Archief - explorer.exe + MS Blast

Kem al paar maanden het virus MS blast, en krijg da nooit definitief weg, na elke format staat em daar terug... Iemand zei dak es moest scannen me antivir, de SP1 en 2 installeren en dan is heropstarten en hij zou dan altijd wegblijven... Had ik gedaan, bleef idd weg, ook na een paar formats, ma nu sinds gisteren ( na format ) is em daar weer terug...

Dan ebk ook nog et probleem da elke keer ask de pc opstart een explorer.exe fout krijgen! Das een pokke lastig probleem! Kan ni kopieren of plakken( af en toe wel af en toe ni ) en jah pc vertraagd, bestanden op de pc wadak had zen allemaal verloren gegaan, en jah kem dan ma es de HD elemaal geformateerd da hij helemaal clean is ( dacht ik na een volledige format te doen) en jah ze ziette er nog steeds op... K'installeer ni veel, gwn drivers van geluid en msn ofzo en da ist...

Logfile of HijackThis v1.99.1
Scan saved at 10:28:24, on 5/03/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\crtl.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\msyh32.exe
C:\WINDOWS\System32\Flashget.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\~PRINS~1\LOCALS~1\Temp\Rar$EX00.462\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Microsoft Control Center] crtl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Msy Startups] msyh32.exe
O4 - HKLM\..\Run: [Flashget Download Manager] Flashget.exe
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\yqktyxjh.exe
O4 - HKLM\..\RunServices: [Microsoft Control Center] crtl.exe
O4 - HKLM\..\RunServices: [Msy Startups] msyh32.exe
O4 - HKLM\..\RunServices: [Flashget Download Manager] Flashget.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O21 - SSODL: Web Event Logger - {79FEACFF-FFCE-815E-A900-316290B5B738} - C:\WINDOWS\System32\Micndioe.dll
O21 - SSODL: mtkle - {A7B26F24-FBEF-4D99-6B8E-9C53C91D9684} - C:\WINDOWS\System32\dxkau32.dll

wa moek ier toch aan doen, da die nu es definitief wegblijven!! Virusscan ebbek ook al gedaan, hij delete ze, maar na enige tijd komen ze gewoonweg terug!

thx

na format moet ge wel meteen updaten of een xp installen met sp1/2 erin.
en dan hangt het af waar ge die ms blast binnen haalt, goed mogelijk dat die in een mail zit die online blijft staan en ge die telkens binnen haalt, haal es alle mails binnen en wis die online en scan op virussen

ook te zien welke sites enzo.

mails van outlook zijn altijd allemaal weg na format, ma kant zijn dat ook nen mail is in mn hotmail? al doek dieje mail dan ni open ofzo?

@ Seb
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Possibly out of date Shows the version of your Internet Explorer. Newest Version is: 6.00.2800.1106! The version (6.00.2600.0000) is out of date[. Check Windowsupdate to update the Internet Explorer.
C:\WINDOWS\System32\smss.exe
Safe. running process. (smss.exe)
Systemprozess - Anwendung, die benutzt wird um Sitzungen zu starten, verwalten und löschen.

C:\WINDOWS\system32\winlogon.exe
Safe. running process. (winlogon.exe)
Systemprozess - Windows Login Routine

C:\WINDOWS\system32\services.exe
Safe. running process. (services.exe)
Systemprozess - Verwaltet die Systemdienste.

C:\WINDOWS\system32\lsass.exe
Safe. running process. (lsass.exe)
Systemprozess

C:\WINDOWS\system32\svchost.exe
Safe. running process. (svchost.exe)
Systemprozess - Allgemeiner Hostprozessname für Dienste.

C:\WINDOWS\System32\svchost.exe
Safe. running process. (svchost.exe)
Systemprozess - Allgemeiner Hostprozessname für Dienste.

C:\WINDOWS\system32\spoolsv.exe
Safe. running process. (spoolsv.exe)
Systemprozess

C:\WINDOWS\System32\crtl.exe
Unknown running process. (crtl.exe)
This is a unknown process.

C:\Program Files\QuickTime\qttask.exe
Safe. running process. (qttask.exe)
Part of QuickTime

C:\WINDOWS\System32\msyh32.exe
Unknown running process. (msyh32.exe)
This is a unknown process.

