Jump to content

windows 7 x64 high cpu usage


johndi

Recommended Posts

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 20:38:13, on 10.11.2009

Platform: Unknown Windows (WinNT 6.01.3504)

MSIE: Internet Explorer v8.00 (8.00.7600.16385)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe

C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe

C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe

C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

C:\Program Files (x86)\uTorrent\uTorrent.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F2 - REG:system.ini: UserInit=userinit.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2010\ievkbd.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)

O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll

O4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe"

O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files (x86)\Unlocker\UnlockerAssistant.exe"

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O4 - Startup: Logitech . Înregistrare de Produse.lnk = C:\Program Files (x86)\Common Files\LogiShrd\eReg\SetPoint\eReg.exe

O4 - Startup: RDS - Shortcut.lnk = ?

O4 - Global Startup: Logitech SetPoint.lnk = ?

O4 - Global Startup: RDS - Shortcut.lnk = ?

O9 - Extra button: &Virtual keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2010\klwtbbho.dll

O13 - Gopher Prefix:

O17 - HKLM\System\CCS\Services\Tcpip\..\{7F1E3AE2-67E9-4566-89F1-87BF58B1069A}: NameServer = 213.154.124.1 193.231.252.1

O17 - HKLM\System\CS1\Services\Tcpip\..\{7F1E3AE2-67E9-4566-89F1-87BF58B1069A}: NameServer = 213.154.124.1 193.231.252.1

O17 - HKLM\System\CS2\Services\Tcpip\..\{7F1E3AE2-67E9-4566-89F1-87BF58B1069A}: NameServer = 213.154.124.1 193.231.252.1

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd3.dll

O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe

O23 - Service: Acronis Nonstop Backup service (afcdpsrv) - Acronis - C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)

O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe

O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - PC Tools - C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe

O23 - Service: PDAgent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe

O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--

End of file - 8208 bytes

utorrentx.th.jpg

Link to comment
Share on other sites

Process PID CPU Description Company Name

System Idle Process 0 86.36

Interrupts n/a Hardware Interrupts

DPCs n/a Deferred Procedure Calls

System 4

smss.exe 544 Windows Session Manager Microsoft Corporation

csrss.exe 756 Client Server Runtime Process Microsoft Corporation

wininit.exe 832 Windows Start-Up Application Microsoft Corporation

services.exe 880 Services and Controller app Microsoft Corporation

svchost.exe 628 Host Process for Windows Services Microsoft Corporation

klwtblfs.exe 1324 WebToolBar component Kaspersky Lab

svchost.exe 676 Host Process for Windows Services Microsoft Corporation

atiesrxx.exe 848 AMD External Events Service Module AMD

atieclxx.exe 1452 AMD External Events Client Module AMD

svchost.exe 1048 Host Process for Windows Services Microsoft Corporation

svchost.exe 1092 Host Process for Windows Services Microsoft Corporation

dwm.exe 1812 0.76 Desktop Window Manager Microsoft Corporation

svchost.exe 1144 Host Process for Windows Services Microsoft Corporation

svchost.exe 1284 Host Process for Windows Services Microsoft Corporation

svchost.exe 1392 Host Process for Windows Services Microsoft Corporation

spoolsv.exe 1576 Spooler SubSystem App Microsoft Corporation

svchost.exe 1612 Host Process for Windows Services Microsoft Corporation

taskhost.exe 1740 Host Process for Windows Tasks Microsoft Corporation

schedul2.exe 1892 Acronis Scheduler 2 Acronis

schedhlp.exe 2036 Acronis Scheduler Helper Acronis

afcdpsrv.exe 1932 File Level CDP Manager Service Acronis

avp.exe 1220 Kaspersky Anti-Virus Kaspersky Lab

mDNSResponder.exe 1736 Bonjour Service Apple Computer, Inc.

svchost.exe 2060 Host Process for Windows Services Microsoft Corporation

StartManSvc.exe 2108 StartMan Application PC Tools

PDAgent.exe 2156 PDAgent Module Raxco Software, Inc.

