| Author |
Message
|
stageman
Poziom 15
Joined: 15 Jan 2005
Posts: 211
Location: NewYork
|
 #1
 30 Aug 2005 18:11 lsass.exe |
|
|
|
Witam
Mam taki oto problem w XP Home Edition:
system nie nadaje sie do pracy bo dwa procesy: lsass.exe i winlogon.exe zajmuja cala pamiec CPU i poza tym tworzy sie mnostwo procesow rundll32.exe.
Nie wykrywam zadnych wirusow dwoma antywirusami (m.in. aktualny mks_vir). Nie wydaje mi sie aby byl to sasser bo removal tool i lata od microsofta nic nie daly/nie wykryly.
Czytalem podobny temat na elektrodzie ale tamtej osobie inne pliki generowaly calkowite uzycie procesora
Czy ktos z Was mial moze podobna sytyacje, czy jej sprostal? Prosze o rady.
==================
Logfile of HijackThis v1.97.7
Scan saved at 18:45:30, on 05-08-30
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
G:\WINXP\System32\smss.exe
G:\WINXP\system32\winlogon.exe
G:\WINXP\system32\services.exe
G:\WINXP\system32\lsass.exe
G:\WINXP\system32\svchost.exe
G:\WINXP\System32\svchost.exe
G:\WINXP\Explorer.EXE
G:\WINXP\system32\spoolsv.exe
G:\WINXP\system32\Rundll32.exe
C:\Program Files\MKS\Bin\mks_menu.exe
C:\Program Files\MKS\Bin\ABregmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\MKS\Bin\NetMonSV.exe
C:\Program Files\MKS\Bin\mksmonsv.exe
G:\WINXP\system32\notepad.exe
G:\WINXP\system32\wscntfy.exe
C:\Program Files\MKS\Bin\mks_scan.exe
G:\Program Files\Internet Explorer\IEXPLORE.EXE
G:\Instalki\dla Packa\spybot, adware, trojan\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.info.stargard.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [MKS_MENU] C:\Program Files\MKS\Bin\mks_menu.exe
O4 - HKLM\..\Run: [ABREGMON] C:\Program Files\MKS\Bin\ABregmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=www.info.stargard.pl
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
===========
Dzieki!!!
|
|
| Back to top |
|
 |
Google
|
| #
30 Aug 2005 18:11 |
|
|
|
|
|
| Back to top |
|
|
jankolo
Poziom 26
Joined: 10 Jan 2005
Posts: 28258
Location: Łódź
|
#2
30 Aug 2005 18:17 Re: lsass.exe |
|
|
|
| stageman wrote: |
| Logfile of HijackThis v1.97.7 |
Proszę ściągnąć AKTUALNĄ wersję hijackthis (1.99). Ta, którą kolega się posłużył, jest zbyt stara.
|
|
| Back to top |
|
|
Google
|
| #
30 Aug 2005 18:17 |
|
|
|
|
|
| Back to top |
|
|
tronic1
Poziom 26
Joined: 06 Feb 2005
Posts: 20006
Location: Police, Alesund-Norwegia
|
#3
30 Aug 2005 18:20 lsass.exe |
|
|
|
Wyłącz w usługach NetBios i zaktualizuj system.
|
|
| Back to top |
|
|
Google
|
| #
30 Aug 2005 18:20 |
|
|
|
|
|
| Back to top |
|
|
stageman
Poziom 15
Joined: 15 Jan 2005
Posts: 211
Location: NewYork
|
#4
30 Aug 2005 19:44 Re: lsass.exe |
|
|
|
| jankolo wrote: |
| stageman wrote: |
| Logfile of HijackThis v1.97.7 |
Proszę ściągnąć AKTUALNĄ wersję hijackthis (1.99). Ta, którą kolega się posłużył, jest zbyt stara. |
sorry, pomylilem sie i wrzucilem loga z innego systemu, ponizszy logfile z wlasciwego systemu i nowszego hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 20:11:34, on 2005-08-30
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Winamp3\winampa.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Eraser\eraser.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\OpenOffice.org1.1.0\program\soffice.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Driver\HijackThis.exe
\?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-2fe89c996183} - c:\program files\steganos internet anonym 7\sia7iep.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide
O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Program Files\OpenOffice.org1.1.0\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 81.222.131.59
O15 - Trusted IP range: 81.222.131.59 (HKLM)
O16 - DPF: komentator - http://sport.onet.pl/komentator.cab
O16 - DPF: {37A49D66-2735-4BB9-8503-82BA5E2333D0} (MailCfg Control) - http://poczta.wp.pl/autoryzacja/mailcfg.ocx
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://D:\ANIA\Autocad\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://D:\ANIA\Autocad\AutoCAD 2002\InstFred.ocx
O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - http://skaner.mks.com.pl/SkanerOnline.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://D:\ANIA\Autocad\AutoCAD 2002\AcPreview.ocx
O20 - Winlogon Notify: BITS - C:\WINDOWS\system32\nalanui.dll
O20 - Winlogon Notify: CSCSettings - C:\WINDOWS\system32\dcraw.dll
O20 - Winlogon Notify: H323TSP - C:\WINDOWS\system32\dlwave.dll
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\dlwave.dll
O20 - Winlogon Notify: MediaContentIndex - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: MS-DOS Emulation - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: NetCache - C:\WINDOWS\system32\mmacm.dll
O20 - Winlogon Notify: Nls - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\ozbccu32.dll
O20 - Winlogon Notify: policies - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\kedsw.dll
O20 - Winlogon Notify: Run - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: Run Once - C:\WINDOWS\system32\dcwave.dll
O20 - Winlogon Notify: RunOnce - C:\WINDOWS\system32\mmacm.dll
O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\mmacm.dll
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\ozbccu32.dll
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\kedsw.dll
O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\dcraw.dll
O20 - Winlogon Notify: ShellScrap - C:\WINDOWS\system32\ozbccu32.dll
O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\ozbccu32.dll
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\ozbccu32.dll
O20 - Winlogon Notify: SMDEn - C:\WINDOWS\system32\nrwrsfr.dll
O20 - Winlogon Notify: StillImage - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\kedsw.dll
O20 - Winlogon Notify: ThemeManager - C:\WINDOWS\system32\dcwave.dll
O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\nrwrsfr.dll
O20 - Winlogon Notify: Uninstall - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: URL - C:\WINDOWS\system32\kedsw.dll
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\dlwave.dll
O20 - Winlogon Notify: WindowsUpdate - C:\WINDOWS\system32\mmacm.dll
O21 - SSODL: ILigxDT - {048495C2-AE2E-3F68-CF9A-5D244BD84DB3} - C:\WINDOWS\System32\rqjjh.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
I musze powtorzyc ze system nie nadaje sie do wspolpracy (100 % uzycia procesora - kazda, najmniejsza czynnosc trwa wieki) wiec operacje typu aktualizajce czy wylaczanie uslug raczej nie wchodza w gre. No chyba ze sa jedyna wlasciwa recepta - wtedy moge poswiecic caly dzien;)
W kazdym razie dzieki za kazde info...
