Qoologic... cant get rid of

Discussion in 'Malware Help (A Specialist Will Reply)' started by ManIneedHelP, Jun 16, 2006.

  1. ManIneedHelP

    ManIneedHelP Private E-2

    I have been working on this, with the help of this site, for two days now... It started with the Brave Sentry garbage, now has turned into this.

    Ad-Aware(up to date) shows the same three entrys everytime. I remove them and they are ALWAYS back right away. Spybod S&D(up to date) always says Im clean. Microsoft Defender ALWAYS shows the same qoologic, and then says I need to restart to fix but it is ALWAYS there after restarting. Ill attach pix of the ad-aware and ms def.
    I installed and updated Trendmicros PC Cillin in hopes that it would take care of it. It always finds files but cant do anything with them, it suggests I manually del them but I cant, in safe mode I can del a few of them but some I cant.

    Any help would be GREATLY appreciated!
    Also windows is fully up to date.
     

    Attached Files:

    ManIneedHelP, Jun 16, 2006
    #1
  2. ManIneedHelP

    ManIneedHelP Private E-2

    Went throught all the steps again in safemode with networking to see if I could get it to go... All went well except for the panda scan. It would get to the screen to choose my comp, hdds, etc. but when I clicked on anyone of the options nothing would happen...

    Run Ccleaner - Del about 78mb of stuff
    Microsoft Windows Malicious Software Removal Tool - didnt find anything
    Run Ad-Aware SE - found the same three as the pic in first post
    Run Spybot Search & Destroy - didnt find anything
    Run Microsoft Windows Defender - found the same qoologic

    Bitdefender - found a decent amount, attaching log
    Panda - as stated above, didnt work

    hope this helps
     

    Attached Files:

    ManIneedHelP, Jun 17, 2006
    #2
  3. ManIneedHelP

    ManIneedHelP Private E-2

    well for some reason I was still using Ad-aware 6.5 so I upgraded to se and it took care of some of the problems...

    Now Ad-aware sees two e2g problems in the registry:
    HKLM\SOFTWARE\Classes\IeBHOs.Control
    HKLM\SOFTWARE\Classes\IeBHOs.Control.1

    When I try and repair them it says it needs to start on next restart to take care of the problem... But the stupid malware somehow makes just exlporer restart so that when I restart the computer ad-aware doesnt start up like it was supposed to...

    Man this is driving me crazy.

    I tried ewido's online scan and it detected the same problems but couldnt fix it. I dl'd ewido's program and scanned. Detected the e2g but cant fix it...

    I could really use some help...:confused:
     
    ManIneedHelP, Jun 17, 2006
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You need to run the below so we can locate hidden files related to a Qoologic infection.

    Download FindQool by LonnyRJones
    • Extract the files and place the FindQool folder into root folder of your hard disk. This is usually C:\
    • Open the folder and run Qlocate.bat
    • attach the contents of the txt.log which will open when the scan is finished. You will have to attach this to a second message because only 3 logs can be attached to a single message.
    FindQool is not a removal procedure. It is a scan that helps us to locate hidden files and registry keys so we can work up a fix for the Qoologic infection.

    There is another sticky thread procedure for E2Give problems that you should follow.
     
    chaslang, Jun 18, 2006
    #4
  5. ManIneedHelP

    ManIneedHelP Private E-2

    I did the "generic" e2g removal sticky which got rid of the e2g folder and thats about it.

    As you said there seems to be some hidden file still running the show. That and the fact that I am unable to delete the HKLM\SOFTWARE\Classes\IeBHOs.Control
    HKLM\SOFTWARE\Classes\IeBHOs.Control.1
    in the registry...

    The qooreport didnt show any files until:
    Files In Winlogon shell and userinit
    Listed here as a Doublecheck for the locate com results
    shell REG_SZ Explorer.exe
    userinit REG_SZ userinit.exe

    If I still need to creat another post just let me know, I was trying to keep it simple in one post for future searches.

    Thanks!
     
    ManIneedHelP, Jun 18, 2006
    #5
  6. ManIneedHelP

    ManIneedHelP Private E-2

    I guess I read your post incorrectly.

    Here are the logs for findqool, rkfiles, and winpfind
     

    Attached Files:

    ManIneedHelP, Jun 18, 2006
    #6
  7. ManIneedHelP

    ManIneedHelP Private E-2

    and a current hijackthis

    I dont know if this helps or not but it seems that 90% of the pop ups that I keep getting dont open the page they are trying to get. The window opens(but doesnt show on the taskbar) with nothing on it.
     

    Attached Files:

    ManIneedHelP, Jun 18, 2006
    #7
  8. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    The symptoms in you HJT log have change since the previous post. Have you been running other steps to remove problems? Or did you incorrectly attach a HijackThis log from safe boot mode which is of no use to us?

    Anyway..... run the below procedure and attach the requested log. This should fix your Look 2 Me infection.

    Look2Me VX2 Removal


    Then also attach a new HJT log from Normal Boot mode.
     
    chaslang, Jun 18, 2006
    #8
  9. ManIneedHelP

    ManIneedHelP Private E-2

    well that program seemed to do what the others have failed at. Thanks! The only problem that I can see now is that all my picture choices for my desktop background are still all greyed out...

    Here are the logs, sorry for the last hijackthis in safemode. Ive been living in safemode for the last week...

    thanks again!
     

    Attached Files:

    ManIneedHelP, Jun 19, 2006
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay all visible malware seems to be gone. You remaining problems could be due to some registry changes.

    Run the below procedure and attach the runkeys.txt log.
     
    chaslang, Jun 19, 2006
    #10
  11. ManIneedHelP

    ManIneedHelP Private E-2

    Heres the runkey
     

    Attached Files:

    ManIneedHelP, Jun 20, 2006
    #11
  12. ManIneedHelP

    ManIneedHelP Private E-2

    its all good now, I dont know what caused it but the last restart took care of it.
    Thanks for all the help!
     
    ManIneedHelP, Jun 20, 2006
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You still have a few hidden problems we need to fix.

    First click Start, Run and enter MSconfig and click OK. Then select Normal Startup. Then click Apply, Ok and reboot.

    Now run the below procedure which I recently updated:

    SpywareQuake & SpyFalcon Removal Procedure

    Then attach the smitfiles.txt log that is requested.

    Then get another runkeys.txt log and attach it. There could be more to clean up.
     
    chaslang, Jun 20, 2006
    #13
  14. ManIneedHelP

    ManIneedHelP Private E-2

    thanks
     

    Attached Files:

    ManIneedHelP, Jun 20, 2006
    #14
  15. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay the SPywareQuake procedure fixed some of the things I saw. But you attached the wrong log. I need a new runkeys.txt log which comes from running GetRunKey.bat. I did not need to see an rkfiles log.
     
    chaslang, Jun 21, 2006
    #15
  16. ManIneedHelP

    ManIneedHelP Private E-2

    sorry, been running so many things I thought the runkey was the rkfiles...

    here is the real one
     

    Attached Files:

    ManIneedHelP, Jun 21, 2006
    #16
  17. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay there are still a few things lingering around in the registry I want to fix.

    Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.
    Then attach a new and hopefully a final runkey.txt log so we can make sure we got everything fixed. Also attach a new HJT log.
     
    chaslang, Jun 21, 2006
    #17
  18. ManIneedHelP

    ManIneedHelP Private E-2

    thanks again!
     

    Attached Files:

    ManIneedHelP, Jun 22, 2006
    #18
  19. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your logs are clean. If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

    After that, you should work thru the below link:

    How to Protect yourself from malware!
     
    chaslang, Jun 23, 2006
    #19

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds