i got a problem
Hi my computer seemed to be in and awfull state. I decided to pass some scans to find what it was, it turns out i have a "classloader.x" and
a c:\users\romelia\appdata\locallow\macromedia\...lliance\3dgroovextrav181\groove.x32
can anyone help me on eliminating these .
a c:\users\romelia\appdata\locallow\macromedia\...lliance\3dgroovextrav181\groove.x32
can anyone help me on eliminating these .
0
Comments
log 22 Apr 2010 14:51:17 - **********************************************************
22 Apr 2010 14:51:17 - eScan Anti Virus & Spyware Toolkit Utility.
22 Apr 2010 14:51:17 - Copyright © MicroWorld Technologies
22 Apr 2010 14:51:17 - **********************************************************
22 Apr 2010 14:51:17 - Source: C:\Users\Romelia\Documents\biologyas\mwav.exe
22 Apr 2010 14:51:17 - Version 11.0.152 (C:\USERS\ROMELIA\APPDATA\LOCAL\TEMP\MEXE.COM)
22 Apr 2010 14:51:17 - Log File: C:\Users\Romelia\AppData\Local\Temp\MWAV.LOG
22 Apr 2010 14:51:17 - MWAV Registered: FALSE
22 Apr 2010 14:51:17 - User Account: Romelia (Administrator Mode)
22 Apr 2010 14:51:17 - OS Type: Windows Workstation
22 Apr 2010 14:51:17 - OS: Windows Vista [OS Install Date: 23 Jun 2008 11:14:14]
22 Apr 2010 14:51:17 - Ver: Personal Service Pack 2 (Build 6002)
22 Apr 2010 14:51:17 - System Up Time: 2 Hours, 40 Minutes, 16 Seconds
22 Apr 2010 14:51:17 - Parent Process Name : C:\Users\Romelia\Documents\biologyas\mwav.exe
22 Apr 2010 14:51:17 - Windows Root Folder: C:\Windows
22 Apr 2010 14:51:17 - Windows Sys32 Folder: C:\Windows\system32
22 Apr 2010 14:51:17 - DHCP NameServer: 192.168.1.254
22 Apr 2010 14:51:17 - Interface0 DHCPNameServer: 192.168.1.254
22 Apr 2010 14:51:17 - Interface1 DHCPNameServer: 192.168.1.254
22 Apr 2010 14:51:17 - Local Fixed Drives: c:\,d:\
22 Apr 2010 14:51:17 - MWAV Mode: Only Scan files (Do Not Clean)
22 Apr 2010 14:51:17 - [CREATED ZIP FILE: C:\Users\Romelia\AppData\Local\Temp\pinfect.zip]
22 Apr 2010 14:51:17 - ****** Files/Folders created/modified during last fortnight in Windows and ROOT Folder ******
22 Apr 2010 14:51:17 - C:\Windows\system32\Apphlpdm.dll (28672), 13-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:18 - C:\Windows\system32\cabview.dll (98304), 16-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:18 - C:\Windows\system32\gameux.dll (1696256), 13-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:18 - C:\Windows\system32\iphlpsvc.dll (200704), 16-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:18 - C:\Windows\system32\l3codeca.acm (62464), 16-Apr-2010, Fraunhofer Institut Integrierte Schaltungen IIS, MPEG Layer-3 Audio Codec for MSACM
22 Apr 2010 14:51:18 - C:\Windows\system32\l3codecp.acm (220672), 16-Apr-2010, Fraunhofer Institut Integrierte Schaltungen IIS, Fraunhofer IIS MPEG Audio Layer-3 ACM codec
22 Apr 2010 14:51:18 - C:\Windows\system32\mrt.exe (31971272), 06-Apr-2010, Microsoft Corporation, Microsoft Windows Malicious Software Removal Tool
22 Apr 2010 14:51:18 - C:\Windows\system32\msdrm.dll (332288), 13-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:18 - C:\Windows\system32\ntkrnlpa.exe (3600776), 16-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:18 - C:\Windows\system32\ntoskrnl.exe (3548040), 16-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:18 - C:\Windows\system32\RMActivate.exe (518144), 13-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:19 - C:\Windows\system32\RMActivate_isv.exe (526336), 13-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:19 - C:\Windows\system32\RMActivate_ssp.exe (347136), 13-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:19 - C:\Windows\system32\RMActivate_ssp_isv.exe (346624), 13-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:19 - C:\Windows\system32\secproc.dll (471552), 13-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:19 - C:\Windows\system32\secproc_isv.dll (471552), 13-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:19 - C:\Windows\system32\secproc_ssp.dll (152064), 13-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:19 - C:\Windows\system32\secproc_ssp_isv.dll (152576), 13-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:20 - C:\Windows\system32\vbscript.dll (420352), 16-Apr-2010, Microsoft Corporation, Microsoft (R) VBScript
22 Apr 2010 14:51:20 - C:\Windows\system32\wintrust.dll (172032), 16-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:20 - C:\Windows\system32\drivers\mrxsmb.sys (106496), 16-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:20 - C:\Windows\system32\drivers\mrxsmb10.sys (212992), 16-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:51:20 - C:\Windows\system32\drivers\mrxsmb20.sys (79360), 16-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:52:30 - C:\Windows\system32\drivers\tcpip.sys (904576), 16-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:52:30 - C:\Windows\system32\drivers\tunnel.sys (25088), 16-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:52:30 - C:\Users\Romelia\AppData\Local\Temp\bdc.exe (91904), 22-Apr-2010, MicroWorld Tech, eScan
22 Apr 2010 14:52:30 - C:\Users\Romelia\AppData\Local\Temp\bdfltlib2k.dll (231944), 22-Apr-2010, MicroWorld Technologies Inc., eScan for Windows
22 Apr 2010 14:52:30 - C:\Users\Romelia\AppData\Local\Temp\clean.bat (11), 22-Apr-2010 [Added C:\Users\Romelia\AppData\Local\Temp\clean.bat to ZIP FILE]
22 Apr 2010 14:52:31 - C:\Users\Romelia\AppData\Local\Temp\download.exe (934408), 09-Apr-2010, MicroWorld Technologies Inc., eScan
22 Apr 2010 14:52:31 - C:\Users\Romelia\AppData\Local\Temp\encdec.dll (119816), 09-Apr-2010, MicroWorld Technologies Inc., eScan/MailScan/eConceal
22 Apr 2010 14:52:31 - C:\Users\Romelia\AppData\Local\Temp\erootdrv.sys (13832), 09-Apr-2010, MicroWorld Technologies Inc., eScan/MWAV
22 Apr 2010 14:52:31 - C:\Users\Romelia\AppData\Local\Temp\mexe.com (2292296), 09-Apr-2010, MicroWorld Technologies Inc., MicroWorld AntiVirus Toolkit Utility (MWAV)
22 Apr 2010 14:52:31 - C:\Users\Romelia\AppData\Local\Temp\msvclnt.dll (236040), 09-Apr-2010, MicroWorld Technologies Inc., MailScan
22 Apr 2010 14:52:32 - C:\Users\Romelia\AppData\Local\Temp\MWAVReg.EXE (721416), 09-Apr-2010, MicroWorld Technologies Inc., eScan / MailScan / eConceal
22 Apr 2010 14:52:32 - C:\Users\Romelia\AppData\Local\Temp\MWAVSCAN.COM (2292296), 09-Apr-2010, MicroWorld Technologies Inc., MicroWorld AntiVirus Toolkit Utility (MWAV)
22 Apr 2010 14:52:32 - C:\Users\Romelia\AppData\Local\Temp\red32.dll (10248), 09-Apr-2010, Microsoft Corporation, Microsoft® Windows® Operating System
22 Apr 2010 14:52:32 - C:\Users\Romelia\AppData\Local\Temp\reload.exe (154120), 09-Apr-2010, MicroWorld Technologies Inc., eScan for Windows
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Local\Temp\setpriv.exe (64008), 09-Apr-2010, MicroWorld Technologies Inc, eScan AntiVirus Toolkit Utility
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Local\Temp\unregx.exe (61960), 09-Apr-2010, MicroWorld Technologies Inc, MicroWorld AntiVirus Toolkit Utility
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Local\Temp\viewtcp.exe (573960), 09-Apr-2010, MicroWorld Technologies Inc., ViewTCP
22 Apr 2010 14:52:33 - C:\Windows\Fonts, 02-Nov-2006 [SR] [Folder]
