Winlogon använder 50% CPU

Såg precis att processen winlogon käkade halva min cpu (50%). Jag använder XP SP3 och har kört en check med den vanligaste antispywareprogammen. Googlade och hittade en del, men inget som hjälpt mig.

Om ngn kunde hjälpa mig vore jag lycklig. Här är min hijack-logg i två delar:

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program\Alwil Software\Avast4\aswUpdSv.exe
E:\Program\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program\Google\Update\GoogleUpdate.exe
E:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
E:\Program\Bonjour\mDNSResponder.exe
E:\Program\Java\jre6\bin\jqs.exe
E:\Program\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
E:\WINDOWS\system32\nvsvc32.exe
E:\Program\Spyware Terminator\sp_rsser.exe
E:\WINDOWS\system32\svchost.exe
E:\Program\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
E:\Program\Alwil Software\Avast4\ashMaiSv.exe
E:\Program\Alwil Software\Avast4\ashWebSv.exe
E:\Program\Delade filer\Ahead\Lib\NMIndexingService.exe
E:\WINDOWS\system32\winlogon.exe
E:\Program\iPod\bin\iPodService.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\RTHDCPL.EXE
E:\WINDOWS\system32\RunDLL32.exe
E:\Program\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
E:\WINDOWS\VM301Snap.exe
E:\WINDOWS\Domino.exe
E:\Program\ALWILS~1\Avast4\ashDisp.exe
E:\Program\Google\Google Desktop Search\GoogleDesktop.exe
E:\WINDOWS\system32\iid.exe
E:\Program\Google\Gmail Notifier\gnotify.exe
E:\Program\iTunes\iTunesHelper.exe
E:\Program\Java\jre6\bin\jusched.exe
E:\WINDOWS\system32\ctfmon.exe
D:\Program\windows\SystemExplorer.exe
E:\Program\Google\Google Desktop Search\GoogleDesktop.exe
E:\Documents and Settings\Mattias\Lokala inställningar\Application Data\Google\Update\GoogleUpdate.exe
E:\Program\Personal\bin\Personal.exe
E:\Program\Spotify\spotify.exe
E:\Program\uTorrent\uTorrent.exe
E:\WINDOWS\System32\svchost.exe
E:\Program\Skype\Phone\Skype.exe
E:\Program\Skype\Plugin Manager\skypePM.exe
E:\Program\Last.fm\LastFM.exe
E:\Program\Mozilla Firefox\firefox.exe
E:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\aaw2008_upd.exe
E:\WINDOWS\system32\msiexec.exe
E:\WINDOWS\system32\MsiExec.exe
E:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe
E:\WINDOWS\system32\MsiExec.exe
E:\Program\Spybot - Search & Destroy\SDUpdate.exe
E:\Program\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: Länkhjälp till Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - E:\Program\Desktop Sidebar\sbhelp.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - E:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - E:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin. dll
O3 - Toolbar: QT TabBar - {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - mscoree.dll (file missing)
O3 - Toolbar: QT Tab Standard Buttons - {D2BF470E-ED1C-487F-A666-2BD8835EB6CE} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VirtualCloneDrive] "E:\Program\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [PinnacleDriverCheck] E:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [BigDogPath] E:\WINDOWS\VM301Snap.exe Vimicro USB PC Camera (ZC0301PL)
O4 - HKLM\..\Run: [Domino] E:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [avast!] E:\Program\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Google Desktop Search] "E:\Program\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Net iD] E:\WINDOWS\system32\iid.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] E:\Program\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] E:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "E:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [FileZilla Server Interface] "E:\Program\FileZilla Server\FileZilla Server Interface.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SystemExplorer] "D:\Program\windows\SystemExplorer.exe" /TRAY
O4 - HKCU\..\Run: [Mmm] "E:\Program\HACE\Mmm\Mmm.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "E:\Documents and Settings\Mattias\Lokala inställningar\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] E:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUt il.exe -p
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-606747145-861567501-725345543-1004.bak\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-606747145-861567501-725345543-1005\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe (User 'Isak')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BankID säkerhetsprogram.lnk = E:\Program\Personal\bin\Personal.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://E:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - E:\Program\Desktop Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - E:\Program\Desktop Sidebar\sbhelp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program\Messenger\msmsgs.exe


....

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} -
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {5BF56AD2-E297-416E-BC49-000004040507} - https://cve.trust.telia.com/TeliaEleg/iidsetup.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/...ploader4_5.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - E:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: E:\Program\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - E:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - E:\Program\Bonjour\mDNSResponder.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - E:\Program\FileZilla Server\FileZilla Server.exe
O23 - Service: Google Desktop-hanteraren 5.7.805.16405 (GoogleDesktopManager-051608-133132) - Google - E:\Program\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Tjänsten Google Update (gupdate1c993b770e81fee) (gupdate1c993b770e81fee) - Google Inc. - E:\Program\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - E:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - E:\Program\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - E:\Program\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - E:\Program\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - E:\Program\Delade filer\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - E:\Program\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - E:\Program\WinPcap\rpcapd.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - E:\Program\Spyware Terminator\sp_rsser.exe

--
End of file - 11191 bytes

är denna processen relaterad till en webbcam?
E:\WINDOWS\Domino.exe

det här måste vara malware, kolla filen på virustotal
O4 - HKCU\..\Run: [SystemExplorer] "D:\Program\windows\SystemExplorer.exe

isf bockar du för och fixar den senare i hjt, kolla om filen är borta.
får du inget tydligt svar på virustotal så skicka upp filen till tex fuskbugg så kan jag kolla den

SystemExplorer är ingen malware. Det är det här programmet: http://systemexplorer.mistergroup.org/

Domino.exe är för min webkamera.

Ngt annat förslag?

ok men jag tycker att det känns märkligt att ett sånt program är installerat i en mapp som heter windows och startar med windows.
kolla med ett program som heter process explorer så kanske du får fram mer info