage 2: Examining file name linkage ...

Stage 3: Examining security descriptors ...

-----------------------------------------------------------------------

 

[DR M]

It seems that the disk had issues which are now fixed. However, had in mind that as soon as the disk starts having issues, the whole system won't run properly until there is a replacement.

Assuming you are still having the same issues?

Since the system is clean, and the disk check is done, I don't have any other suggestion, other than an in-place upgrade using an ISO file. I know you said that you already did that, but I assume it was before the next things you tried, which may caused a mess.

• Go to this Microsoft page and under the title Create Windows 10 installation media press on Download tool now.
• Save the tool on your Desktop and double click to run it.
• On the License terms page, if you accept the license terms, select Accept.
• On the What do you want to do page, select Create installation media (USB....) and then select Next.
• Choose the ISO file option. Once the download is complete, right click the ISO and select the option Mount.
• Open the Windows File Explorer and open mounted ISO, and run the setup.exe file.
• Follow the instructions and click on the option Change what to keep.
• Select the option Keep personal files and apps and click next.
• Windows Setup will now start the in-place upgrade installation to repair Windows.

Let me know how things are, after the upgrade.

 

[gVega]

sorry for the late reply. i'm still having the same issues unfortunately. i was talking to someone else who also has a dell and has similar (but less severe) issues to what i have after he did an in-place upgrade to 10 too, and he didn't have a virus or anything so we were thinking it could be related, i don't know if that gives you anything more to work with or is of any value. i know you don't have any other suggestions, but do you think this is even fixable? does this mean that replacing it could fix my issue?

However, had in mind that as soon as the disk starts having issues, the whole system won't run properly until there is a replacement.

 

[Shintaro]

Reading what you have said, that you had the stuttering issue prior to the virus and after the in-place Windows 10 upgrade, I would suggest that it appears to be software-related.

A few people seem to point to either the Dell support apps and/or Windows Sonic for headphones.

You said that the USB NIC caused DPC (Deferred Procedure call) issues, did you run DPC latency monitor and see what it reported?


Hope this helps.