Obciążenie procesora 100 %

kamyk59 · 11 Wrzesień 2007 12:48

Proszę o znalezienie przyczyny 100 % obciążenia procesora praktycznie cały czas w czasie połączenia z netem.

Oto log :

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:43:34, on 2007-09-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Eset\nod32kui.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Netia\Net\netianet.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe D:\Program Files\Gadu-Gadu\gg.exe D:\Program Files\Winamp\winamp.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM…\Run: [nod32kui] “C:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKLM…\Run: [ZoneAlarm Client] “C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” O4 - HKLM…\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe -auto O4 - HKLM…\Run: [speedTouch USB Diagnostics] “C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” /icon O4 - HKCU…\Run: [Gadu-Gadu] “D:\Program Files\Gadu-Gadu\gg.exe” /tray O4 - HKCU…\Run: [Odkurzacz-MCD] D:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\MICROS~1\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\MICROS~1\INetRepl.dll O9 - Extra ‘Tools’ menuitem: Utwórz Ulubione dla urządzenia przenośnego… - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\PROGRA~1\MICROS~1\INetRepl.dll O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {70B410C0-BADA-11D4-8308-0080C8D7ED4A} (GameDesire Bridge) - http://67.15.101.33/g_bin/pl/bridge_2_0_0_24.cab O17 - HKLM\System\CCS\Services\Tcpip…{68B1A016-DBF5-43A4-8D2E-439ADB33E428}: NameServer = 213.241.79.37 83.238.255.76 O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe – End of file - 3553 bytes

