WMI Provider Host využívá CPU na 100procent

[zail]

Dobry den
prosim o kontrolu logu, najednou zniceho nic mi WMI spotrebovava temer veskere CPU
dekuji z log z FRST

[Rudy]

Zdravím!
Spusťte tuto utilitu:

Ulozte na plochu AdwCleaner https://malwarebytes.com/adwcleaner/ nebo http://www.bleepingcomputer.com/download/adwcleaner/

ukoncete vsechny programy
odsouhlaste licencni podmiky (EULA) klikem na Souhlasim
kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
kliknete na Skenovat nyni (Scan now), pote na Cisteni a opravy (Clean and Repair)
po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\Logs\AdwCleaner[Cxx].txt), jehoz obsah zkopirujte do pristi odpovedi

[zail]

zde log

# -------------------------------
# Malwarebytes AdwCleaner 8.0.0.0
# -------------------------------
# Build: 11-21-2019
# Database: 2019-11-26.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 12-11-2019
# Duration: 00:00:03
# OS: Windows 10 Home
# Cleaned: 24
# Failed: 3


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

Deleted C:\Program Files (x86)\Seznam.cz
Deleted C:\Users\Public\Documents\Downloaded Installers
Deleted C:\Users\lukas_000\AppData\Roaming\Seznam.cz

***** [ Files ] *****

Deleted C:\Windows\System32\drivers\swdumon.sys

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKCU\Software\AppDataLow\Software\Seznam.cz
Deleted HKCU\Software\Seznam.cz
Deleted HKCU\Software\csastats
Deleted HKLM\SYSTEM\Setup\FirstBoot\Services\SWDUMon
Deleted HKLM\Software\Wow6432Node\Seznam.cz
Deleted HKLM\Software\Wow6432Node\SlimWare Utilities Inc

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

Deleted Amazon
Deleted DAEMON Search
Deleted Filmova databaze (FDb.cz)
Deleted Google
Deleted ICQ Search
Deleted ICQ Search
Deleted MyVideo
Deleted OTTO
Deleted Preisvergleich
Deleted Softonic DE
Deleted Softonic EN
Deleted Trovi search
Deleted Wikipedia
Deleted eBay.de
Not Deleted Jookz
Not Deleted Trovi search
Not Deleted Yahoo! Search

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [6419 octets] - [11/12/2019 20:07:11]
AdwCleaner_Debug.log - [4093 octets] - [11/12/2019 20:09:30]
AdwCleaner[S01].txt - [6542 octets] - [11/12/2019 20:10:40]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C01].txt ##########

[zail]

jeste bych chtel podotknout, ze zatizeni nastavalo v momentu kdy byl spusten blizard client nebo twitch aplikace. Ted co jsem to projel tim adv cleanrem sem i se spustenim obouch aplikaci na 13% zatizeni coz asi uz bude standart

[Rudy]

Nejspše to způsobovalo sw od Seznamu, nicméně ještě dočistíme. Dejte nové logy FRST+Addition.

[zail]

zde log

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

Start

CloseProcesses:
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {3BD694A4-826D-4B86-981E-EEB71B082B99} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107848 2015-07-03] (Google Inc -> Google Inc.)
Task: {9FA1E9DF-D71C-4728-9690-646030A528CD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107848 2015-07-03] (Google Inc -> Google Inc.)
Task: {F21E5935-D0CA-4735-99B2-0FABE6DA58B6} - \avastBCLRestart_chrome.exe -> No File <==== ATTENTION
C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
FirewallRules: [{11AC1184-A83E-4E47-B7C0-5B5CD56FD8A0}] => (Allow) E:\steam\steamapps\common\I am Alive\src\SYSTEM\IAmAlive_game.exe No File
FirewallRules: [{9B264ABF-C996-47AB-B11E-42A44AEFC51C}] => (Allow) E:\steam\steamapps\common\I am Alive\src\SYSTEM\IAmAlive_game.exe No File
FirewallRules: [UDP Query User{F3C6C780-26CB-481D-8225-3B311522C1C8}E:\far cry3\far cry 3\bin\farcry3_d3d11.exe] => (Allow) E:\far cry3\far cry 3\bin\farcry3_d3d11.exe No File
FirewallRules: [TCP Query User{5A81F55F-0A40-49F1-8C8A-9DA89CE7DEC9}E:\far cry3\far cry 3\bin\farcry3_d3d11.exe] => (Allow) E:\far cry3\far cry 3\bin\farcry3_d3d11.exe No File
FirewallRules: [UDP Query User{0AA098A6-D796-4B23-B56E-484978D484FB}E:\far cry3\far cry 3\bin\farcry3.exe] => (Allow) E:\far cry3\far cry 3\bin\farcry3.exe No File
FirewallRules: [TCP Query User{99911A49-C3BD-41BD-9DED-356E520592AD}E:\far cry3\far cry 3\bin\farcry3.exe] => (Allow) E:\far cry3\far cry 3\bin\farcry3.exe No File
FirewallRules: [TCP Query User{52940D21-89FA-469F-BA52-4F2B74733B5F}J:\easysetupassistant\easysetupassistant.exe] => (Allow) J:\easysetupassistant\easysetupassistant.exe No File
FirewallRules: [UDP Query User{A4DB45FA-8C44-43CE-BDD6-A0D8022BCC81}J:\easysetupassistant\easysetupassistant.exe] => (Allow) J:\easysetupassistant\easysetupassistant.exe No File
FirewallRules: [{1674712D-D83F-4241-B34A-16DE2E39B1B2}] => (Allow) E:\steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{C932A57E-7C65-4CFE-ACD1-68777568AD99}] => (Allow) E:\steam\bin\cef\cef.win7\steamwebhelper.exe No File

