Can't remove Qoologic

Hi,

I cannot get ewido to remove this spy-ware:

Downloader.Qoologic.ai

ewido identifies this everytime the system starts up. I click "Clean and move to quarantine", but it's back again everytime I reboot.

The quarantine area looks like this:
c:\windows\system32\wioqpp.exe
c:\documents and settings\all users\start menu\programs\startup\xhqw.exe

Please help if you can, thanks!
Larry

 

You could try this:-

http://www.besttechie.net/forums/index.php?showtopic=9051

 

I've had a similar issue about two months ago with Ewido not removing qoologic in safe mode. Resorted to a HijackThis forum and the qoologic fix along with a few other things.

 

Thanks all,

I think in the flurry, I did try in safe mode but ewido didn't find anything when running in safe mode.

I will the other ideas and report back to you.

Larry

 

Ok, weird

Started the machine up and downloaded qoofix.
Turned off ewido (because it had already found the goologic trj upon boot-up).
Restarted the system (with ewido disabled)
Ran the qoofix tool. - It found nothing.
Re-enabled ewido without rebooting, - Ewido immediately found qoologic!!!

Now when I reboot, qoologic is not found, so I guess it's fixed!

Just weird that it didn't find anything to fix, yet it fixed it. I wish I could write software that good!

Thanks everyone.
Larry

 

It's best not to count your chickens......!

You may want to do an online scan to see if that finds something:-

http://www.kaspersky.com/service?chapter=161739400

Also, it would probably be a good idea to submit a HJT log at a suitable Forum, because there is bound to be debris that needs cleaning up.