Wmi provider host

Dla specjalistów Bezpieczeństwo
#1

Witam. :slight_smile: Mam problem ze zbyt dużym zużyciem procesora przez WMI.

 

Posiadam laptopa :

  • Procesor: AMD Elite Quad-Core A4-5000M 1,5GHz
  • 17,3" LED 1600x900
  • 8GB DDR3 1600MHz (max 16GB)
  • 1TB HDD (5400rpm, Serial ATA)
  • Karta graficzna: AMD RADEON HD 8330
  • DVD-SuperMulti drive
  • Windows 8

Problem polaga na lagowaniu się gry Legaue Of Lengend, nie występował on wcześniej

 

FRST: http://www.wklej.org/id/1619504/

Addition: http://www.wklej.org/id/1619507/

OTL : http://www.wklej.org/id/1619617/

Extras: http://www.wklej.org/id/1619616/

 

#2

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1420346848&from=cor&uid=ST1000LM024XHN-M101MBB_S31LJ9BDC01396&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1420346848&from=cor&uid=ST1000LM024XHN-M101MBB_S31LJ9BDC01396&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420346848&from=cor&uid=ST1000LM024XHN-M101MBB_S31LJ9BDC01396&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420346848&from=cor&uid=ST1000LM024XHN-M101MBB_S31LJ9BDC01396&q={searchTerms}
BHO: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File
BHO-x32: No Name -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://isearch.omiga-plus.com/?type=sc&ts=1420346848&from=cor&uid=ST1000LM024XHN-M101MBB_S31LJ9BDC01396
2015-01-31 19:32 - 2015-01-31 19:34 - 00730528 _____ ( ) C:\Users\Paweł\Downloads\Skype(13018)-dp.exe
2015-01-31 19:32 - 2015-01-31 19:34 - 00730528 _____ ( ) C:\Users\Paweł\Downloads\Skype(13018)-dp(1).exe
2015-01-25 18:25 - 2015-01-25 18:25 - 00000000 ____ D () C:\Users\Paweł\AppData\Roaming\AVG
2015-01-25 18:21 - 2015-01-25 18:21 - 00000000 ____ D () C:\Users\Paweł\AppData\Local\Avg
2015-01-25 18:20 - 2015-01-25 18:26 - 00000000 ____ D () C:\ProgramData\AVG
2015-01-25 16:37 - 2015-01-25 17:31 - 00000000 ____ D () C:\ProgramData\AVG Security Toolbar
2015-01-25 15:59 - 2015-01-26 13:59 - 00000000 ____ D () C:\ProgramData\AVG2015
2015-01-25 15:59 - 2015-01-25 21:07 - 00000000 ___HD () C:\$AVG
2015-01-25 15:44 - 2015-01-26 13:59 - 00000000 ____ D () C:\ProgramData\MFAData
2015-01-25 15:44 - 2015-01-25 15:44 - 00000000 ____ D () C:\Users\Paweł\AppData\Local\MFAData
2015-01-04 05:48 - 2015-01-25 16:04 - 00000000 ____ D () C:\ProgramData\WindowsMangerProtect
2015-01-04 05:48 - 2015-01-13 18:45 - 00000000 ____ D () C:\ProgramData\IePluginServices
2015-01-04 05:48 - 2015-01-08 23:08 - 00000000 ____ D () C:\Program Files (x86)\SupTab
2015-01-04 05:47 - 2015-01-05 15:23 - 00000000 ____ D () C:\Users\Paweł\AppData\Roaming\omiga-plus
2015-01-15 14:22 - 2014-04-26 16:41 - 00000000 ____ D () C:\ProgramData\McAfee
2015-01-15 14:22 - 2014-04-26 16:41 - 00000000 ____ D () C:\Program Files (x86)\McAfee
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
EmptyTemp:

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition.

#3

fixlog : http://www.wklej.org/id/1620142/

frst: http://www.wklej.org/id/1620157/

 problem nadal występuje… wmi zżra proces

#4

Skasuj C:\FRST

https://support.microsoft.com/kb/331796/pl