Found Spyware Look2me - Is this safe to remove?

Huggins

Following the Malware advice stickie I have run all the AV programmes in safe mode and then restarted but this virus keeps reinventing itself Look2me in the system32 file.

So i have found this link on the web for removal http://www.pchell.com/support/look2me.shtml does this advice seem sound to anyone with a technical knowledge? I am concerened it might be the work of a hoaxer and i'll end up with even more problems!

thx for any help

gunneradt

i wouild install and run a spyware removal programme.

As Ive said on other threads, spysweeper by webroot is way ahead of the others but is not free.

Huggins

anyone else know if the above link is OK or how to safely remove look2me spyware?

as the spyware removal programmes pick up look2me but do not remove it from the computer -despite claiming to!!!

coolsteel

Try using Awido Security Suite here, http://www.ewido.net/en/download/ its free for so many days, certainly worked for me.
Hope this helps Huggins as i know spareware is stress city!
Also try here for lots and lots of free help,
http://www.geekstogo.com/
Coolsteel :cool:

pchelpman

Look2Me/VX2 are nasty little things that have been around for a while.

You can follow coolsteel's advice and go to Geeks2Go or you can post your HJT log to this thread. It will show where the L2M/VX2 varients are hiding but the removal process may be lenghty depending on how badly you are infected.

Let us know what you decide to do.

Huggins

thanks all - have ewido, it finds the prob but doesnt fix it. How do i get a HJT log to post please?

pchelpman

Huggins wrote:

thanks all - have ewido, it finds the prob but doesnt fix it.

To be honest I didn't think it would.

---

To address the VX2/L2M infection download this ...

http://www.downloads.subratam.org/l2mfix.exe by ShadowWar.

1. Save the file to your desktop

2. Double click l2mfix.exe

3. Click the Install button to extract the files and follow the prompts

4. Open the newly added l2mfix folder on your desktop

5. Double click l2mfix.bat

6. Select option #1 for Run Find Log by typing 1 and then pressing enter

7. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log.

8. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

---

Huggins wrote:

How do i get a HJT log to post please?

Download HijackThis here ....

http://www.spywareinfo.com/~merijn/files/HijackThis.exe

Install it on your system in a secure loaction (I recommend your main C: hard drive) then open it.

You will be presented with a menu of options ... choose the first one "Do a system scan and save a log file". Two things will happen.

Your system will be scanned then, on top of the scan window, a Notepad log file report will appear. Copy & paste that log file report to this thread.

When posting let us know how your computer is behaving after this.

Huggins

pchelpman wrote:

To be honest I didn't think it would.

---

To address the VX2/L2M infection download this ...

http://www.downloads.subratam.org/l2mfix.exe by ShadowWar.

Thanks - The above link isn't working for me. Page not found?

pchelpman

Don't know what's happening this morning. It was OK earlier.

Atribune also hosts the fix here but that's not working either.........

http://www.atribune.org/downloads/l2mfix.exe

You keep trying both and I'll ask around if other analysts are having the same trouble.

I'll let you know.

EDIT 12:32 pm > still don't know about subratam but Atri has said that his site was subject to a DOSS "denial of servie" attack a couple of days ago so he's trying to fix thing's there. We'll both just keep trying!

EDIT 15:15 pm > both links operational again now.

Huggins

THANKS - have downloaded the l2mfix as per above insrtuctions. Have run the option#1 but notepad hasn't opened with the log file approx 10 minutes or more has elapsed. Could something be blocking this from opening???

cheers antony

Huggins

anyone please?