{
  "family": "look2me",
  "sample_count": 1,
  "category": "trojan",
  "description": "<h3>Executive Summary</h3>\nLook2Me (also known as L2M) is a notoriously aggressive and persistent form of Adware and Spyware that plagued Windows systems heavily in the mid-2000s. Unlike typical browser extensions, Look2Me operates as a complex rootkit, embedding itself deeply into the Windows operating system (specifically targeting the `Winlogon` process) to forcefully display pop-up advertisements, hijack search queries, and aggressively resist removal efforts by users and standard antivirus software.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nLook2Me was primarily distributed through deceptive software bundling, drive-by downloads via exploit kits on malicious websites, and disguised as fake video codecs required to view adult content.\n\nUpon execution, Look2Me employs sophisticated rootkit tactics:\n<ul>\n<li><strong>Winlogon Injection (DLL Hooking):</strong> Its defining characteristic is injecting its malicious DLL directly into `winlogon.exe` (a critical Windows subsystem process). This ensures the adware is loaded immediately upon user login, before most security software can initialize.</li>\n<li><strong>Aggressive Self-Defense:</strong> Look2Me actively monitors the registry and file system. If a user or antivirus attempts to delete its files or registry keys (often located in `HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Notify`), the injected process instantly recreates them.</li>\n<li><strong>Browser Hijacking and Pop-ups:</strong> Once embedded, it constantly spawns hidden Internet Explorer instances, generates intrusive pop-up ads (often for fake antispyware), and redirects search engine traffic to affiliate-monetized domains.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nWhile technically classified as adware, Look2Me's rootkit-level persistence and aggressive self-defense make it functionally act like a sophisticated trojan. It causes severe system instability (frequent crashing of `explorer.exe`), massive performance degradation, and creates a highly disruptive user experience.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Safe Mode or Offline Removal:</strong> Due to its injection into `winlogon.exe`, standard removal attempts while Windows is running normally are almost always futile. Removal typically requires booting into Safe Mode or using an offline, bootable antivirus rescue disk.</li>\n<li><strong>Specialized Removal Tools:</strong> Standard AV often struggles with Look2Me's persistence. Specialized anti-rootkit utilities (like the historically used 'L2Mfix' or modern equivalents) are required to safely unhook the DLL from `winlogon.exe` without crashing the operating system.</li>\n<li><strong>System Re-imaging (Recommended):</strong> Given the depth of the OS hooking and the age of the malware (suggesting a severely unpatched system), a complete bare-metal wipe and OS re-installation is the most secure and reliable remediation method.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Adware.Look2Me",
    "Spyware.L2M",
    "Win32/Look2Me.Rootkit"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1547.004",
    "T1055.001",
    "T1562.001",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:10:57Z",
  "type": "Adware / Rootkit",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}