Cookingluck virus. Please help me!

It appears that you did not follow the instructions for running MGtools properly. It looks like you did not click to Accept the license agreement for TrendMicro's HijackThis as specified in the READ ME. As a result it did not run a put a log into the MGlogs.zip file.

What did you do to this PC on Dec 29, 2007? Many many files are showing with that date. Did you reinstall on that date or restore from a backup? Having so many new files (thousands) makes your logs almost useless.

Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Now we need to use ComboFix.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Make sure this time you click (twice) to accept the TrendMicro HijackThis license agreement.

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

HijackThis is still not installed or running to produce a log. Please do the below.

• Right Click Start and select Explore.
• Navigate to the C:\MGtools folder.
• Double click on the analyse.exe file
• Tell me what happens.

Also you still have some of the infection. Please do the below.


Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Tell me if you get a success message about adding the above to the registry.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below logs:

• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Okay that is what we were looking for. Now I just need one more log from MGtools to verify the registry entries really got fixed.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below logs:

• C:\MGlogs.zip

 

Okay while everything seems alright, it is not completely fixed. Something is blocking you from getting those bad registry entries from the malware removed. Also HijackThis does not run each time when you run the GetLogs.bat program (from MGtools) which is also troublesome. I'm not sure what is causing the problems but it may related to McAfee or another security program. Please uninstall SUPERAntispyware now since we are really finished with it anyway. Then please try shutting down or disabling as much of McAfee as possible and let's try fixing those registry entries again with ComboFix.

Now we need to use ComboFix.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Please watch for any error messages in the command prompt window that opens and let me know if you notice any problems while GetLogs.bat runs.

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip