antivirus software freezes during scan?? virus?

hey, i'm new to bleepingcomputer and would really appreciate some help.

my computer was running super slow and acting strange. i wasn't using much RAM or processor space, i was trying to load a web page. but the indicator light on my computer that represents the hard drive was remaining lit, meanwhile the computer was running so slow that it seemed completely frozen. so i restarted and tried to run malwarbytes to see if i was infected. a little over 2 minutes in to the scan, the timer froze and the program was stuck at a program file having something to do with javascript. the file was: <C:\Program Files\Common Files\i4j_jres\jre1\lib\ext\sunpkcs11.jar>. i held the power button to turn off the frozen computer. i restarted in safe mode and tried the same scan again and it froze in a similar fashion in the same folder but not exactly the same file. i did this several times and using different combinations of start-ups and other antivirus software to the same result. the only difference is how long it took my virus scans to freeze and which files they froze on (one of my scans with symantec landed on a .dll file that windows movie maker used).

the most recent start-up left the computer running fine, which allowed me to come here. so my computer seems to be ok now... except for the fact that i still can't run virus scans. i'm pretty confused about it all. am i infected?

Hello, please do these.. And review a log.
Run TFC by OT
Please download TFC by Old Timer and save it to your desktop.
alternate download link
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista, right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.
Run RKill....

Please download Rkill by Grinler and save it to your desktop.Link 2
Link 3
Link 4

• Double-click on the Rkill desktop icon to run the tool.
• If using Vista, right-click on it and Run As Administrator.
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
• If not, delete the file, then download and use the one provided in Link 2.
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
• If the tool does not run from any of the links provided, please let me know.

You will need to run the application again if rebooting the computer occurs along the way as the malware programs will start again.



Next run MBAM (MalwareBytes):

Please download Malwarebytes Anti-Malware (v1.45) and save it to your desktop.alternate download link 1
alternate download link 2
MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

• If Malwarebytes Anti-Malware results in any error messages, check the Help file's list of error codes within its program folder first. If you do not find any information, please refer to Common Issues, Questions, and their Solutions, Frequently Asked Questions. If the error you are receiving is not in the list, please report it here so the research team can investigate.

• Some types of malware will target Malwarebytes Anti-Malware and other security tools to keep them from running properly. If that's the case, please refer to the suggestions provided in For those having trouble running Malwarebytes Anti-Malware.

i completed all the steps you outlined above to the T. the first two tools ran great without a hitch. but i'm not so sure about MBAM. i have used it for some time not, it was the program i was referring to when i first posted. the scan froze several times - once for nearly 10 minutes, but i did not interfere and eventually it continued. after finally completing the scan, MBAM showed no malicious items detected. what does this mean? i'm not sure what rkill is, but it stopped 11 processes, so i was expecting MBAM to find something. now what do i do?

my roomate just suggested that i try your steps in the guest user account because i suspect that this is the account that was in use when my computer was infected. the first tool ran fine, but i tried all 4 links for rkill and i got the same result each time. when i tried to run the tool, windows did not recognize the file pev.rkexe and asked me to use the web to find a program that would open the file. why did it work in my administrator account, but not the guest account? ...i do have vista by the way.

EDIT: that is a good suggestion.

Was it Version 1.45?
Tell me what JAVA is on here.
Go into Control Panel>Add Remove Programs. Be sure the 'Show Updates' box is checked. Go down the list and tell me what Java applications are installed and their version. (Highlight the program to see this).

Let's run these next.

Next run ATF and SAS: If you cannot access Safe Mode,run in normal ,but let me know.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post logs and Let us know how the PC is running now.

Edited by boopme, 31 March 2010 - 07:40 PM.

sorry, but i'm not able to tell you anything about the version of java i HAD. before i started posting here, i tried to work out this problem myself. after watching MBAM freeze twice in a row while scanning the java program files, i deleted them. so now there is no entry under my programs list in the control panel having to do with java.

i followed your second set of steps. due to constant freezing and resuming (sometimes for 15 mins or so at a time) SUPERantispyware took over 4 hours to complete the full scan!! i was able to run it in safe mode. it found 130 adware tracking cookies. this at first gave me hope, but even after the quarantine and reboot, my computer is running worse than ever. it took about 20 minutes for this page to load. nevertheless i will post the scan log below.

is it possible that something different is wrong with my computer? perhaps some sort of a hardware failure or overheating? i have no reason to think these are possibilities except that the problem must somehow be affecting my hard drive. everytime it freezes, the hard drive indicator light on the outside of the computer case goes crazy. it basically remains lit the entire time, meanwhile any open windows are "Not Responding." but if i wait long enough it usually comes back to life. the light stays on, but i'm at least able to get something done. also, i haven't been able to shut down properly lately. it gets as far as the "logging out" page and will remain there much longer than i have been willing to wait so far. i end up holding the power key to shut off the machine.

what else can i do?