Gutek · 11 Wrzesień 2007 23:21

Daj log z ComboFix

kamyk59 · 12 Wrzesień 2007 08:44

ComboFix 07-08-30.3 - “mariusz” 2007-09-01 11:31:47.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.151 [GMT 2:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\sisport.sys ((((((((((((((((((((((((( Files Created from 2007-08-01 to 2007-09-01 ))))))))))))))))))))))))))))))) 2007-09-01 11:29 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-30 17:42 2007-08-28 17:15 2007-08-27 14:12 2007-08-27 13:56 36,352 --------- C:\WINDOWS\system32\tsgqec.dll 2007-08-27 13:56 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll 2007-08-27 13:56 116,736 --------- C:\WINDOWS\system32\aaclient.dll 2007-08-27 13:50 2007-08-27 13:42 36,864 -----c— C:\WINDOWS\system32\dllcache\hidclass.sys 2007-08-27 13:36 2007-08-27 13:26 2007-08-27 13:26 2007-08-27 13:24 2007-08-27 13:22 59,264 -----c— C:\WINDOWS\system32\dllcache\usbhub.sys 2007-08-27 13:22 30,208 -----c— C:\WINDOWS\system32\dllcache\usbehci.sys 2007-08-27 13:22 20,608 -----c— C:\WINDOWS\system32\dllcache\usbuhci.sys 2007-08-27 13:22 17,152 -----c— C:\WINDOWS\system32\dllcache\usbohci.sys 2007-08-27 13:22 143,488 -----c— C:\WINDOWS\system32\dllcache\usbport.sys 2007-08-27 13:20 62,336 --------- C:\WINDOWS\system32\drivers\rspndr.sys 2007-08-27 13:20 10,752 --------- C:\WINDOWS\system32\rspndr.exe 2007-08-27 13:19 2007-08-27 13:17 2007-08-27 11:55 2007-08-27 11:51 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2007-08-27 10:39 2007-08-27 10:26 2007-08-27 10:15 40,960 --a------ C:\WINDOWS\system32\SSUBTMR6.DLL 2007-08-27 10:15 32,584 --a------ C:\WINDOWS\system32\FM20ENU.DLL 2007-08-27 10:15 10,752 --a------ C:\WINDOWS\system32\aamd532.dll 2007-08-27 10:15 1,146,184 --a------ C:\WINDOWS\system32\FM20.DLL 2007-08-26 15:05 2007-08-24 10:03 2007-08-22 09:53 2007-08-19 20:27 2007-08-16 08:30 2007-08-16 08:25 32,000 --a------ C:\WINDOWS\system32\drivers\stppp.sys 2007-08-16 08:25 30,464 --a------ C:\WINDOWS\system32\drivers\st330.sys 2007-08-16 08:25 16,128 --a------ C:\WINDOWS\system32\drivers\lpwdm.sys 2007-08-16 08:25 12,672 --a------ C:\WINDOWS\system32\drivers\stbus.sys 2007-08-15 08:59 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-08-09 11:22 796,672 --a------ C:\WINDOWS\GPInstall.exe 2007-08-07 12:39 2007-08-07 12:39 2007-08-07 12:37 2007-08-07 12:37 2007-08-01 19:57 2007-08-01 19:50 120,056 --------- C:\WINDOWS\system32\pxcpyi64.exe 2007-08-01 19:50 118,520 --------- C:\WINDOWS\system32\pxinsi64.exe 2007-08-01 19:49 2007-08-01 19:29 234 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-08-01 19:29 234 --a------ C:\WINDOWS\system32\WMV9VCM.dll 2007-08-01 19:29 234 --a------ C:\WINDOWS\system32\vorbisenc.dll 2007-08-01 19:29 234 --a------ C:\WINDOWS\system32\vorbis.dll 2007-08-01 19:29 234 --a------ C:\WINDOWS\system32\OggDS.dll 2007-08-01 19:29 234 --a------ C:\WINDOWS\system32\ogg.dll 2007-08-01 19:29 234 --a------ C:\WINDOWS\system32\mplvpx.dll 2007-08-01 19:29 234 --a------ C:\WINDOWS\system32\cpuinf32.dll (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-09-01 09:23 131576 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2007-09-01 09:23 11046944 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2007-08-31 08:57 --------- d-------- C:\DOCUME~1\mariusz\DANEAP~1\OpenOffice.org2 2007-08-28 17:16 33 --a------ C:\WINDOWS\system32\drivers\adidsl.cfg 2007-08-28 17:15 --------- d–h----- C:\Program Files\InstallShield Installation Information 2007-08-28 17:12 --------- d-------- C:\Program Files\neostrada tp 2007-08-27 09:58 --------- d-------- C:\Program Files\Mozilla Thunderbird 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-29 18:15 --------- d-------- C:\DOCUME~1\mariusz\DANEAP~1\Thunderbird 2007-07-29 12:50 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Spybot - Search & Destroy 2007-07-29 12:19 --------- d-------- C:\DOCUME~1\mariusz\DANEAP~1\Lavasoft 2007-07-29 09:42 --------- d-------- C:\Program Files\Anti Trojan Elite 2007-07-27 01:06 129784 --------- C:\WINDOWS\system32\pxafs.dll 2007-07-26 10:08 --------- d-------- C:\Program Files\Hewlett-Packard 2007-07-25 10:05 45056 --a------ C:\WINDOWS\NCUNINST.EXE 2007-07-25 09:13 --------- d-------- C:\Program Files\Common Files\SWF Studio 2007-07-24 12:47 --------- d-------- C:\Program Files\OpenOffice.org 2.2 2007-07-24 11:31 50688 --a------ C:\WINDOWS\system32\wbhelp2.dll 2007-07-24 09:37 --------- d-------- C:\Program Files\PLANET WL-U356A 2007-07-19 20:34 --------- d-------- C:\DOCUME~1\mariusz\DANEAP~1\Help 2007-07-19 09:19 --------- d-------- C:\Program Files\PROKOM Software SA 2007-07-19 09:15 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-07-19 08:13 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-07-19 08:13 298104 --a------ C:\WINDOWS\system32\imon.dll 2007-07-19 08:13 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-07-19 07:42 --------- d-------- C:\Program Files\SiS Compatible VGA V2.11 2007-07-19 07:39 --------- d-------- C:\Program Files\AvRack 2007-07-18 21:05 4 --a------ C:\WINDOWS\system32\proc-220146841.bin 2007-07-18 21:05 --------- d-------- C:\DOCUME~1\mariusz\DANEAP~1\GanymedeNet 2007-07-18 20:55 --------- d-------- C:\Program Files\Winamp 2007-07-18 18:10 --------- d-------- C:\DOCUME~1\mariusz\DANEAP~1\Gadu-Gadu 2007-07-18 17:42 75932 --a------ C:\WINDOWS\system32\drivers\klick.dat 2007-07-18 17:42 74396 --a------ C:\WINDOWS\system32\drivers\klin.dat 2007-07-18 15:28 --------- d-------- C:\DOCUME~1\mariusz\DANEAP~1\Opera 2007-07-18 15:04 --------- d-------- C:\Program Files\microsoft frontpage 2007-06-26 08:10 1104896 --a------ C:\WINDOWS\system32\msxml3.dll 2007-06-21 21:54 75248 --a------ C:\WINDOWS\zllsputility.exe 2007-06-21 21:54 1086952 --a------ C:\WINDOWS\system32\zpeng24.dll 2007-06-19 15:32 282112 --a------ C:\WINDOWS\system32\gdi32.dll 2007-06-13 15:23 1034752 --a------ C:\WINDOWS\explorer.exe --------- C:\Program Files\Usługi online ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “nod32kui”=“C:\Program Files\Eset\nod32kui.exe” [2007-07-19 08:13] “ZoneAlarm Client”=“C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe” [2007-06-21 21:54] “NETIANET”=“C:\Program Files\Netia\Net\netianet.exe” [2007-05-18 15:10] “SpeedTouch USB Diagnostics”=“C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe” [2004-03-23 12:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “Gadu-Gadu”=“D:\Program Files\Gadu-Gadu\gg.exe” [2007-07-09 09:39] “Odkurzacz-MCD”=“D:\Program Files\Odkurzacz\odk_mcd.exe” [2007-05-03 10:02] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2006-03-02 14:00] “H/PC Connection Agent”=“D:\Program Files\Microsoft ActiveSync\wcescomm.exe” [2006-11-13 15:57] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] “NoRecentDocsMenu”=1 (0x1) “NoSMConfigurePrograms”=1 (0x1) “NoSharedDocuments”=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^mariusz^Menu Start^Programy^Autostart^OpenOffice.org 2.2.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^mariusz^Menu Start^Programy^Autostart^Skrót do subs ad.lnk] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] “D:\Program Files\DAP\DAP.EXE” /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent] “D:\Program Files\Microsoft ActiveSync\wcescomm.exe” [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS KHooker] C:\WINDOWS\system32\khooker.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiS Tray] C:\WINDOWS\system32\sistray.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StatusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] D:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys S3 ATE_PROCMON;ATE_PROCMON;??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;??\C:\WINDOWS\system32\NSNDIS5.SYS S3 ST330;ST330;C:\WINDOWS\system32\drivers\st330.sys S3 STBUS;STBUS;C:\WINDOWS\system32\drivers\stbus.sys S3 stppp;Speedtouch PPP Adapter Adapter;C:\WINDOWS\system32\DRIVERS\stppp.sys S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS S3 ZD1211BU(AirLive);AirLive WL-5480USB WLAN USB Driver(AirLive);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys S3 ZD1211BU(PLANET Technology Corp.);PLANET WL-U356A Driver(PLANET Technology Corp.);C:\WINDOWS\system32\DRIVERS\zd1211Bu.sys S3 ZD1211U(PLANET Technology Corp.);PLANET WL-U356A Driver(PLANET Technology Corp.);C:\WINDOWS\system32\DRIVERS\zd1211u.sys *Newly Created Service* - CATCHME Contents of the ‘Scheduled Tasks’ folder 2007-08-29 16:15:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-01 11:40:38 Windows 5.1.2600 Dodatek Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-09-01 11:44:59 C:\ComboFix-quarantined-files.txt … 2007-09-01 11:44 — E O F —

