HJT log

[IABoy02]

[Gecko]

I think you may have the newest version of VX2. Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe.
Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.
Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter.
This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log.
Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

[IABoy02]

edited out see below post

[IABoy02]

[Gecko]

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix,
by typing 2 and then pressing enter, then press any key to reboot your computer.
After a reboot, your desktop and icons will appear, then disappear (this is normal).
L2mfix will continue to scan your computer and when it's finished, notepad will open with a log.
Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

[IABoy02]

[IABoy02]

i am using eScan Antivirus and KillBox to get rid of the files it says are infected. I will post new logs afterwards.

Thanks again for your help so far.

[IABoy02]

[Gecko]

This appears to be a new variant of the look2me/VX2 malware that disables the l2mfix on reboot.

Please copy this to Notepad and print it. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
You should not have any open windows when you are following the procedures below.

Boot into safe mode:
Reboot after you see the BIOS screen and before Windows starts to load.
Start tapping the F8 key. The Windows Advanced Options Menu appears.
Use the Arrow key to ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.

Once in safe mode right click on you D:\ drive and select Scan with Norton antivirus.

After Norton has finished remove everything it finds, note names of any files it could not remove.

Start KillBox put a check next to ‘Standard file kill’ and ‘End Exploere while killing file.
Now paste the below into the text box then delete the file:
D:\WINDOWS\SYSTEM32\mfc42d~1.tmp

Do the same for each of the following files: (Also add any files Norton couldn’t remove)

D:\WINDOWS\SYSTEM32\agipdlxx.dll
D:\WINDOWS\system32\en68l1ju1.dll
D:\WINDOWS\SYSTEM32\chypt32.dll
D:\WINDOWS\SYSTEM32\fnl021~1.dll
D:\WINDOWS\SYSTEM32\o0pqla751d.dll
D:\WINDOWS\SYSTEM32\ilakeng.dll

If KillBox cannot delete any of the above files try replacing on reboot using the dummy file.

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. (Turn it back on after this is repaired and you've rebooted.)
Close all other open Windows and have HiJackThis Fix:
O20 - Winlogon Notify: App Management - D:\WINDOWS\system32\en68l1ju1.dll

Now, empty all your TEMP Folders, Temporary Internet Files Folder and then empty your Recycle Bin, reboot and post a new HiJackThis log.

[IABoy02]

[Gecko]

This is a new variation of the look2me/VX2 malware, the problem is that it is hooked to the winlogon.
So even trying to delete it from the recovery console won’t work because you have to login first.
I will have to do some more research on a guaranteed removal process.

In the mean time, Look2me_dot_com has an uninstall program that you can download from
I have no way of checking to see if it works or not, I did download it but it was not found on my system.
I’m afraid that you will have to have the whole Look2me spyware installed in order for the uninstall to work.
But it’s worth a try anyway.

[IABoy02]

heh that's the site that many of the popups came through. I don't know if that is a good thing or a bad thing. Anyway, I couldn't download that file (not sure why -- it seemed as though my browser was trying to open the file within it instead of even giving me the option to save or open the file). But I downloaded a different file () which is supposed to get rid of it (probably an older variant of it anyway). I also downloaded and installed XoftSpy 4.17 and ran it. It found no traces of Look2Me (and that's one of the things it looks for).

I understand that this may not be fixed but I really think it may be as I have restarted my computer quite a few times and run the various scanners and they haven't found any traces of it. I also haven't had any popups since I posted that last message about it being fixed. Hopefully it truly is fixed and this is not just wishful thinking.

Anyway, I will continue to check on this thread a couple times a day or so to see if you come up with something.

Thanks so much for the help and good luck in the future,
IABoy02

[Gecko]

[IABoy02]

I have had SP2 installed before and ran into numerous issues with it (when it first came out). I am sure many have been fixed (firewall saying it is turned off but actually isn't and others), but I really prefer sp1. To be honest, almost all of the computer nerds (like myself) I know use SP1. We have all had bad experiences with SP2 at some point or another.

Also, I use Opera and Firefox and hardly ever use IE. So that this got installed on my system really caught me by surprise. Especially since I have used the Internet probably an average of 6+ hours a day for the past three years and not gotten a single infection until now.

Once again, I thank you for your help.
IABoy02