Wysokie użycie CPU przez lsass.exe i winlogon.exe w Windows XP Home Edition

Question

Witam Mam taki oto problem w XP Home Edition: system nie nadaje sie do pracy bo dwa procesy: lsass.exe i winlogon.exe zajmuja cala pamiec CPU i poza tym tworzy sie mnostwo procesow rundll32.exe. Nie wykrywam zadnych wirusow dwoma antywirusami (m.in. aktualny mks_vir). Nie wydaje mi sie aby byl...

jankolo · Answer

Proszę ściągnąć AKTUALNĄ wersję hijackthis (1.99). Ta, którą kolega się posłużył, jest zbyt stara.

tronic1 · Answer

Wyłącz w usługach NetBios i zaktualizuj system.

stageman · Answer

sorry, pomylilem sie i wrzucilem loga z innego systemu, ponizszy logfile z wlasciwego systemu i nowszego hijackthis: Logfile of HijackThis v1.99.1 Scan saved at 20:11:34, on 2005-08-30 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\System32\CTsvcCDA.EXE C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Winamp3\winampa.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINDOWS\System32vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Eraser\eraser.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\OpenOffice.org1.1.0\program\soffice.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Driver\HijackThis.exe \?\C:\WINDOWS\system32\WBEM\WMIADAP.EXE C:\Program Files\Alwil Software\Avast4\setup\avast.setup R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O3 - Toolbar: Steganos Internet Anonym - {00000000-5736-4205-0008-2fe89c996183} - c:\program files\steganos internet anonym 7\sia7iep.dll O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe /s O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp3\winampa.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0 O4 - HKCU\..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe /tray O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe -hide O4 - Startup: OpenOffice.org 1.1.0.lnk = C:\Program Files\OpenOffice.org1.1.0\program\quickstart.exe O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O15 - Trusted Zone: *.blazefind.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: (HKLM) O15 - Trusted Zone: *.flingstone.com (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.searchbarcash.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - Trusted IP range: 81.222.131.59 O15 - Trusted IP range: 81.222.131.59 (HKLM) O16 - DPF: komentator - O16 - DPF: {37A49D66-2735-4BB9-8503-82BA5E2333D0} (MailCfg Control) - O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://D:\ANIA\Autocad\AutoCAD 2002\InstBanr.ocx O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://D:\ANIA\Autocad\AutoCAD 2002\InstFred.ocx O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} (MainControl Class) - O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://D:\ANIA\Autocad\AutoCAD 2002\AcPreview.ocx O20 - Winlogon Notify: BITS - C:\WINDOWS\system32alanui.dll O20 - Winlogon Notify: CSCSettings - C:\WINDOWS\system32\dcraw.dll O20 - Winlogon Notify: H323TSP - C:\WINDOWS\system32\dlwave.dll O20 - Winlogon Notify: Internet Settings - C:\WINDOWS\system32\dlwave.dll O20 - Winlogon Notify: MediaContentIndex - C:\WINDOWS\system32\wrnsrv.dll O20 - Winlogon Notify: MS-DOS Emulation - C:\WINDOWS\system32\wrnsrv.dll O20 - Winlogon Notify: NetCache - C:\WINDOWS\system32\mmacm.dll O20 - Winlogon Notify: Nls - C:\WINDOWS\system32\wrnsrv.dll O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\ozbccu32.dll O20 - Winlogon Notify: policies - C:\WINDOWS\system32\wrnsrv.dll O20 - Winlogon Notify: Reliability - C:\WINDOWS\system32\kedsw.dll O20 - Winlogon Notify: Run - C:\WINDOWS\system32\wrnsrv.dll O20 - Winlogon Notify: Run Once - C:\WINDOWS\system32\dcwave.dll O20 - Winlogon Notify: RunOnce - C:\WINDOWS\system32\mmacm.dll O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\mmacm.dll O20 - Winlogon Notify: Setup - C:\WINDOWS\system32\ozbccu32.dll O20 - Winlogon Notify: SharedDLLs - C:\WINDOWS\system32\wrnsrv.dll O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\system32\kedsw.dll O20 - Winlogon Notify: ShellCompatibility - C:\WINDOWS\system32\dcraw.dll O20 - Winlogon Notify: ShellScrap - C:\WINDOWS\system32\ozbccu32.dll O20 - Winlogon Notify: ShellServiceObjectDelayLoad - C:\WINDOWS\system32\ozbccu32.dll O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\ozbccu32.dll O20 - Winlogon Notify: SMDEn - C:\WINDOWS\system32rwrsfr.dll O20 - Winlogon Notify: StillImage - C:\WINDOWS\system32\wrnsrv.dll O20 - Winlogon Notify: Syncmgr - C:\WINDOWS\system32\kedsw.dll O20 - Winlogon Notify: ThemeManager - C:\WINDOWS\system32\dcwave.dll O20 - Winlogon Notify: Themes - C:\WINDOWS\system32rwrsfr.dll O20 - Winlogon Notify: Uninstall - C:\WINDOWS\system32\wrnsrv.dll O20 - Winlogon Notify: URL - C:\WINDOWS\system32\kedsw.dll O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\dlwave.dll O20 - Winlogon Notify: WindowsUpdate - C:\WINDOWS\system32\mmacm.dll O21 - SSODL: ILigxDT - {048495C2-AE2E-3F68-CF9A-5D244BD84DB3} - C:\WINDOWS\System32\rqjjh.dll (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe /service (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32vsvc32.exe I musze powtorzyc ze system nie nadaje sie do wspolpracy (100 % uzycia procesora - kazda, najmniejsza czynnosc trwa wieki) wiec operacje typu aktualizajce czy wylaczanie uslug raczej nie wchodza w gre. No chyba ze sa jedyna wlasciwa recepta - wtedy moge poswiecic caly dzien;) W kazdym razie dzieki za kazde info...

Kolobos · Answer

I nastepny piracki windows bez aktualizacji z tona smieci. - zmien przegladarke albo zainstaluj aktualizacjie do IE jezeli tego nie zrobisz zaraz bedziesz mial to samo. - odinstaluj jeden antyvirus i zostaw tylko jeden! W hijackthis usun: Uzyj tego: zeby usunac te wpisy: O15 - Trusted Zone: *.blazefind.com (HKLM) O15 - Trusted Zone: *.clickspring.net (HKLM) O15 - Trusted Zone: (HKLM) O15 - Trusted Zone: *.flingstone.com (HKLM) O15 - Trusted Zone: *.mt-download.com (HKLM) O15 - Trusted Zone: *.my-internet.info (HKLM) O15 - Trusted Zone: *.searchbarcash.com (HKLM) O15 - Trusted Zone: *.searchmiracle.com (HKLM) O15 - Trusted Zone: *.skoobidoo.com (HKLM) O15 - Trusted Zone: *.slotch.com (HKLM) O15 - Trusted Zone: *.slotchbar.com (HKLM) O15 - Trusted Zone: *.windupdates.com (HKLM) O15 - Trusted Zone: *.xxxtoolbar.com (HKLM) O15 - Trusted Zone: *.ysbweb.com (HKLM) O15 - Trusted IP range: 81.222.131.59 O15 - Trusted IP range: 81.222.131.59 (HKLM) O20 - Winlogon Notify: BITS - C:\WINDOWS\system32alanui.dll

Wysokie użycie CPU przez lsass.exe i winlogon.exe w Windows XP Home Edition

Post #1

Post #2

Post #3

Post #4

Post #5