Gutek · 12 Wrzesień 2007 21:05

Optymalizacja XP: http://forum.dobreprogramy.pl/viewtopic.php?t=76580

Pobierz program SDFix

kamyk59 · 13 Wrzesień 2007 04:55

SDFix: Version 1.104 Run by mariusz on 2007-09-13 at 06:43 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] Remaining Files: --------------- Files with Hidden Attributes: Finished!

jessica · 13 Wrzesień 2007 07:26

Jak widać - SDFix też nic podejrzanego nie wykrył.

Ani w Hijacku, ani w ComboFix też nic nie było.

W takim razie można wykluczyć przyczyny wirusowe.

Zajmij się optymalizacją systemu, zaleconą wcześmiej przez @Gutka2222.

jessi

kamyk59 · 13 Wrzesień 2007 09:12

A to :

S3 ATE_PROCMON;ATE_PROCMON;\Pytajnik\C:\Program Files\Anti Trojan Elite\ATEPMon.sys

S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;\Pytajnik\C:\WINDOWS\system32\NSNDIS5.SYS

Spróbuję jeszcze optymalizacji.Dzięki na razie - jeśli nie pomoże poproszę o inne sposoby.

jessica · 13 Wrzesień 2007 09:49

Przecież masz zainstalowany “Anti Trojan Elite”.

A pytajniki są dlatego, że ta usługa jest od niedawna, więc ComboFix jej jeszcze nie zweryfikował. Nie przejmuj się tą usługą i zostaw ją w spokoju.

NSNDIS5.SYS

Printing Communications Assoc., Inc. (PCAUSA)

MD5:53F7546E8DAEFB3A0813F5E19C4613C9

is safe to use.

http://www.runscanner.net/getmd5.aspx?MD5=53F7546E8DAEFB3A0813F5E19C4613C9&process=nsndis5.sys

Pytajniki są też chyba z tego samego powodu, co poprzednio.

jessi