PDAgentS1.exe 3396 PDAgentS1 Module Raxco Software, Inc.

svchost.exe 2192 Host Process for Windows Services Microsoft Corporation

svchost.exe 2224 Host Process for Windows Services Microsoft Corporation

svchost.exe 3560 Host Process for Windows Services Microsoft Corporation

SearchIndexer.exe 3656 Microsoft Windows Search Indexer Microsoft Corporation

SearchProtocolHost.exe 4936 Microsoft Windows Search Protocol Host Microsoft Corporation

SearchFilterHost.exe 4624 Microsoft Windows Search Filter Host Microsoft Corporation

wmpnetwk.exe 3748 Windows Media Player Network Sharing Service Microsoft Corporation

svchost.exe 3872 Host Process for Windows Services Microsoft Corporation

svchost.exe 2968 Host Process for Windows Services Microsoft Corporation

lsass.exe 904 Local Security Authority Process Microsoft Corporation

lsm.exe 912 Local Session Manager Service Microsoft Corporation

csrss.exe 844 Client Server Runtime Process Microsoft Corporation

winlogon.exe 952 Windows Logon Application Microsoft Corporation

explorer.exe 1872 Windows Explorer Microsoft Corporation

RAVCpl64.exe 2508 Realtek HD Audio Manager Realtek Semiconductor

jusched.exe 2532 Java Platform SE binary Sun Microsystems, Inc.

SetPoint.exe 2568 Logitech SetPoint Event Manager (UNICODE) Logitech, Inc.

SetPoint32.exe 2748

KHALMNPR.exe 2860 Logitech KHAL Main Process Logitech, Inc.

firefox.exe 3244 Firefox Mozilla Corporation

uTorrent.exe 1176 2.27 µTorrent BitTorrent, Inc.

procexp.exe 4468 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

procexp64.exe 4684 10.61 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

avp.exe 2708 Kaspersky Anti-Virus Kaspersky Lab

TrueImageMonitor.exe 2720 Acronis True Image Monitor Acronis

MOM.exe 2728 Catalyst Control Center: Monitoring program Advanced Micro Devices Inc.

CCC.exe 2612 Catalyst Control Centre: Host application ATI Technologies Inc.

UnlockerAssistant.exe 2820

Process: atiesrxx.exe Pid: 848

Name Description Company Name Version

ADVAPI32.dll Advanced Windows 32 Base API Microsoft Corporation 6.1.7600.16385

apphelp.dll Application Compatibility Client Library Microsoft Corporation 6.1.7600.16385

atiesrxx.exe AMD External Events Service Module AMD 6.14.11.1043

CFGMGR32.dll Configuration Manager DLL Microsoft Corporation 6.1.7600.16385

DEVOBJ.dll Device Information Set DLL Microsoft Corporation 6.1.7600.16385

GDI32.dll GDI Client DLL Microsoft Corporation 6.1.7600.16385

IMM32.DLL Multi-User Windows IMM32 API Client DLL Microsoft Corporation 6.1.7600.16385

kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation 6.1.7600.16385

KERNELBASE.dll Windows NT BASE API Client DLL Microsoft Corporation 6.1.7600.16385

locale.nls

LPK.dll Language Pack Microsoft Corporation 6.1.7600.16385

MSCTF.dll MSCTF Server DLL Microsoft Corporation 6.1.7600.16385

msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.0.7600.16385

ntdll.dll NT Layer DLL Microsoft Corporation 6.1.7600.16385

ole32.dll Microsoft OLE for Windows Microsoft Corporation 6.1.7600.16385

OLEAUT32.dll Microsoft Corporation 6.1.7600.16385

POWRPROF.dll Power Profile Helper DLL Microsoft Corporation 6.1.7600.16385

profapi.dll User Profile Basic API Microsoft Corporation 6.1.7600.16385

PSAPI.DLL Process Status Helper Microsoft Corporation 6.1.7600.16385

RPCRT4.dll Remote Procedure Call Runtime Microsoft Corporation 6.1.7600.16385

sechost.dll Host for SCM/SDDL/LSA Lookup APIs Microsoft Corporation 6.1.7600.16385

SETUPAPI.dll Windows Setup API Microsoft Corporation 6.1.7600.16385

USER32.dll Multi-User Windows USER API Client DLL Microsoft Corporation 6.1.7600.16385

USERENV.dll Userenv Microsoft Corporation 6.1.7600.16385

USP10.dll Uniscribe Unicode script processor Microsoft Corporation 1.626.7600.16385

WINSTA.dll Winstation Library Microsoft Corporation 6.1.7600.16385

WTSAPI32.dll Windows Remote Desktop Session Host Server SDK APIs Microsoft Corporation 6.1.7600.16385

Link to comment
Share on other sites

i saw that, to late to edit , thx

Process PID CPU Description Company Name

afcdpsrv.exe 1932 File Level CDP Manager Service Acronis

atieclxx.exe 1452 AMD External Events Client Module AMD

atiesrxx.exe 848 AMD External Events Service Module AMD

avp.exe 1220 Kaspersky Anti-Virus Kaspersky Lab

avp.exe 2708 Kaspersky Anti-Virus Kaspersky Lab

CCC.exe 2612 Catalyst Control Centre: Host application ATI Technologies Inc.

csrss.exe 756 Client Server Runtime Process Microsoft Corporation

csrss.exe 844 Client Server Runtime Process Microsoft Corporation

DPCs n/a 0.76 Deferred Procedure Calls

dwm.exe 1812 1.52 Desktop Window Manager Microsoft Corporation

explorer.exe 1872 Windows Explorer Microsoft Corporation

firefox.exe 3244 Firefox Mozilla Corporation

Interrupts n/a Hardware Interrupts

jusched.exe 2532 Java Platform SE binary Sun Microsystems, Inc.

