Look2me Not Detected?
I just ran HijackThis, and stumbled upon what appears to be a Look2Me infection..
I've identified this DLL as Look2Me (correct me if I'm wrong): k4pmle711h.dll
I ran a full scan with BitDefender 2008 last night, and it detected a few things.. low priority stuff, but now I'm skeptic towards the BD2008 purchase..
Please clarify:
1) k4pmle711h.dll - is it Look2Me?
2) Look2Me is malicious, right?
3) [if (2) is yes] Why wasn't Look2Me found?
Thank you
Comments
-
Apparently we can't edit our own posts?
Anyways.. Here's the report from Look2Me-DestroyerLook2Me-Destroyer V1.0.12
Scanning for infected files.....
Scan started at 11/10/2007 1:46:05 AM
Infected! C:\WINDOWS\system32\k4pmle711h.dll
Attempting to delete infected files...
Making registry repairs.
Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Management
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{F453DD30-19A3-42A1-AA2D-ACF7D2B5E6F8}"
HKCR\Clsid\{F453DD30-19A3-42A1-AA2D-ACF7D2B5E6F8}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{26741859-BC54-4280-B46A-9C202D89858B}"
HKCR\Clsid\{26741859-BC54-4280-B46A-9C202D89858B}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{3995347E-2A61-4A4D-AD1E-1BC6FF87FE24}"
HKCR\Clsid\{3995347E-2A61-4A4D-AD1E-1BC6FF87FE24}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{7066B146-939E-492B-B7FA-1EC72B0D738B}"
HKCR\Clsid\{7066B146-939E-492B-B7FA-1EC72B0D738B}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{909EA04A-149C-4860-B79D-3E474C401415}"
HKCR\Clsid\{909EA04A-149C-4860-B79D-3E474C401415}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{1D7712BF-F292-4182-BE48-50E2007BF88E}"
HKCR\Clsid\{1D7712BF-F292-4182-BE48-50E2007BF88E}
Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{BD602396-134D-4151-AFBB-5934653B7BA9}"
HKCR\Clsid\{BD602396-134D-4151-AFBB-5934653B7BA9}
Restoring Windows certificates.
Replaced hosts file with default windows hosts file
Restoring SeDebugPrivilege for Administrators - Succeeded0