Last updated 14/05/2005
 Copyright © 1999 - 2004, Sandra Hardmeier, All Rights Reserved Worldwide

Spyware Home Page

Screen shot of a lop.com toolbar:

Screen shot of the pass through toolbar that is installed if you change your home page from that chosen by lop.com:

Lop.com have provided a couple of programmes to undo the settings changed via clicking various options at their web site.  Have a look at this URL for further information http://lop.com/help.html.

 

Lop.com is installed as the Sponsor Program for Messenger Plus!

 

Lots of variations, lots of sites connected to the malware, even the file names it uses are randomly generated.

 

Removal:

If you have an icon in the system tray, right click and select remove.  Also check Control Panel, Add/Remove Programs for suspicious entries that you can uninstall. 

 

If lop.com comes from Messenger Plus! uninstall Messenger Plus!.  That may remove the Sponsor Program.

There was a bug in the Messenger Plus! sponsor program that was, under some circumstances, preventing the removal of the Sponsor Program. It may help to download the latest version of Messenger (beta), install with Sponsor Program and then uninstall Messenger Plus! Apparently the latest version of the Sponsor Program has been updated to remove this bug, but I do not yet have independent confirmation of this.

The Messenger Plus! uninstall windows DO NOT mention this, but it is essential that all other programmes be shut down during uninstall, especially Internet Explorer. Use Task Manager to ensure that no iexplore.exe processes are running before attempting an uninstall of Messenger Plus!. Also, anti-adware programmes, antivirus programmes that actively monitor a computer system can interfere.

Sometimes the lop.com provided uninstaller works - available here:
http://lop.com/help.html

If you're still having problems, we get into the heavy stuff....
Troubleshooting advice

A selection of information links about lop.com malware (detected as Swizzor Trojan by some antivirus programmes) follows:

http://sarc.com/avcenter/venc/data/adware.lop.html (Symantec)
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453076024 (Computer Associates)
http://vil.mcafeesecurity.com/vil/content/v_120626.htm (McAfee)
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_SWIZZOR.AG (Trend Micro)
http://www.f-secure.com/v-descs/swizzor.shtml (F-Secure)
http://www.sophos.com/virusinfo/analyses/trojswizzorbq.html (Sophos)