KHALMNPR.exe 2860 Logitech KHAL Main Process Logitech, Inc.

klwtblfs.exe 1324 WebToolBar component Kaspersky Lab

lsass.exe 904 Local Security Authority Process Microsoft Corporation

lsm.exe 912 Local Session Manager Service Microsoft Corporation

mDNSResponder.exe 1736 Bonjour Service Apple Computer, Inc.

MOM.exe 2728 Catalyst Control Center: Monitoring program Advanced Micro Devices Inc.

notepad.exe 4568 Notepad Microsoft Corporation

PDAgent.exe 2156 PDAgent Module Raxco Software, Inc.

PDAgentS1.exe 3396 PDAgentS1 Module Raxco Software, Inc.

procexp.exe 4468 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

procexp64.exe 4684 11.36 Sysinternals Process Explorer Sysinternals - www.sysinternals.com

RAVCpl64.exe 2508 Realtek HD Audio Manager Realtek Semiconductor

schedhlp.exe 2036 Acronis Scheduler Helper Acronis

schedul2.exe 1892 Acronis Scheduler 2 Acronis

SearchFilterHost.exe 4200 Microsoft Windows Search Filter Host Microsoft Corporation

SearchIndexer.exe 3656 Microsoft Windows Search Indexer Microsoft Corporation

SearchProtocolHost.exe 4936 Microsoft Windows Search Protocol Host Microsoft Corporation

services.exe 880 Services and Controller app Microsoft Corporation

SetPoint.exe 2568 Logitech SetPoint Event Manager (UNICODE) Logitech, Inc.

SetPoint32.exe 2748

smss.exe 544 Windows Session Manager Microsoft Corporation

spoolsv.exe 1576 Spooler SubSystem App Microsoft Corporation

StartManSvc.exe 2108 StartMan Application PC Tools

svchost.exe 628 Host Process for Windows Services Microsoft Corporation

svchost.exe 676 Host Process for Windows Services Microsoft Corporation

svchost.exe 1048 Host Process for Windows Services Microsoft Corporation

svchost.exe 1092 Host Process for Windows Services Microsoft Corporation

svchost.exe 1144 Host Process for Windows Services Microsoft Corporation

svchost.exe 1284 Host Process for Windows Services Microsoft Corporation

svchost.exe 1392 Host Process for Windows Services Microsoft Corporation

svchost.exe 1612 Host Process for Windows Services Microsoft Corporation

svchost.exe 2060 Host Process for Windows Services Microsoft Corporation

svchost.exe 2192 Host Process for Windows Services Microsoft Corporation

svchost.exe 2224 Host Process for Windows Services Microsoft Corporation

svchost.exe 3560 Host Process for Windows Services Microsoft Corporation

svchost.exe 3872 Host Process for Windows Services Microsoft Corporation

svchost.exe 2968 Host Process for Windows Services Microsoft Corporation

System 4 0.76

System Idle Process 0 84.09

taskhost.exe 1740 Host Process for Windows Tasks Microsoft Corporation

TrueImageMonitor.exe 2720 Acronis True Image Monitor Acronis

UnlockerAssistant.exe 2820

uTorrent.exe 1176 1.52 µTorrent BitTorrent, Inc.

wininit.exe 832 Windows Start-Up Application Microsoft Corporation

winlogon.exe 952 Windows Logon Application Microsoft Corporation

wmpnetwk.exe 3748 Windows Media Player Network Sharing Service Microsoft Corporation

Process: uTorrent.exe Pid: 1176

Name Description Company Name Version

ADVAPI32.dll Advanced Windows 32 Base API Microsoft Corporation 6.1.7600.16385

C_1252.NLS

CLBCatQ.DLL COM+ Configuration Catalog Microsoft Corporation 2001.12.8530.16385

COMCTL32.dll User Experience Controls Library Microsoft Corporation 6.10.7600.16385

comdlg32.dll Common Dialogs DLL Microsoft Corporation 6.1.7600.16385

CRYPTBASE.dll Base cryptographic API DLL Microsoft Corporation 6.1.7600.16385

CRYPTSP.dll Cryptographic Service Provider API Microsoft Corporation 6.1.7600.16385

dhcpcsvc.DLL DHCP Client Service Microsoft Corporation 6.1.7600.16385

dhcpcsvc6.DLL DHCPv6 Client Microsoft Corporation 6.1.7600.16385

DnsApi.dll DNS Client API DLL Microsoft Corporation 6.1.7600.16385

dwmapi.dll Microsoft Desktop Window Manager API Microsoft Corporation 6.1.7600.16385