22 Apr 2010 14:52:33 - C:\Windows\ftpcache, 25-Sep-2008 [HS] [Folder]
22 Apr 2010 14:52:33 - C:\Windows\Media, 02-Nov-2006 [SR] [Folder]
22 Apr 2010 14:52:33 - C:\Windows\system32\GroupPolicy, 02-Nov-2006 [H] [Folder]
22 Apr 2010 14:52:33 - C:\Windows\system32\GroupPolicyUsers, 02-Nov-2006 [H] [Folder]
22 Apr 2010 14:52:33 - C:\Windows\system32\Microsoft, 02-Nov-2006 [Folder]
22 Apr 2010 14:52:33 - C:\Boot, 14-Apr-2008 [HS] [Folder]
22 Apr 2010 14:52:33 - C:\Documents and Settings, 02-Nov-2006 [HS] [Folder]
22 Apr 2010 14:52:33 - C:\hp, 14-Apr-2008 [H] [Folder]
22 Apr 2010 14:52:33 - C:\MSOCache, 07-Sep-2008 [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData, 02-Nov-2006 [H] [Folder]
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Local\Temp\hsperfdata_Romelia, 22-Apr-2010 [Folder]
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Local\Temp\MessengerCache, 22-Apr-2010 [Folder]
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Local\Temp\plugins, 22-Apr-2010 [Folder]
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Local\Temp\plugtmp, 22-Apr-2010 [Folder]
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Local\Temp\WPDNSE, 22-Apr-2010 [Folder]
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Local\Temp\_lck, 22-Apr-2010 [Folder]
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Roaming\.#, 06-Feb-2009 [HS] [Folder]
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Roaming\Download Manager, 22-Apr-2010 [Folder]
22 Apr 2010 14:52:33 - C:\Users\Romelia\AppData\Roaming\Microsoft, 05-Aug-2008 [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\Adobe Systems, 13-Apr-2010 [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\Application Data, 02-Nov-2006 [HS] [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\Desktop, 02-Nov-2006 [HS] [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\Documents, 02-Nov-2006 [HS] [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\Microsoft, 02-Nov-2006 [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\MicroWorld, 22-Apr-2010 [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\Start Menu, 02-Nov-2006 [HS] [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\Templates, 02-Nov-2006 [HS] [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\..\Boot, 14-Apr-2008 [HS] [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\..\Documents and Settings, 02-Nov-2006 [HS] [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\..\hp, 14-Apr-2008 [H] [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\..\MSOCache, 07-Sep-2008 [Folder]
22 Apr 2010 14:52:33 - C:\ProgramData\..\ProgramData, 02-Nov-2006 [H] [Folder]
22 Apr 2010 14:52:33 - C:\Program Files\Panda Security, 18-Apr-2010 [Folder]
22 Apr 2010 14:52:33 - C:\Program Files\Common Files\Adobe Systems Shared, 13-Apr-2010 [Folder]
22 Apr 2010 14:52:33 - *********************************************************************************************
22 Apr 2010 14:52:33 - Latest Date of files inside MWAV: Fri Apr 9 12:43:53 2010.
22 Apr 2010 14:52:33 - Plugins FileCount: 641 Sign Version: 7.31143
22 Apr 2010 14:52:35 - ** Deleted Value of "DisableCAD" in "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon". Its value was DWORD:1.
22 Apr 2010 14:52:35 - ** Changed Value of "Path"
22 Apr 2010 14:52:35 - ** Changed Value of "HKEY_CLASSES_ROOT\.htm" from "" to "htmlfile"
22 Apr 2010 14:52:35 - ** Changed Value of "HKEY_CLASSES_ROOT\.html" from "" to "htmlfile"
22 Apr 2010 14:52:35 - Loading/Creating FileScan Database C:\ProgramData\MicroWorld\MWAV\ESCANDBX.MDB [Log: C:\Users\Romelia\AppData\Local\Temp\ESCANDB.LOG]