|
|
| Back to top |
|
|
Kolobos
Poziom 26
Joined: 13 Jun 2003
Posts: 26220
Location: Warszawa
|
#5
30 Aug 2005 20:10 lsass.exe |
|
|
|
I nastepny piracki windows bez aktualizacji z tona smieci.
- zmien przegladarke albo zainstaluj aktualizacjie do IE jezeli tego nie zrobisz zaraz bedziesz mial to samo.
- odinstaluj jeden antyvirus i zostaw tylko jeden!
W hijackthis usun:
Uzyj tego:
http://www.searchengines.pl/phpbb203/index.php?s=5debf1bfeab0c89e54567f66c39699f0&act=Attach&type=post&id=459 zeby usunac te wpisy:
O15 - Trusted Zone: *.blazefind.com (HKLM)
O15 - Trusted Zone: *.clickspring.net (HKLM)
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O15 - Trusted Zone: *.flingstone.com (HKLM)
O15 - Trusted Zone: *.mt-download.com (HKLM)
O15 - Trusted Zone: *.my-internet.info (HKLM)
O15 - Trusted Zone: *.searchbarcash.com (HKLM)
O15 - Trusted Zone: *.searchmiracle.com (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotch.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)
O15 - Trusted Zone: *.ysbweb.com (HKLM)
O15 - Trusted IP range: 81.222.131.59
O15 - Trusted IP range: 81.222.131.59 (HKLM)
O20 - Winlogon Notify: BITS - C:\WINDOWS\system32\nalanui.dll <- kasujesz te wszystkie pliki dll, najpierw trzeba je wyrejestrowac o tak:
regsvr32 /u C:\WINDOWS\system32\nalanui.dll i dopiero kasujesz.
O20 - Winlogon Notify: CSCSettings - C:\WINDOWS\system32\dcraw.dll
O20 - Winlogon Notify: H323TSP - C:\WINDOWS\system32\dlwave.dll
O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\dlwave.dll
O20 - Winlogon Notify: MediaContentIndex - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: MS-DOS Emulation - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: NetCache - C:\WINDOWS\system32\mmacm.dll
O20 - Winlogon Notify: Nls - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\ozbccu32.dll
O20 - Winlogon Notify: policies - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\kedsw.dll
O20 - Winlogon Notify: Run - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: Run Once - C:\WINDOWS\system32\dcwave.dll
O20 - Winlogon Notify: RunOnce - C:\WINDOWS\system32\mmacm.dll
O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\mmacm.dll
O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\ozbccu32.dll
O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\kedsw.dll
O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\dcraw.dll
O20 - Winlogon Notify: ShellScrap - C:\WINDOWS\system32\ozbccu32.dll
O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\ozbccu32.dll
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\ozbccu32.dll
O20 - Winlogon Notify: SMDEn - C:\WINDOWS\system32\nrwrsfr.dll
O20 - Winlogon Notify: StillImage - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\kedsw.dll
O20 - Winlogon Notify: ThemeManager - C:\WINDOWS\system32\dcwave.dll
O20 - Winlogon Notify: Themes - C:\WINDOWS\system32\nrwrsfr.dll
O20 - Winlogon Notify: Uninstall - C:\WINDOWS\system32\wrnsrv.dll
O20 - Winlogon Notify: URL - C:\WINDOWS\system32\kedsw.dll
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\dlwave.dll
O20 - Winlogon Notify: WindowsUpdate - C:\WINDOWS\system32\mmacm.dll
O21 - SSODL: ILigxDT - {048495C2-AE2E-3F68-CF9A-5D244BD84DB3} - C:\WINDOWS\System32\rqjjh.dll (file missing)
Na koniec skan tym:
http://download.microsoft.com/download/8/1/5/815d2d60-49b5-44dc-ae35-fca2f2c6f0cc/MicrosoftAntiSpywareInstall.exe
http://download.ewido.net/ewido-setup.exe <- zrob update przed skanowaniem, po przeskanowaniu odinstaluj.
Zamknij porty tym:
www.firewallleaktester.com/tools/wwdc.exe
I wklej nowy log z hijackthis.
|
|
| Back to top |
|
|
