komputer zwolnił - jak sprawdzić co robi CPU i HDD ?

21.09.2009

03:30

[3]

darek_dragon [ 42 ]

Nie chcesz wiedzieć...

U_N [ -KOCHAM ANIE- ]

procesy są czyste - niewiele, zużywają nieduzo

Rezor [ NIN ]

Wrzuć tutaj screen z procesami z menadżera zadań.

Spróbuj odpalić na swoim kompie programik hijackthis, zapisz log do pliku, a potem skopiuj jego zawartość na strone hijackthis.de >analiza.

Narmo [ nikt ]

Azazell3 [ Żywy Trup ]

Polecam ten program! Bardzo dobry i pokazuje ci działa w tle itp co najbardziej żzera etc. :)

U_N [ -KOCHAM ANIE- ]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:12:01, on 2009-09-21
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\explorer.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Microsoft Office\Office12\POWERPNT.EXE
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\taskmgr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - ‹06849E9F-C8D7-4D59-B87D-784B7D6BE0B3› - C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: IEVkbdBHO - ‹59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C› - C:\Program Files\Kaspersky Lab\Kaspersky Internet

Security 2010\ievkbd.dll
O2 - BHO: SSVHelper Class - ‹761497BB-D6F0-462C-B6EB-D4DAF1D92D43› - C:\Program Files\Java\jre1.6.0_03

\bin\ssv.dll
O2 - BHO: link filter bho - ‹E33CF602-D945-461A-83F0-819F76A199F8› - C:\Program Files\Kaspersky Lab\Kaspersky

Internet Security 2010\klwtbbho.dll
O3 - Toolbar: (no name) - ‹E0E899AB-F487-11D5-8D29-0050BA6940E3› - (no file)
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [IME JPN 2007 Migration] C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMEJP\IMJPKLMG.EXE /Preload
O4 - HKLM\..\Run: [Korean IME Migration] C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMEKR\IMKRMIG.EXE
O4 - HKLM\..\Run: [Microsoft Pinyin IME Migration] C:\PROGRA~1\COMMON~1\MICROS~1\IME12\IMESC\IMSCMIG.EXE /INSTALL
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL

SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK

SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital

Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - ‹08B0E5C0-4FCB-11CF-AAA5-00401C608501› - C:\Program Files\Java\jre1.6.0_03

\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - ‹08B0E5C0-4FCB-11CF-AAA5-00401C608501› - C:\Program

Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - ‹2670000A-7350-4f3c-8081-5663EE0C6C49› - C:\PROGRA~1\MICROS~3\Office12

\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - ‹2670000A-7350-4f3c-8081-5663EE0C6C49› - C:\PROGRA~1\MICROS~3

\Office12\ONBttnIE.dll
O9 - Extra button: &Virtual keyboard - ‹4248FE82-7FCB-46AC-B270-339F08212110› - C:\Program Files\Kaspersky

Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O9 - Extra button: Research - ‹92780B25-18CC-41C8-B9BE-3C9C571A8263› - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: URLs c&heck - ‹CCF151D8-D089-449F-A5A4-D9909053F20F› - C:\Program Files\Kaspersky

Lab\Kaspersky Internet Security 2010\klwtbbho.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O18 - Protocol: skype4com - ‹FFC8B962-9B40-4DFF-9458-1830C7DD7F5D› - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,C:\PROGRA~1\KASPER~1\KASPER~1

\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky

Internet Security 2010\avp.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program

Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program

Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick

Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game

Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health

Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-

Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio

MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company -

C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common

Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0

\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing

Shared\stllssvr.exe

--
End of file - 7867 bytes

wysiu [ ]

Miales to wkleic na strone, a nie tu.

U_N [ -KOCHAM ANIE- ]

wysiu - wiem, ale ja sie za bardzo na tych procesach nie znam i nie wiem co do czego :/


Hacker pokazuje mi duużo procesów :|
zastanawia mnie po co tyle scchostów ?
wszystkie są w windows\system32

svchost.exe, 976, 3.44 MB, , SYSTEM, Host Process for Windows Services
svchost.exe, 3040, 1.41 MB, , SYSTEM, Host Process for Windows Services
svchost.exe, 2976, 4.17 MB, , LOCAL SERVICE, Host Process for Windows Services
svchost.exe, 2912, 2.15 MB, , NETWORK SERVICE, Host Process for Windows Services
svchost.exe, 1196, 16.4 MB, , LOCAL SERVICE, Host Process for Windows Services
svchost.exe, 1276, 50.25 MB, , SYSTEM, Host Process for Windows Services, 24 B/s
svchost.exe, 2012, 11.87 MB, , LOCAL SERVICE, Host Process for Windows Services
svchost.exe, 1668, 19.1 MB, , NETWORK SERVICE, Host Process for Windows Services
svchost.exe, 1496, 8.21 MB, , LOCAL SERVICE, Host Process for Windows Services, 582 B/s
svchost.exe, 1048, 4.36 MB, , NETWORK SERVICE, Host Process for Windows Services
svchost.exe, 2236, 6.46 MB, , SYSTEM, Host Process for Windows Services
svchost.exe, 1092, 59.16 MB, , SYSTEM, Host Process for Windows Services
svchost.exe, 1348, 41.77 MB, , SYSTEM, Host Process for Windows Services, 16 B/s

sikham [ Generaďż˝ ]

może poprostu włączył Ci się tryb PIO na dysku ?

Rezor [ NIN ]

Log Hijackthis pokazuje jasno, że masz tam jakiś śmieć. Nie wiem czy to jest winą danego stanu rzeczy ale lepiej sie tego pozbyc. Jak?

Skanujesz jeszcze raz komp hijackthis -em, nie zamykasz programu!, zapisujesz do pliku, wklejasz zawartość pliku na strone, tam gdzie na stronie jest X to tą samą wartość zaznaczasz w programie. Na koniec dajesz Fix.

Procesów svchost jest odpowiednia ilośc, tym się nie martw. Czasem trojany podszywają się pod ten dość istotny proces, ale wtedy jego nazwa ulega zmianie na np svhost.

sikham --- dysk na pewno pracuje w trybie sata więc ta opcja nie wchodzi w gre.