22 Apr 2010 14:52:36 - Loaded/Created FileScan Database...
22 Apr 2010 14:52:36 - Loading AV Library [DB]...
22 Apr 2010 14:52:54 - AV Library Loaded [DB-DIRECT].
22 Apr 2010 14:52:54 - MWAV doing self scanning...
22 Apr 2010 14:52:55 - MWAV files are clean.
22 Apr 2010 14:54:30 - Virus Database Date: 09 Apr 2010
22 Apr 2010 14:54:30 - Virus Database Count: 5598930
22 Apr 2010 15:06:07 - **********************************************************
22 Apr 2010 15:06:07 - eScan Anti Virus & Spyware Toolkit Utility.
22 Apr 2010 15:06:07 - Copyright © MicroWorld Technologies
22 Apr 2010 15:06:07 -
22 Apr 2010 15:06:07 - Support: support@escanav.com
22 Apr 2010 15:06:07 - Web: http://www.escanav.com
22 Apr 2010 15:06:07 - **********************************************************
22 Apr 2010 15:06:07 - Version 11.0.152[DB] (C:\USERS\ROMELIA\APPDATA\LOCAL\TEMP\MEXE.COM)
22 Apr 2010 15:06:07 - Log File: C:\Users\Romelia\AppData\Local\Temp\MWAV.LOG
22 Apr 2010 15:06:07 - User Account: Romelia (Administrator Mode)
22 Apr 2010 15:06:07 - Parent Process Name : C:\Users\Romelia\Documents\biologyas\mwav.exe
22 Apr 2010 15:06:07 - Windows Root Folder: C:\Windows
22 Apr 2010 15:06:07 - Windows Sys32 Folder: C:\Windows\system32
22 Apr 2010 15:06:07 - OS: Windows Vista [OS Install Date: 23 Jun 2008 11:14:14]
22 Apr 2010 15:06:07 - Ver: Personal Service Pack 2 (Build 6002)
22 Apr 2010 15:06:07 - Latest Date of files inside MWAV: Fri Apr 9 12:43:53 2010.
22 Apr 2010 15:06:07 - Plugins FileCount: 641 Sign Version: 7.31143
22 Apr 2010 15:06:07 - Options Selected by User:
22 Apr 2010 15:06:07 - Memory Check: Enabled
22 Apr 2010 15:06:07 - Registry Check: Enabled
22 Apr 2010 15:06:07 - StartUp Folder Check: Enabled
22 Apr 2010 15:06:07 - System Folder Check: Enabled
22 Apr 2010 15:06:07 - Services Check: Enabled
22 Apr 2010 15:06:07 - Scan Spyware: Disabled
22 Apr 2010 15:06:07 - Drive Check Option Disabled
22 Apr 2010 15:06:07 - Folder Check: Disabled
22 Apr 2010 15:06:07 - SCAN: Program_Files
22 Apr 2010 15:06:07 - MWAV Mode: Only Scan files (Do Not Clean)
22 Apr 2010 15:06:09 - ***** Scanning Memory Files *****
22 Apr 2010 15:06:24 - Scanning File C:\Program Files\Messenger Plus! Live\Detoured.dll (????)
22 Apr 2010 15:06:29 - ***** Scanning Registry Files *****
22 Apr 2010 15:06:29 - Scanning File C:\Program Files\Automated Content Enhancer\4.1.0.5260\ACEIEAddOn.dll (????)
22 Apr 2010 15:06:29 - Scanning File C:\Program Files\Customized Platform Advancer\4.1.0.1850\CPAIEAddOn.dll (????)
22 Apr 2010 15:06:30 - Scanning File C:\Program Files\Content Management Wizard\1.1.0.1990\CMWIE.dll (????)
22 Apr 2010 15:06:30 - Scanning File C:\Program Files\Textual Content Provider\1.1.0.1810\TCPIE.dll (????)
22 Apr 2010 15:06:30 - Scanning File C:\Program Files\Web Search Operator\4.1.0.1990\wso.dll (????)
22 Apr 2010 15:06:46 - ERROR!!! Invalid Entry HP Health Check Scheduler = [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (in key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run). No Action Taken.
22 Apr 2010 15:06:47 - ***** Scanning StartUp Folders *****
22 Apr 2010 15:06:47 - ***** Scanning Service Files *****
22 Apr 2010 15:06:56 - ERROR!!! Invalid Entry \SystemRoot\system32\drivers\blbdrive.sys in HKLM\SYSTEM\CurrentControlSet\Services\blbdrive. Action Taken: No Action Taken.