EmptyTemp:
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

[zail]

Fix result of Farbar Recovery Scan Tool (x64) Version: 07-12-2019
Ran by lukas_000 (11-12-2019 22:01:44) Run:1
Running from C:\Users\lukas_000\Desktop
Loaded Profiles: lukas_000 (Available Profiles: lukas_000)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start

CloseProcesses:
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction <==== ATTENTION
Task: {3BD694A4-826D-4B86-981E-EEB71B082B99} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107848 2015-07-03] (Google Inc -> Google Inc.)
Task: {9FA1E9DF-D71C-4728-9690-646030A528CD} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107848 2015-07-03] (Google Inc -> Google Inc.)
Task: {F21E5935-D0CA-4735-99B2-0FABE6DA58B6} - \avastBCLRestart_chrome.exe -> No File <==== ATTENTION
C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
FirewallRules: [{11AC1184-A83E-4E47-B7C0-5B5CD56FD8A0}] => (Allow) E:\steam\steamapps\common\I am Alive\src\SYSTEM\IAmAlive_game.exe No File
FirewallRules: [{9B264ABF-C996-47AB-B11E-42A44AEFC51C}] => (Allow) E:\steam\steamapps\common\I am Alive\src\SYSTEM\IAmAlive_game.exe No File
FirewallRules: [UDP Query User{F3C6C780-26CB-481D-8225-3B311522C1C8}E:\far cry3\far cry 3\bin\farcry3_d3d11.exe] => (Allow) E:\far cry3\far cry 3\bin\farcry3_d3d11.exe No File
FirewallRules: [TCP Query User{5A81F55F-0A40-49F1-8C8A-9DA89CE7DEC9}E:\far cry3\far cry 3\bin\farcry3_d3d11.exe] => (Allow) E:\far cry3\far cry 3\bin\farcry3_d3d11.exe No File
FirewallRules: [UDP Query User{0AA098A6-D796-4B23-B56E-484978D484FB}E:\far cry3\far cry 3\bin\farcry3.exe] => (Allow) E:\far cry3\far cry 3\bin\farcry3.exe No File
FirewallRules: [TCP Query User{99911A49-C3BD-41BD-9DED-356E520592AD}E:\far cry3\far cry 3\bin\farcry3.exe] => (Allow) E:\far cry3\far cry 3\bin\farcry3.exe No File
FirewallRules: [TCP Query User{52940D21-89FA-469F-BA52-4F2B74733B5F}J:\easysetupassistant\easysetupassistant.exe] => (Allow) J:\easysetupassistant\easysetupassistant.exe No File
FirewallRules: [UDP Query User{A4DB45FA-8C44-43CE-BDD6-A0D8022BCC81}J:\easysetupassistant\easysetupassistant.exe] => (Allow) J:\easysetupassistant\easysetupassistant.exe No File
FirewallRules: [{1674712D-D83F-4241-B34A-16DE2E39B1B2}] => (Allow) E:\steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{C932A57E-7C65-4CFE-ACD1-68777568AD99}] => (Allow) E:\steam\bin\cef\cef.win7\steamwebhelper.exe No File

EmptyTemp:
End
*****************

Processes closed successfully.
HKLM\SOFTWARE\Policies\Mozilla => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{3BD694A4-826D-4B86-981E-EEB71B082B99}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3BD694A4-826D-4B86-981E-EEB71B082B99}" => removed successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => removed successfully
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9FA1E9DF-D71C-4728-9690-646030A528CD} => removed successfully
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9FA1E9DF-D71C-4728-9690-646030A528CD} => removed successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA => moved successfully
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA => removed successfully
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F21E5935-D0CA-4735-99B2-0FABE6DA58B6} => removed successfully
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F21E5935-D0CA-4735-99B2-0FABE6DA58B6} => removed successfully
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\avastBCLRestart_chrome.exe => removed successfully
"C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA" => not found
"C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore" => not found
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{11AC1184-A83E-4E47-B7C0-5B5CD56FD8A0}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{9B264ABF-C996-47AB-B11E-42A44AEFC51C}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{F3C6C780-26CB-481D-8225-3B311522C1C8}E:\far cry3\far cry 3\bin\farcry3_d3d11.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{5A81F55F-0A40-49F1-8C8A-9DA89CE7DEC9}E:\far cry3\far cry 3\bin\farcry3_d3d11.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{0AA098A6-D796-4B23-B56E-484978D484FB}E:\far cry3\far cry 3\bin\farcry3.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{99911A49-C3BD-41BD-9DED-356E520592AD}E:\far cry3\far cry 3\bin\farcry3.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{52940D21-89FA-469F-BA52-4F2B74733B5F}J:\easysetupassistant\easysetupassistant.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{A4DB45FA-8C44-43CE-BDD6-A0D8022BCC81}J:\easysetupassistant\easysetupassistant.exe" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{1674712D-D83F-4241-B34A-16DE2E39B1B2}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{C932A57E-7C65-4CFE-ACD1-68777568AD99}" => removed successfully

=========== EmptyTemp: ==========

BITS transfer queue => 12083200 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 12801918 B
Java, Flash, Steam htmlcache => 436277185 B
Windows/system/drivers => 0 B
Edge => 68592 B
Chrome => 203335983 B
Firefox => 0 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 0 B
lukas_000 => 27117606 B

RecycleBin => 170675 B
EmptyTemp: => 659.8 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 22:02:05 ====

[Rudy]

Smazáno, log je již OK.

[zail]

dekuji

[Rudy]

Rádo se stalo!