FirewallAPI.dll Windows Firewall API Microsoft Corporation 6.1.7600.16385

fwpuclnt.dll FWP/IPsec User-Mode API Microsoft Corporation 6.1.7600.16385

GDI32.dll GDI Client DLL Microsoft Corporation 6.1.7600.16385

IMM32.DLL Multi-User Windows IMM32 API Client DLL Microsoft Corporation 6.1.7600.16385

Iphlpapi.dll IP Helper API Microsoft Corporation 6.1.7600.16385

kernel32.dll Windows NT BASE API Client DLL Microsoft Corporation 6.1.7600.16385

KERNELBASE.dll Windows NT BASE API Client DLL Microsoft Corporation 6.1.7600.16385

KernelBase.dll.mui Windows NT BASE API Client DLL Microsoft Corporation 6.1.7600.16385

lgscroll.dll Logitech Scroll Enabler (UNICODE) Logitech, Inc. 4.80.103.0

locale.nls

LPK.dll Language Pack Microsoft Corporation 6.1.7600.16385

mdnsNSP.dll Bonjour Namespace Provider Apple Computer, Inc. 1.0.3.1

MSCTF.dll MSCTF Server DLL Microsoft Corporation 6.1.7600.16385

msctf.dll.mui MSCTF Server DLL Microsoft Corporation 6.1.7600.16385

MSVCR80.dll Microsoft® C Runtime Library Microsoft Corporation 8.0.50727.4927

msvcrt.dll Windows NT CRT DLL Microsoft Corporation 7.0.7600.16385

mswsock.dll Microsoft Windows Sockets 2.0 Service Provider Microsoft Corporation 6.1.7600.16385

mzvkbd3.dll Mozilla 3 Virtual Keyboard Kaspersky Lab 9.0.0.736

NSI.dll NSI User-mode interface DLL Microsoft Corporation 6.1.7600.16385

ntdll.dll NT Layer DLL Microsoft Corporation 6.1.7600.16385

ntdll.dll NT Layer DLL Microsoft Corporation 6.1.7600.16385

ntmarta.dll Windows NT MARTA provider Microsoft Corporation 6.1.7600.16385

ole32.dll Microsoft OLE for Windows Microsoft Corporation 6.1.7600.16385

oleaut32.dll Microsoft Corporation 6.1.7600.16385

profapi.dll User Profile Basic API Microsoft Corporation 6.1.7600.16385

psapi.dll Process Status Helper Microsoft Corporation 6.1.7600.16385

rasadhlp.dll Remote Access AutoDial Helper Microsoft Corporation 6.1.7600.16385

RPCRT4.dll Remote Procedure Call Runtime Microsoft Corporation 6.1.7600.16385

rsaenh.dll Microsoft Enhanced Cryptographic Provider Microsoft Corporation 6.1.7600.16385

sechost.dll Host for SCM/SDDL/LSA Lookup APIs Microsoft Corporation 6.1.7600.16385

SHELL32.dll Windows Shell Common Dll Microsoft Corporation 6.1.7600.16385

SHLWAPI.dll Shell Light-weight Utility Library Microsoft Corporation 6.1.7600.16385

SortDefault.nls

SspiCli.dll Security Support Provider Interface Microsoft Corporation 6.1.7600.16385

StaticCache.dat

UnlockerHook.dll

USER32.dll Multi-User Windows USER API Client DLL Microsoft Corporation 6.1.7600.16385

USERENV.dll Userenv Microsoft Corporation 6.1.7600.16385

USP10.dll Uniscribe Unicode script processor Microsoft Corporation 1.626.7600.16385

uTorrent.exe µTorrent BitTorrent, Inc. 1.8.5.17091

uxtheme.dll Microsoft UxTheme Library Microsoft Corporation 6.1.7600.16385

VERSION.dll Version Checking and File Installation Libraries Microsoft Corporation 6.1.7600.16385

WINNSI.DLL Network Store Information RPC interface Microsoft Corporation 6.1.7600.16385

WLDAP32.dll Win32 LDAP API DLL Microsoft Corporation 6.1.7600.16385

wow64.dll Win32 Emulation on NT64 Microsoft Corporation 6.1.7600.16385

wow64cpu.dll AMD64 Wow64 CPU Microsoft Corporation 6.1.7600.16385

wow64win.dll Wow64 Console and Win32 API Logging Microsoft Corporation 6.1.7600.16385

WS2_32.dll Windows Socket 2.0 32-Bit DLL Microsoft Corporation 6.1.7600.16385

wship6.dll Winsock2 Helper DLL (TL/IPv6) Microsoft Corporation 6.1.7600.16385

wshtcpip.dll Winsock2 Helper DLL (TL/IPv4) Microsoft Corporation 6.1.7600.16385

do you want ( need ) more informations ?

