Windows7 si prende troppa ram

[Eress]

Beh certo ci sarebbe da controllare meglio cosa si nasconde dietro quello strano svchost *32

[T.E.C. Power]

non so cosa si possa nascondere ma comunque si mi sono salvato solo le cose più importanti e comunque ho molti problemi oltre al fatto che si blocca.
(in questo momento ho 2282 mb di ram usata con skype e google chrome .-.)
Al massimo secondo voi sarebbe buono mettermi xp e 7?due partizioni?

[Eress]

Non so se al momento dello screen avessi aperto qualche programma in particolare, ma vedo anche un notevole utilizzo di cpu...c'è qualòcosa che non va nel tuo sistema o nella configurazione hw/sw, sarebbe da capire esattamente cosa, fai anche una scansione con HijackThis e posta il log

[T.E.C. Power]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 09:48:49, on 09/07/2011
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16700)
Boot mode: Normal

Running processes:
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\TheCoder\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe
C:\Windows\SysWOW64\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2776682
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: (no name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
R3 - URLSearchHook: (no name) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: 109.236.81.22 109.236.81.22 root
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
O2 - BHO: MegaIeHelperBHO - {77F4E711-789B-447F-9614-96759B2F83C6} - C:\Users\TheCoder\AppData\Local\Megamedia\Megakey\MegaIeHelper.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: Guida per l'accesso a Windows Live ID - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O2 - BHO: IMinent WebBooster - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\IMBooster4Web\Iminent.WebBooster.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll
O2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files (x86)\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll" (file missing)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [ATICustomerCare] "C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVIZIO DI RETE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVIZIO DI RETE')
O8 - Extra context menu item: Capture Web Page - C:\Users\TheCoder\AppData\Local\Megamedia\Megakey\CaptureWebPage.htm
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~2\MIF5BA~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fetch to Megaupload - C:\Users\TheCoder\AppData\Local\Megamedia\Megakey\MegaUpload.htm
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files (x86)\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files (x86)\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MIF5BA~1\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll
O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll
O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll
O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll
O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll
O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll
O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll
O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll
O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll
O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: frameworkPostgreSQL - PostgreSQL Global Development Group - C:/PROGRA~2/Rapid7/FRAMEW~1/POSTGR~1/bin/pg_ctl.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12145 bytes

ecco il file di log

[Khronos]

ascoltami.
voglio vedere uno screenshot del tuo taskmanager come questo, MA con la scheda "memoria" aperta.:


TASTO START -> monitoraggio risorse ->invio.

PERO', quando fai lo screenshot, NON devi avere CHROME aperto, NON devi avere Photoshop aperto, NON devi avere le tuneup utilities, NON devi avere nient'altro.
SOLO il sistema e i processi di background.

capito?
ciao

[Eress]

Ci sono dei problemi con il Winsock hijackers, inoltre troppi BHO toolbar, devi eliminarne il più possibile. Poi c'è questa strana voce che di solito non appare nei log di HT

C:\Windows\SysWOW64\NOTEPAD.EXE

[T.E.C. Power]

ecco <,<

[Khronos]

non ci siamo capiti....

Originariamente inviato da mio post precedente

PERO', quando fai lo screenshot, NON devi avere CHROME aperto, NON devi avere Photoshop aperto, NON devi avere le tuneup utilities, NON devi avere nient'altro.
SOLO il sistema e i processi di background.

li dentro hai pure postgres acceso.


comunque, sembra che il problema sia relativo al processo (e al servizio) di sharing dati del media player,

wmpnetwk.exe

ne fai uso? se no, leggi qua.
ciao

[Nicodemo Timoteo Taddeo]

Glielo spiego sottovoce io?

@T.E.C. Power:

Riavvia il PC, attendi che si carichi tutto il sistema operativo, quando pensi che il PC è diventato utilizzabile fai passare altri due-tre minuti almeno senza toccare nulla, niente tastiera, niente mouse niente di niente fai come se tu non ci fossi . Dopo, l'unica cosa che devi fare è la schermata.

Una volta che hai l'immagine sei libero di usare il PC come vuoi.



Saluti.

[T.E.C. Power]

ma infatti avevo solo i programmi in background, quelli che vedete sono i processi come se io abbia appena riavviato il pc
e ho notato che c'è chrome...non capisco, era chiuso o.O
comunque si è quel processo che si prende tutta la ram... (tipo ora 2gb .-.")

[Nicodemo Timoteo Taddeo]

Hai il sistema sballato e questo si era già capito , sembra che i processi non rilascino memoria. Però la schermata a sistema appena riavviato la devi fare lo stesso oramai


Saluti.

[T.E.C. Power]

siccome non ho virus e mi sono fatto backup un'idea ce l'ho..formatto :|

[T.E.C. Power]

ok ho formattato...tutto liscio come l'olio

[WarDuck]

Originariamente inviato da T.E.C. Power

ok ho formattato...tutto liscio come l'olio

Quasi sicuramente eri infetto da malware...

Mi raccomando, UAC al massimo e più attenzione a cosa scarichi .

[Khronos]

era diventato parte di una botnet bella precisa... quella successione di servizi "chrome" mi fa pensare a calcoli paralleli per sfondare qualche password.
ciao