How to get rid of Adware.lop

[Elsie]

Hi, I think my pc is infected by adware.lop, cause IE occasionally go to
www.search.com when I didn't click the url at all. And a search.vbs file
keep appearing under my Startup folder. Please help. I ran a virus scan on
the system, but no virus found. It only detected a CMedia.exe which I
deleted. So where is the source that is running the Trojan now? How to find
it and get rid of it?

Thanks,

Elsie

 

[dcdon]

http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=adware.lop&btnG=Google+Search

that took 9 seconds on Google.

Look for and use the Symantec fix sheet, and you MUST do it line by line in their order or
it will come right back.

--
Happy Holidays,
don
---

Hi, I think my pc is infected by adware.lop, cause IE occasionally go to
www.search.com when I didn't click the url at all. And a search.vbs file
keep appearing under my Startup folder. Please help. I ran a virus scan on
the system, but no virus found. It only detected a CMedia.exe which I
deleted. So where is the source that is running the Trojan now? How to find
it and get rid of it?

Thanks,

Elsie

 

[Elsie]

Sorry about the double post, I can't see the post, due to some server not
responding msg. Btw, the url Don posted just linked to the Symantec website,
which I have already went to looked. But when I tried to search through
regedit, can't seem to find the registry created by the adware

Elsie

 

[Jim Byrd]

Hi Elsie - Well, you kinda need to know what the parasite(s) is/are before
you can do much about fixing them except to apply some general tools like
AdAware and/or SpyBot S&D (see below). If they don't fix it then start
here:

Download HijackThis, free, here:
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Unzip it to any convenient folder, start it then press Scan. Click on
SaveLog when it's finished which will create hijackthis.log. Now click the
Config button, then Misc Tools and click on Generate StartupList.log which
will create Startuplist.txt

Then go to one of the following forums:

Spyware and Hijackware Removal Support, here:
http://www.spywareinfo.com/forums/index.php?s=8a236cdf61469fbad3bddbe810be0374&act=SF&f=11

or Net-Integration here:
http://www.net-integration.net/cgi-...86d536d57b5f65b6e40c55365e;act=ST;f=27;t=6949

or Tom Coyote here:
http://tomcoyote.org/forums/index.php?act=ST&f=10&t=495&s=2c6e92805e310b519b9fa61cc7098fba

Sign in, then copy and paste both files into a message asking for
assistance, Someone will answer with detailed instructions for the removal
of your parasite(s).


For the general hijack case, the best way to start is to get Ad-Aware 6.0,
Build 181 or later, here: http://www.lavasoftusa.com/support/download/.
Update and run this regularly to get rid of most "spyware/hijackware" on
your machine. If it has to fix things, be sure to re-boot and rerun
AdAware again and repeat this cycle until you get a clean scan. The reason
is that it may have to remove things which are currently "in use" before it
can then clean up others.

Another excellent program for this purpose is SpyBot Search and Destroy
available here: http://security.kolla.de/ SpyBot Support Forum here:
http://www.net-integration.net/cgi-bin/forums/ikonboard.cgi. I recommend
using both normally. After fixing things with SpyBot S&D, be sure to
re-boot and rerun SpyBot again and repeat this cycle until you get a clean
"no red" scan. The reason is that SpyBot sometimes has to remove things
which are currently "in use" before it can then clean up others.


Note that sometimes you need to make a judgement call about what these
programs report as spyware. See here, for example:
http://www.imilly.com/alexa.htm


--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[FS]

OFFICIAL LOP CUSTOMER SUPPORT RESPONSE

These a**holes finally replied back to me:

Dear Sir or Madam:

Please excuse the delay in reply, the email servers were undergoing a
much-needed upgrade.

In the terms and conditions of any of our software products it is
clearly stated that we grant you a free license to use the software
and by installing the software on your computer you agree to use our
search services in your web browser. Any and all changes made to your
system are clearly stated in the terms and conditions and are fully
un-installable via the 'Help' then 'uninstall' option on any of our
software applications.

There are several methods available to you should you wish to
uninstall any of our software products you had previously chosen to
install:

- You can go to your Start Menu--Control Panel, then choose the 'Add /
Remove Programs' option then select 'Lop.com' or 'LOP SEARCH' or
‘Browser Enhancer' from the menu to run the uninstaller.

- Some versions of the software have a globe type icon in the bottom
right hand corner of your screen (near the clock). If you find it,
right click on it then click Menu. From the main menu you will see a
help button on the top right hand corner. Click the help button then
choose 'uninstall'.

Some anti virus software is mis-labeling our uninstaller as a trojan
or virus. Our software engineers and legal department will resolve
this issue as soon as possible. Try disabling your anti-virus
software, Ad-aware, Sophos, and other programs of that nature.
Re-download the uninstaller, then run it. Ad-aware et al seem to
interfere with the uninstall process. If disabling that software
allows you to run our uninstaller successfully, please tell us or
email the software company in question and tell them they need to fix
their software.

- Additionally a separate uninstall program may be downloaded here:
http://lop.com/new_uninstall.exe

If none of these suggestions solve the problem, try reinstalling the
software, then running the uninstall again.

Please let us know if we can be of any further assistance,

Lucy Lewis,
Lop.com Customer Service

Hope this helps anyone with Lop.

 

[Elsie]

Hi,

I read the Symantec article on Adware.lop, since my antivirus detected a
folder (CMedia). But I have deleted this folder. And when scanning the
system, I can't find any other files that is detected as adware.lop. When
searching through the registry edit, I can't find any <random name>.dll file
that is causing the problem.

Elsie

 

[Jim Byrd]

Hi Elsie - You need to download the latest version of HiJackThis and then
run it and save the files as I outlined in my last post. Then log onto the
forum and post these files there, again as I outlined in my last post. The
experts that monitor the forum will then be able to tell you what steps you
need to take to eliminate the particular parasite that you have.

--
Please respond in the same thread.
Regards, Jim Byrd, MS-MVP



In

 

[Elsie]

Hi, is HijackThis safe to download and use? I hope not to download another
parasite....

Elsie

 

[John John]

Yes it is, it's not a parasite it's a parasite eliminator.

John

 

[Elsie]

Hi, will HijackThis have problems with Norton Internet Security 2004?

Elsie

 

[John John]

You have to understand what HijackThis is and how it works. It doesn't
run in the background, it's a small executable (about 150Kb) that you
run when you want to find potential problems. Once you're done with it
you turn it off. What is does is scan your pc for items that interact
with your browser and such. It won't remove anything unless you tell it
to do so. And yes it will list some valid items in the list so you have
to be careful as to what you remove. It's a helpful tool to find the
pests but then you have to research the objects it finds to be sure. In
any case it makes a backup of what it removes so you can restore it
later if need be. It's sort of a specialized tool, you're best to use
AdAware and Spybot Search&Destroy before you use HijackThis. Remember
to keep your AdAware and Spybot up to date.

John