Found Spyware Look2me - Is this safe to remove?

Huggins

Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\backup.zip[WGI.DLL]
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\backup.zip[WNHBTH.DLL]
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\backup.zip[WQERROR.DLL]
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\backup.zip[WR2_32.DLL]
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\backup.zip[WSNMM.DLL]
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\backup.zip[WTADEFUI.DLL]
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\backup.zip[wtafbdrv.dll]
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\backup.zip[wwweb.dll]
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\IXSHLPR.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\IZ50_QC.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\IZAGEHLP.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\jt0207doe.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\jt8007lme.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\KCDAL.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\KMDSG.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\KNDCZ2.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\KQDIT.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\KRDAL.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\kt66l7js1.dll


Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\ktjql7151.dll

Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\KUDHU.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\KWDMAC.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\KXDYCC.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\l64q0gh5e64.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\LSX2KUSB.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\LURHELP.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\lv2209foe.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\lv4s09h7e.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\LVBVUTIL.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\lvlm0931e.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\MBV1_0.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\MDCTF.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\MGFUTIL.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\mhvci70.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\MJIQTZ32.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\mjvcp70.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\MLRMSG.DLL

Huggins

Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\mpc71.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\mv44l9hq1.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\MWCSHEXT.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\MWHCP.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\MYCSUBS.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\MYCTFP.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\n06q0aj5edo.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\NILANUI.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\nv2029fmg.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\OMEPRO32.DLL


Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\oT660gjse6o60.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\PGP.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\PIPGASVC.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\PLDLIB32.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\PLRFOS.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\PXGFILT.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\RBSSER.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\RCSUTILS.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\RGVPSP.DLL

Huggins

Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\RHIPXMIB.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\RRND.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\RUCHED32.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\SHFTPUB.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\SIECLI.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\SKLGNTFY.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\SQMAPI.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\SWECLI.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\TFEXT.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\TXBYUV.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\UERV42A.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\UIL.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\UUERENV.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\UYHISAPI.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\VBRSION.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\VO5DB.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\VSRSION.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\WBIDX.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\WBVEMSP.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\WCPSHELL.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\WDPCORE.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\WGI.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\WNHBTH.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\WQERROR.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\WR2_32.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\WSNMM.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\WTADEFUI.DLL
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\wtafbdrv.dll
Adware:Adware/Look2Me Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\dlls\wwweb.dll
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Antony\Desktop\l2mfix.exe[Process.exe]
Potentially unwanted tool:Application/FunWeb Not disinfected C:\Program Files\backups\backup-20041215-103710-510.inf
Virus:Trj/Qhost.Y Disinfected C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.20050315-103447.backup

---

TREND HOUSECALL found the following - but i couldn't find any links or info on how to remove the problem - it directed me to a page which just stated:

"(MS01-028) RTF Document Linked to Template Can Run Macros Without Warning


Vulnerability Identifier: CVE-2001-0240
Discovery Date: May 21, 2001
Risk: Critical
Vulnerability Assessment Pattern File: 008
Related Malware: W97M_GOGA.A
Affected Software:
Microsoft Word 2000
Microsoft Word 2001(MAC)
Microsoft Word 97
Microsoft Word 98 (MAC)
Microsoft Word 98(J)

Description:

This vulnerability allows attackers to execute macros without user warning. It is done by linking a Rich Text Format document to a template that contains an embedded macro.

---

BEST REGARDS,

Huggins

albertross_2

Is there anything you want under the l2mfix folder on Anthony's desktop, if not, just delete the folder and empty the recycle bin.

If you haven't run https://www.windowsupdate.com run it. That should patch you against most of the known vulnerabilities in Windows.

run https://www.ccleaner.com

Then do an independant scan

http://safety.live.com/site/en-US/default.htm

(full scan)

and install this if you don't already have it..

http://www.microsoft.com/athome/security/spyware/software/default.mspx

edit: have just read some of your rather long thread.. have you downloaded l2mfix, and panda/ad-aware is reporting it as something nasty?

pchelpman

Huggins ... please don't fix ANYTHING more yet till I've looked throught the logs.

Thanks.

Huggins

Ok Pchelpman i'm hanging fire until further notice.

Thx Albertross - i think i have downloaded most of the stuff you rec. previosuly on the advice of Pchelpman.

Thanks Huggins

pchelpman

Hi Huggins .... clean up time. The Activescan log reveals a few things to resolve/clarify.

swimsuitnetwork > Go to this file in bold and delete it......

C:\WINDOWS\SYSTEM32\MYDLL.dll

---

Mywebsearch > this is a nuisance and - possibly unwanted - adware/spyware. Do you use this "tool"? Did you even know it was there?

If you want to get rid of it you can try doing a system-wide search for that name and delete all instances of it.

However, this time there are no guarantees. It may return.

---

MyWay search > again, this is a nuisance and - possibly unwanted - adware/spyware. Do you use this "tool"? Did you even know it was there?

It is an indication that you may have a Dell computer. Dell add this "MyWay" "facility" to all their PCs now. The general view is that it is classified as spyware.

If you want to get rid of it you can try doing a system-wide search for that name and delete all instances of it.

However, again, there are no guarantees. MyWay is very difficult to remove. Dell bury it deep into their machines but, if it isn't a Dell computer, this might work.

---

You have this file - in bold - from Funwebproducts .....

C:\Program Files\backups\backup-20041215-103710-510.inf

Find it and delete it.

Funwebproducts produce things like free smilies, screensavers and similar. It is NOT a recommended site as their products come littered/bundled with adware/spyware and so on. Avoid it like the plague.

---

Now l2mfix has done its job go to this file and delete it ....

C:\Documents and Settings\Antony\Desktop\l2mfix

---

Download Spybot Search & Destroy and install it. Please run it, click "Search for Updates" then "Check for Problems". If it finds something, check/tick all items in RED and hit the “Fix Selected Problems” button. Exit Spybot.

….& DSO Exploit fix…….
If you keep getting the DSO Exploit entries, even after you updated Windows and fixed them, then download the Spybot DSO Exploit Fix here
and install it over the current Spybot installation. A quick tutorial for using Spybot can be found here.

---

Download Ad-aware SE Personal here…

http://www.lavasoftusa.com/

Install it if you don't have it already. Make sure it's the newest version and check for any updates before running it.

Scan and get Ad-Aware to fix anything found to be bad.

---

As albertross recommends you should download ccleaner and clean your system with it.

---

Housecall > the problem Housecall flagged up only relates to old software and shouldn't be around any longer.

Again, as albertross suggests, you should update your whole Windows protection by downloading all the latest "crtitical updates" from Microsoft. That should help protect you.

Also you can do like I do ... avoid "Rich Text Format" in document.

---

Now you need to clean out all your System Restore Points.

Turn off System Restore by Clicking Start > right-click My Computer and then click Properties. Click the System Restore tab > Check "Turn off System Restore" or "Turn off System Restore on all drives". Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this. Click OK.

Reboot your System.

To turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.

Create a new system restore point immediately so that you have something to fall back on if it all goes wrong again in the future. I suggest you also make a habit of creating new system restore points regularly to mitigate any loss to data and programs.

---

Finally, to help keep your system protected, read this handy little guide ......

http://www.help2go.com/Tutorials/Protect_Your_PC/Avoid_Web_Browser_Hijackers.html

Huggins

Sorry to be dumb but do i have to re-run the Active Scan inorder to be able to remove the first file you outlined above or can I access the file some other way - eg. thru add/remove programmes?

Many thx Pchelpman

pchelpman

You're not dumb. The fact that you are asking says that.

No need to use any tools ... just go directly to that file and delete it.

C:\WINDOWS\SYSTEM32\MYDLL.dll

Thus .....

Double click the "My Computer" icon on your desktop ...

Double click on the C: drive ...

Double click the WINDOWS folder on that drive ...

Open the System32 folder in that folder ...

See the MYDLL.dll file? Delete it.

[then empty your recycle bin, by the way. Ccleaner should help with things like that but manual emptying is good].

You can run those Activescan and Housecall scans whenever you like. In fact, I would recommend it as an aid to keeping your PC in check.

The next Activescan log should be much shorter once you have deleted l2mfix, as advised above. If you ever see anything suspiscious in the results of a scan post the log in this fourm again with your questions.

Huggins

Just a quick note to say THANK YOU VERY much to Pchelpman for all your very helpful info and advice. My comp is running perfectly at the moment (fingers crossed!).

It's people like you who make the moneysaingexpert such a great site.

Keep up the goodwork and thanks again.

Regards

Huggins