C:\WINDOWS\System32\Flashget.exe
Safe. running process. (Flashget.exe)
Flashget downloadmanager
Possibly nasty! According to our database this process runs normally in c:\programme\flashget\! Check if you know this process and arrange a viruscheck where required.
C:\Program Files\MSN Messenger\MsnMsgr.Exe
Safe. running process. (MsnMsgr.Exe)
MSN Messenger

C:\WINDOWS\explorer.exe
Safe. running process. (explorer.exe)
Systemprozess für Desktop und Taskleiste.

C:\Program Files\Internet Explorer\iexplore.exe
Safe. running process. (iexplore.exe)
Internet Explorer - Wir empfehlen einen sichereren alternativen Browser zu verwenden. (z.B. Firefox)

C:\Program Files\WinRAR\WinRAR.exe
Safe. running process. (WinRAR.exe)
WinRar Packer

C:\DOCUME~1\~PRINS~1\LOCALS~1\Temp\Rar$EX00.462\Hi jackThis.exe
Safe. running process. (HijackThis.exe)
Tool, mit dem sie dieses Logfile erzeugt haben. Remember that Hijackthis must be run in an own folder. Only if Hijackthis run in an own folder it will create backups!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
Safe. This page has been identified as safe.
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
Safe. Entries found in this registry zone are potentially nasty. This application ([8E718888-423F-11D2-876E-00A0C9082467] - Result: 8E718888-423F-11D2-876E-00A0C9082467) has been checked. If the name is made up of random letters, found in the folder 'Application Data' and the kind is 'Unknown' , it should be fixed. Hit rate: 99 %
O4 - HKLM\..\Run: [Microsoft Control Center] crtl.exe
Unknown
Hit rate: 9 % (result) Unknown application.
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
Safe. QuickTime
Hit rate: 99 % (result) Not dangerous, but unnecessary.
O4 - HKLM\..\Run: [Msy Startups] msyh32.exe
Unknown
Hit rate: -1 % (result) Unknown application.
O4 - HKLM\..\Run: [Flashget Download Manager] Flashget.exe
Unknown
Hit rate: 2 % (result) Unknown application.
O4 - HKLM\..\Run: [Cryptographic Service] C:\WINDOWS\System32\yqktyxjh.exe
Unknown
Hit rate: 7 % (result) Unknown application.
O4 - HKLM\..\RunServices: [Microsoft Control Center] crtl.exe
Unknown
Hit rate: 9 % (result) Unknown application.
O4 - HKLM\..\RunServices: [Msy Startups] msyh32.exe
Unknown
Hit rate: -1 % (result) Unknown application.
O4 - HKLM\..\RunServices: [Flashget Download Manager] Flashget.exe
Unknown
Hit rate: 2 % (result) Unknown application.
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
Safe. Microsoft s MSN Messenger 6
Hit rate: 99 % (result)
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
Safe. The entry Related has been identified as safe. If the entry 'Related ' is not needed anymore, it should be fixed.
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
Safe. The entry Show &Related Links has been identified as safe. If the entry 'Show &Related Links ' is not needed anymore, it should be fixed.
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/M...pDownloader.cab
Safe. This entry has been identified as safe.
O21 - SSODL: Web Event Logger - {79FEACFF-FFCE-815E-A900-316290B5B738} - C:\WINDOWS\System32\Micndioe.dll
Nasty O21 - SSODL: mtkle - {A7B26F24-FBEF-4D99-6B8E-9C53C91D9684} - C:\WINDOWS\System32\dxkau32.dll
Unknow

als ik virus scan doe zegt em da dieje => C:\WINDOWS\System32\crtl.exe
Unknown running process. (crtl.exe)
This is a unknown process.
een virus is, ma ask et weg doe, komt na elke heropstarting terug

btw thx cram

kem nu net is systeemherstel gedaan => op datum van na mijne format, en alles ga weer prima... ma kdenk da alsk vanaf de drivers van men geluid installeer dak et weer zitte eb ma das toch raar dat et aan drivers ligt da ge een virus vast hebt...

als alles nu werkt zet ge best eens systeem herstel af zoda alle mappen in backup weg zijn, daarna terug aan en zal ie dus dees als backup nemen

waar downd ge die driver? van mobo site?

jup download drivers van mobo site...