Proces DDORES.exe

J/w , włącza się z każdym uruchomieniem systemu i pobiera większość CPU.

Da radę coś z tym zrobić?

Z góry dziękuje za pomoc.

Podaj logi z OTL, program znajdziesz na forum w dziale logi.

proszę

Ask Toolbar
Pando Media Booster
McAfee Security Scan Plus

:OTL
SRV - [2013-07-19 05:56:21 | 000,376,896 | ---- | M] (Wsys Co., Ltd.) [Auto | Running] -- C:\ProgramData\eSafe\eGdpSvc.exe -- (WsysSvc)
IE - HKU\S-1-5-21-2619364651-640378460-2371045331-1000\..\SearchScopes\{6743B735-6075-4D0D-9E36-8E10C76E0453}: "URL" = http://searchou.com/?affil=7&uid=69cbf6d0-8dc3-11e2-b8c0-90e6ba36e471&q={searchTerms}
O4 - HKU\S-1-5-21-2619364651-640378460-2371045331-1000..\Run: [Microsoft® Windows® Operating System] C:\Users\asus\AppData\Roaming\Microsoft\Windows\Templates\DDORES.exe (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~2\browse~1\261339~1.144\{c16c1~1\browse~1.dll) -  File not found
@Alternate Data Stream - 231 bytes -> C:\ProgramData\Temp:6BE50C2B
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:4EE74317
 
:Files
C:\Windows\DeleteOnReboot.bat
C:\ProgramData\eSafe
 
:Commands
[emptytemp]

Użytkownik pawel315 edytował ten post 24 07 2013 - 18:00

All processes killed

========== OTL ==========

Service WsysSvc stopped successfully!

Service WsysSvc deleted successfully!

C:\ProgramData\eSafe\eGdpSvc.exe moved successfully.

Registry key HKEY_USERS\S-1-5-21-2619364651-640378460-2371045331-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6743B735-6075-4D0D-9E36-8E10C76E0453}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6743B735-6075-4D0D-9E36-8E10C76E0453}\ not found.

Registry value HKEY_USERS\S-1-5-21-2619364651-640378460-2371045331-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Microsoft® Windows® Operating System deleted successfully.

C:\Users\asus\AppData\Roaming\Microsoft\Windows\Templates\DDORES.exe moved successfully.

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\progra~2\browse~1\261339~1.144\{c16c1~1\browse~1.dll deleted successfully.

ADS C:\ProgramData\Temp:6BE50C2B deleted successfully.

ADS C:\ProgramData\Temp:4EE74317 deleted successfully.

========== FILES ==========

C:\Windows\DeleteOnReboot.bat moved successfully.

C:\ProgramData\eSafe\log folder moved successfully.

C:\ProgramData\eSafe folder moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: asus

->Temp folder emptied: 4118689984 bytes

->Temporary Internet Files folder emptied: 242810709 bytes

->Java cache emptied: 24974 bytes

->FireFox cache emptied: 480579813 bytes

->Google Chrome cache emptied: 349495810 bytes

->Flash cache emptied: 107642429 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 576099350 bytes

RecycleBin emptied: 65755797 bytes

 

Total Files Cleaned = 5 666,00 mb

 

 

OTL by OldTimer - Version 3.2.69.0 log created on 07242013_181903

 

Files\Folders moved on Reboot...

 

PendingFileRenameOperations files...

 

Registry entries deleted on Reboot...

 

 

Nie miałem uprawnień do wysyłania logów więc zacytowałem log z usuwania w poście.

Wygląda, OK - uruchom OTL i kliknij w nim "Sprzątanie", są jeszcze jakies problemy ? 

W sumie nie zauważyłem żadnych innych poważniejszych problemów. Poza chwilowymi lagami przy otwieraniu folderów z dużą ilością plików.

Edit:

Dzięki wielkie za pomoc!

Użytkownik duday edytował ten post 24 07 2013 - 19:19