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 04/02/2010 at 09:57 PM

Application Version : 4.35.1002

Core Rules Database Version : 4763
Trace Rules Database Version: 2575

Scan type : Complete Scan
Total Scan Time : 04:35:24

Memory items scanned : 351
Memory threats detected : 0
Registry items scanned : 7419
Registry threats detected : 0
File items scanned : 118970
File threats detected : 130

Adware.Tracking Cookie
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\davey_jones@apmebf[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\davey_jones@atdmt[2].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\davey_jones@doubleclick[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\davey_jones@mediaplex[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\davey_jones@revsci[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\davey_jones@zedo[2].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@ad.yieldmanager[2].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@ads.gmodules[2].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@ads.pointroll[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@ads.undertone[2].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@advertising[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@apmebf[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@atdmt[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@collective-media[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@content.yieldmanager[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@content.yieldmanager[3].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@data.coremetrics[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@doubleclick[2].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@eb.adbureau[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@invitemedia[1].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@mediaplex[2].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@pointroll[2].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@questionmarket[2].txt
C:\Users\davey jones\AppData\Roaming\Microsoft\Windows\Cookies\Low\davey_jones@revsci[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@247realmedia[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@2607.clicksvalidate[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@2o7[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@a1.interclick[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ad.wsod[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ad.yieldmanager[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ad2.clickhype[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@adbrite[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@adecn[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@admarketplace[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ads.admaxasia[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ads.bleepingcomputer[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ads.cnn[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ads.freefoto[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ads.gamersmedia[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ads.gmodules[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ads.good[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ads.imgur[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ads.pointroll[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ads.vclick[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@adserver.adtechus[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@adtech[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@advertise[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@advertising[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@adxpose[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@apmebf[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@at.atwola[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@atdmt[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@azjmp[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@bannertgt[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@bridge2.admarketplace[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@bs.serving-sys[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@burstnet[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@casalemedia[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@cdn4.specificclick[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@chitika[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@collective-media[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@content.yieldmanager[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@content.yieldmanager[3].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@doubleclick[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@dr.findlinks[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@eas4.emediate[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@eyewonder[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@fastclick[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@findmyfile[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@fridaytrafficreport[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@ileadztracker[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@imrworldwide[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@insightexpressai[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@interclick[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@invitemedia[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@kontera[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@lstat.youku[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@media.adrevolver[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@media6degrees[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@mediacoder.sourceforge[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@mediaplex[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@microsoftmachinetranslation.112.2o7[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@microsoftwindows.112.2o7[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@msnportal.112.2o7[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@network.realmedia[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@oasn03.247realmedia[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@oasn04.247realmedia[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@overture[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@pointroll[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@presentermedia[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@pubads.g.doubleclick[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@questionmarket[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@realmedia[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@revenue[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@revsci[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@serving-sys[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@simplifymedia[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@smartadserver[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@specificclick[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@specificmedia[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@spylog[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@stat.onestat[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@statcounter[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@statse.webtrendslive[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@tacoda[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@tns-counter[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@track.adform[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@track.effiliation[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@tracking.foxnews[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@tradedoubler[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@trafficmp[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@tribalfusion[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@user-activity-tracking[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@viacom.adbureau[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@videoegg.adbureau[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@weborama[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@www.burstnet[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@www.fridaytrafficreport[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@www.presentermedia[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@www.worldlingomedia[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@yadro[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@zedo[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\Low\user@zillow.adbureau[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\user@advertising[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\user@at.atwola[1].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\user@atdmt[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\user@atwola[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\user@questionmarket[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\user@tacoda[2].txt
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\user@www.fridaytrafficreport[1].txt

Ok, that at least means we just have a corrupt Java file left over. It does not appear to be malware tho it is still possible. I think you should post agin in the corresponding Operating System forum at the top they will probably go thru your event viewer and determine if it is hard or software. I will keep this topic open for an update.

my computer has gotten a lot worse. i wasn't able to even load this forum page because it will freeze too quickly after startup. then i can't shut down either. i'm on a different computer now, i'm afraid to start mine up again. what exactly should i do? i'm not clear on where to go and what to say.

Can we get a DDS log posted??
Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9 and not here,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/t/307611/infected-with-something-dont-know-what-to-do/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a MRT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the MRT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the MRT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the MRT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another MRT Team member is already assisting you and not open the thread to respond.

Please be patient. It may take several days to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom