Look2me

Question

Having problems when I log on.  Get a box that says 'you or a program have requested information from www.look2me.com.  The popups are beyond annoying.  Someone please help.  I ran Hijack This and the results are as follows    Logfile of HijackThis v1.98.0Scan saved at 8:47:34 PM, on 6/29/2004Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32undll32.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exeC:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeC:\PROGRA~1\FOURHI~1\List Does.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\PROGRA~1\MYDAIL~1\MYDAIL~1.EXEC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\MSN\MSNCoreFiles\msn.exeC:\Program Files\MSN\MSNIA\msniasvc.exeC:\Program Files\MSN\MSNIA\WA\ClientSideProxy.exeC:\Documents and Settings\josephine lepore\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search200.com/passthrough/index.html?http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=homeR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9022F0 - system.ini: Shell=F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: piledebugdash - {9607B6D3-0C13-E503-9962-8DE404276621} - C:\PROGRA~1\ISOHOL~1\Dale noun.dllO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exeO4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsersO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [MoneyStartUp10.0] 'C:\Program Files\Microsoft Money\System\Activation.exe'O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exeO4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exeO4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeO4 - HKLM\..\Run: [IncredimailDownloader] C:\WINDOWS\DOWNLO~1\imloader.exeO4 - HKLM\..\Run: [8DE69C19] C:\WINDOWS\System32\hlqrdg.exeO4 - HKLM\..\Run: [Free tray] C:\PROGRA~1\FOURHI~1\List Does.exeO4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /backgroundO4 - HKCU\..\Run: [MyDailyHoroscope] C:\PROGRA~1\MYDAIL~1\MYDAIL~1.EXEO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O8 - Extra context menu item: View Original Image - C:\program files\msn\msnia\wa\getoriginal.htmO9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v5.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{A3DF3403-52DF-43F4-B30C-89E15D8369D5}: NameServer = 209.244.0.3 209.244.0.4 Please help...thanks in advance.

JohnK324 · Answer

Boston Red, To remove Look 2 Me, run Spybot 1.3, search for updates then scan.  Look 2 Me is on the list. You can get your free copy here   There are a lot of info on this spyware, check here and here Hope this helps, John

ChrisRLG · Answer

Or try this http://www.wilderssecurity.com/showpost.php?p=206749&postcount=6 Ad-aware has a 'pluggin' that deals with it too.

ChrisRLG · Answer

Did you try the ad-aware pluggin on that page too. If so - or after you do - post a new hijackthis log.

Boston Red · Answer

Chris:  Tried your suggestion with VX2 cleaner to remove Look2Me and it did not remove it.  This is really a tough one.

Boston Red · Answer

I now have a new box that pops up that says you or a program have requested info from 'my horoscope.net'.  I will post another HijackThis log.  Thanks.

Boston Red · Answer

New logfile: Logfile of HijackThis v1.98.0Scan saved at 1:48:59 PM, on 7/5/2004Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32undll32.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Norton AntiVirus\SAVScan.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exeC:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeC:\PROGRA~1\FOURHI~1\List Does.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\PROGRA~1\MYDAIL~1\MYDAIL~1.EXEC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\MSN\MSNCoreFiles\msn.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\MSN\MSNIA\msniasvc.exeC:\Program Files\MSN\MSNIA\WA\ClientSideProxy.exeC:\Documents and Settings\josephine lepore\Local Settings\Temp\Temporary Directory 2 for hijackthis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search200.com/passthrough/index.html?http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=homeR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9022F0 - system.ini: Shell=F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: piledebugdash - {9607B6D3-0C13-E503-9962-8DE404276621} - C:\PROGRA~1\ISOHOL~1\Dale noun.dllO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exeO4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsersO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [MoneyStartUp10.0] 'C:\Program Files\Microsoft Money\System\Activation.exe'O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exeO4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exeO4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeO4 - HKLM\..\Run: [IncredimailDownloader] C:\WINDOWS\DOWNLO~1\imloader.exeO4 - HKLM\..\Run: [8DE69C19] C:\WINDOWS\System32\hlqrdg.exeO4 - HKLM\..\Run: [Free tray] C:\PROGRA~1\FOURHI~1\List Does.exeO4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /backgroundO4 - HKCU\..\Run: [MyDailyHoroscope] C:\PROGRA~1\MYDAIL~1\MYDAIL~1.EXEO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O8 - Extra context menu item: View Original Image - C:\program files\msn\msnia\wa\getoriginal.htmO9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - (no file)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v5.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{A3DF3403-52DF-43F4-B30C-89E15D8369D5}: NameServer = 209.244.0.3 209.244.0.4

Boston Red · Answer

John:  Spybot Search & Destroy gives the following result:  DSO Exploit 5 files.  It fixes them but they come up again on every scan.   I tried to download Look2me uninstaller, but it says my security setting won't allow it.  Don't know what to do next.  I don't feel comfortable to go into the registry and mess around with any of that stuff.

ChrisRLG · Answer

Thanks baskar1234 - I am a little indisposed at the moment - thanks for taking obver. Boston Red - you are in good hands.

baskar1234 · Answer

Hello,

Chris might be away for sometime.

Spybot 1.3 seems to have a glitch that it up comes with this DSO exploit everytime . But its ok .

For Look2me,

Download VX2Finder from this link:
http://www.downloads.subratam.org/VX2Finder.exe

--------------------------------

Sign off and stay off the internet until the entire procedure is complete.

Open VX2Finder and click on the *click to find VX2.BetterInternet* button.

Then select the *Delete these files* button.
You will be left with notice about one to be deleted on reboot.
It will ask to reboot on deletion of the last file (Reboot)

-----------------
Once back in Windows

Open VX2Finder again and click on these buttons in the right pane:

user agent, Guardian.reg, restore policy

Exit and reboot.

Run Vx2Finder once more and click on the *click to find VX2.BetterInternet* button. Then click *make log*.

Post it here with a fresh HijackThis log please.

Boston Red · Answer

Hi Baskar: I downloaded VX2 Finder and ran it. It came up with the following, but did not give me an option to delete in the delete box. What now?

Log for VX2.BetterInternet File Finder

Files Found---

Guardian Key--- is called:

User Agent String---
{9A383D2A-3A39-4BDF-AAF1-2636CD136545}

baskar1234 · Answer

Hello,

I see no signs of look2me in your log. But thats look2me anyway.

But try the latest version of ADAWARE plugin from their website.

Also ,

Close all browser windows. Run Hijackthis. Put a check mark on all these entries.Hit FIX CHECKED button.

O4 - HKLM\..\Run: [IncredimailDownloader] C:\WINDOWS\DOWNLO~1\imloader.exe
O4 - HKLM\..\Run: [8DE69C19] C:\WINDOWS\System32\hlqrdg.exe
O4 - HKLM\..\Run: [Free tray] C:\PROGRA~1\FOURHI~1\List Does.exe

O4 - HKCU\..\Run: [MyDailyHoroscope] C:\PROGRA~1\MYDAIL~1\MYDAIL~1.EXE
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - (no file)

Reboot into safe mode.

Unhide all files and folders.

http://www.xtra.co.nz/help/0,,4155-1916458,00.html How to unhide file and folders

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001060608000039 How to boot into safe mode

Delete ,

C:\WINDOWS\DOWNLO~1 -- FOLDER STARTING WITH THAT NAME

C:\PROGRAM FILES\FOURHI~1\ -- FOLDER STARTING WITH THAT NAME

C:\WINDOWS\System32\hlqrdg.exe -- FILE

C:\PROGRAM FILES\MYDAIL~1\ -- FOLDER STARTING WITH THAT NAME

Reboot, rescan with hijackthis and post a fresh log.

Boston Red · Answer

Hi Baskar:  I tried Adaware plug in and it didn't work.  I followed your instructions for the Hijack This log.  I couldn't find 04-HKLM//Run:(8DE69C19)C:in.System 32/hlqrdg.exe  Found the others and deleted them.  When I rebooted into safe mode I couldn't find Syst. 32/hlqrdg.exe file or Downlo-1 folder.  Here is the new Hijack This log. and Look2me is still on my computer.   Logfile of HijackThis v1.98.0Scan saved at 8:23:38 PM, on 7/6/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Norton AntiVirus\SAVScan.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exeC:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeC:\Program Files\MSN Messenger\MsnMsgr.ExeC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\WINDOWS\System32\wuauclt.exeC:\Documents and Settings\josephine lepore\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exeC:\Program Files\Messenger\msmsgs.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search200.com/passthrough/index.html?http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhomeF0 - system.ini: Shell=F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: piledebugdash - {9607B6D3-0C13-E503-9962-8DE404276621} - C:\PROGRA~1\ISOHOL~1\Dale noun.dllO4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exeO4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsersO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [MoneyStartUp10.0] 'C:\Program Files\Microsoft Money\System\Activation.exe'O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [Lexmark X73 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X73.exeO4 - HKLM\..\Run: [Lexmark X73 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X73.exeO4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exeO4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /backgroundO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/popcap/zuma/popcaploader_v5.cab

baskar1234 · Answer

Hello, your log looks clean . Do you still have problems.

Boston Red · Answer

Hi Baskar:

Got the latest update (6.181) for Ad-aware and ran it. It found 1 registry key and 19 files. It removed the 19 files and said it could not remove

C:\Windows/System32\6qo-4svc.dll and that it would remove it on the next reboot. I rebooted and ran Ad-aware again. It found the same System 32/6qo-4svc.dll and removed it. I ran Ad-aware a third time and it found nothing.

Logged on and haven't seen Look2me yet. Hope I never see it again....what a nuisance. I think we did it. Many thanks for your efforts. Don't know what I would have done without you. The Forum is a great place and you guys are top notch.

Again, many thanks.....until the next virus.......Boston Red

nonu2101 · Answer

according to me you should delete the fiiles which are associated with this

Virus & Spyware

Was this post helpful?