Link to comment
Share on other sites

I'm having the same problem. Windows 7 RTM, x86-64. uTorrent would eat up an entire CPU for about a minute, drop down to normal levels for a minutes, and shoot back up again, and so on and so forth. This is version 1.8.5. I never saw this problem on XP.

And just in case anyone wants me to try the usual suspects: the firewall service is disabled, the Windows Defender service is disabled, I never pollute any of my systems with anti-malware snake oil. My system is not infected or hijacked in any way. Etc.

If it helps, it's just one thread that is acting up: it's a thread whose start address offset is at 0x152b9 in 1.8.5. I also have a stack trace taken by Process Explorer of the offending thread:

During a CPU spike:

ntoskrnl.exe!SeAccessCheckWithHint+0xb4a

ntoskrnl.exe!KeAcquireSpinLockAtDpcLevel+0x682

ntoskrnl.exe!KeWaitForSingleObject+0x19f

ntoskrnl.exe!PsIsSystemProcess+0x68

ntoskrnl.exe!KeStackAttachProcess+0x11b9

ntoskrnl.exe!KiCheckForKernelApcDelivery+0x25

ntoskrnl.exe!ObReferenceObjectByHandleWithTag+0x3b6

ntoskrnl.exe!NtReadFile+0x7e

ntoskrnl.exe!KeSynchronizeExecution+0x3a43

wow64cpu.dll!TurboDispatchJumpAddressEnd+0x690

wow64cpu.dll!TurboDispatchJumpAddressEnd+0x29a

wow64.dll!Wow64SystemServiceEx+0x1ce

wow64.dll!Wow64LdrpInitialize+0x429

ntdll.dll!LdrGetProcedureAddress+0x24db7

ntdll.dll!LdrInitializeThunk+0xe

ntdll.dll!NtReadFile+0x15

kernel32.dll!ReadFile+0x54

uTorrent.exe+0x35544

uTorrent.exe+0x1327e

uTorrent.exe+0x1350b

uTorrent.exe+0x14361

uTorrent.exe+0x14aa9

uTorrent.exe+0x1508d

uTorrent.exe+0x1529f

uTorrent.exe+0x152c2

kernel32.dll!BaseThreadInitThunk+0x12

ntdll.dll!RtlInitializeExceptionChain+0x63

ntdll.dll!RtlInitializeExceptionChain+0x36

Normal:

ntoskrnl.exe!SeAccessCheckWithHint+0xb4a

ntoskrnl.exe!KeAcquireSpinLockAtDpcLevel+0x682

ntoskrnl.exe!KeWaitForSingleObject+0x19f

ntoskrnl.exe!PsIsSystemProcess+0x68

ntoskrnl.exe!KeStackAttachProcess+0x11b9

ntoskrnl.exe!KeAcquireSpinLockAtDpcLevel+0x88d

ntoskrnl.exe!KeWaitForSingleObject+0x19f

ntoskrnl.exe!NtWaitForSingleObject+0xb2

ntoskrnl.exe!KeSynchronizeExecution+0x3a43

wow64cpu.dll!TurboDispatchJumpAddressEnd+0x690

wow64cpu.dll!TurboDispatchJumpAddressEnd+0x484

wow64.dll!Wow64SystemServiceEx+0x1ce

wow64.dll!Wow64LdrpInitialize+0x429

ntdll.dll!LdrGetProcedureAddress+0x24db7

ntdll.dll!LdrInitializeThunk+0xe

ntdll.dll!NtWaitForSingleObject+0x15

kernel32.dll!WaitForSingleObjectEx+0x43

kernel32.dll!WaitForSingleObject+0x12

uTorrent.exe+0x15109

uTorrent.exe+0x152c2

kernel32.dll!BaseThreadInitThunk+0x12

ntdll.dll!RtlInitializeExceptionChain+0x63

ntdll.dll!RtlInitializeExceptionChain+0x36

The call to ReadFile is present in every single high-CPU trace and is absent in the normal traces.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...