22 Apr 2010 15:07:17 - ERROR!!! Invalid Entry system32\drivers\nmwcdnsu.sys in HKLM\SYSTEM\CurrentControlSet\Services\nmwcdnsu. Action Taken: No Action Taken.
22 Apr 2010 15:07:17 - ERROR!!! Invalid Entry system32\drivers\nmwcdnsuc.sys in HKLM\SYSTEM\CurrentControlSet\Services\nmwcdnsuc. Action Taken: No Action Taken.
22 Apr 2010 15:07:17 - ERROR!!! Invalid Entry J:\Game downloads\Maplestory\In here XD\npkcmsvc.exe in HKLM\SYSTEM\CurrentControlSet\Services\npkcmsvc. Action Taken: No Action Taken.
22 Apr 2010 15:07:17 - ERROR!!! Invalid Entry \??\J:\Game downloads\Maplestory\In here XD\npkcrypt.sys in HKLM\SYSTEM\CurrentControlSet\Services\npkcrypt. Action Taken: No Action Taken.
22 Apr 2010 15:07:17 - ERROR!!! Invalid Entry \??\J:\Game downloads\Maplestory\In here XD\npkycryp.sys in HKLM\SYSTEM\CurrentControlSet\Services\npkycryp. Action Taken: No Action Taken.
22 Apr 2010 15:07:18 - ERROR!!! Invalid Entry system32\DRIVERS\pccsmcfd.sys in HKLM\SYSTEM\CurrentControlSet\Services\pccsmcfd. Action Taken: No Action Taken.
22 Apr 2010 15:07:18 - ERROR!!! Invalid Entry system32\DRIVERS\pcdrndisuio.sys in HKLM\SYSTEM\CurrentControlSet\Services\PcdrNdisuio. Action Taken: No Action Taken.
22 Apr 2010 15:07:25 - ERROR!!! Invalid Entry system32\DRIVERS\SymIM.sys in HKLM\SYSTEM\CurrentControlSet\Services\SymIMMP. Action Taken: No Action Taken.
22 Apr 2010 15:07:27 - ERROR!!! Invalid Entry system32\DRIVERS\usbser_lowerflt.sys in HKLM\SYSTEM\CurrentControlSet\Services\upperdev. Action Taken: No Action Taken.
22 Apr 2010 15:07:29 - ERROR!!! Invalid Entry "J:\Game downloads\Wampserver\wamp\bin\apache\apache2.2.8\bin\httpd.exe" -k runservice in HKLM\SYSTEM\CurrentControlSet\Services\wampapache. Action Taken: No Action Taken.
22 Apr 2010 15:07:29 - ERROR!!! Invalid Entry "J:\Game downloads\Wampserver\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe" wampmysqld in HKLM\SYSTEM\CurrentControlSet\Services\wampmysqld. Action Taken: No Action Taken.
22 Apr 2010 15:07:31 - ***** Scanning System32 Folders *****
22 Apr 2010 15:09:18 - ***** Checking for specific ITW Viruses *****
22 Apr 2010 15:09:18 - ***** Scanning complete. *****
22 Apr 2010 15:09:18 - Total Objects Scanned: 5674
22 Apr 2010 15:09:18 - Total Critical Objects: 0
22 Apr 2010 15:09:18 - Total Disinfected Objects: 0
22 Apr 2010 15:09:18 - Total Objects Renamed: 0
22 Apr 2010 15:09:18 - Total Deleted Objects: 0
22 Apr 2010 15:09:18 - Total Errors: 13
22 Apr 2010 15:09:18 - Time Elapsed: 00:03:08
22 Apr 2010 15:09:18 - Virus Database Date: 09 Apr 2010
22 Apr 2010 15:09:18 - Virus Database Count: 5598930
22 Apr 2010 15:09:18 - Scan Completed.
22 Apr 2010 15:11:45 - Virus Database Date: 09 Apr 2010
22 Apr 2010 15:11:45 - Virus Database Count: 5598930
22 Apr 2010 15:11:47 - Uninitializing Scanner (3)...
22 Apr 2010 15:11:47 - Freeing Libraries (3)...
22 Apr 2010 15:11:48 - AV Library Unloaded (3)...
22 Apr 2010 15:11:48 - [Made copy of PINFECT.ZIP (183 Bytes) as C:\Users\Romelia\Documents\pinfect.zip]