Anilrgowda

It is completely pointless wasting your time trying to fix the latest VX2 or L2M hijacks with any manual method or by using adaware/spybot etc or any previous fixes

There is only one cure that works on this version (until they change it again) so if an HJT log with any of these lines appears

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch

or any entries like
O10 - Unknown file in Winsock LSP: c:\windows\system32\dolsp.dll

or the "victim" says that despite cleaning all the hijackers come back

then please don't attempt the fix unless you are 100% sure you know what you are doing

WARNING: This fix is ONLY for XP or Windows 2000/2003,
DO NOT attempt it on Windows 98 or ME, It will not work and probably wreck the computer

If YOU are infected please do this or ask the victim to do this


Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

then when the log has been posted please report to a moderator and we will examine to ensure it is suitable to use the remainder of the fix



only use this fix when asked to do so by someone who knows

Please post a hijackthis log or ask for help first


Edit:

The latest VX2/L2M incarnation only shows this entry
O20 - Winlogon Notify: StillImage - C:\WINDOWS\system32\t0r80a9ued.dll

or similar
the clue is a strange random name dll in O20 in a HJT log