Can't remove Qoologic

Discussion in 'ewido anti-spyware forum' started by lmcnutt, Aug 17, 2006.

Thread Status:
Not open for further replies.
  1. lmcnutt

    lmcnutt Registered Member

    Joined:
    Aug 17, 2006
    Posts:
    3
    Hi,

    I cannot get ewido to remove this spy-ware:

    Downloader.Qoologic.ai

    ewido identifies this everytime the system starts up. I click "Clean and move to quarantine", but it's back again everytime I reboot.

    The quarantine area looks like this:
    c:\windows\system32\wioqpp.exe
    c:\documents and settings\all users\start menu\programs\startup\xhqw.exe

    Please help if you can, thanks!
    Larry
     
  2. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    7,300
    Location:
    England
    Have you tried running ewido in safe mode?
     
  3. TopperID

    TopperID Registered Member

    Joined:
    Oct 1, 2004
    Posts:
    1,527
    Location:
    London
  4. sosaiso

    sosaiso Registered Member

    Joined:
    Nov 12, 2005
    Posts:
    601
    I've had a similar issue about two months ago with Ewido not removing qoologic in safe mode. Resorted to a HijackThis forum and the qoologic fix along with a few other things.
     
  5. lmcnutt

    lmcnutt Registered Member

    Joined:
    Aug 17, 2006
    Posts:
    3
    Thanks all,

    I think in the flurry, I did try in safe mode but ewido didn't find anything when running in safe mode.

    I will the other ideas and report back to you.

    Larry
     
  6. lmcnutt

    lmcnutt Registered Member

    Joined:
    Aug 17, 2006
    Posts:
    3
    Ok, weird

    Started the machine up and downloaded qoofix.
    Turned off ewido (because it had already found the goologic trj upon boot-up).
    Restarted the system (with ewido disabled)
    Ran the qoofix tool. - It found nothing.
    Re-enabled ewido without rebooting, - Ewido immediately found qoologic!!!

    Now when I reboot, qoologic is not found, so I guess it's fixed!

    Just weird that it didn't find anything to fix, yet it fixed it. I wish I could write software that good!

    Thanks everyone.
    Larry
     
  7. TopperID

    TopperID Registered Member

    Joined:
    Oct 1, 2004
    Posts:
    1,527
    Location:
    London
    It's best not to count your chickens......!

    You may want to do an online scan to see if that finds something:-

    http://www.kaspersky.com/service?chapter=161739400

    Also, it would probably be a good idea to submit a HJT log at a suitable Forum, because there is bound to be debris that needs cleaning up.
     
Thread Status:
Not open for further replies.