Copyright © 1999 - 2006, Sandra Hardmeier, All
Rights Reserved Worldwide
Last updated
20/08/2006
Screen shot of a lop.com toolbar:
Screen shot of the pass through toolbar that is installed if you change
your home page from that chosen by lop.com:
Lop.com have provided a couple of programmes to undo the settings changed via clicking various options at their web site. Have a look at this URL for further information http://lop.com/help.html.
Lop.com is installed as the Sponsor Program for Messenger Plus!
Lots of variations, lots of sites connected to the malware, even the file names it uses are randomly generated.
Removal:
If you have an icon in the system tray, right click and select remove. Also check Control Panel, Add/Remove Programs for suspicious entries that you can uninstall.
If lop.com comes from Messenger Plus! uninstall Messenger Plus!. That may remove the Sponsor Program.
There was a bug in the Messenger Plus! sponsor program that was, under some
circumstances, preventing the removal of the Sponsor Program. It may help to
download the latest version of Messenger (beta), install with Sponsor Program
and then uninstall Messenger Plus! Apparently the latest version of the Sponsor
Program has been updated to remove this bug, but I do not yet have independent
confirmation of this.
The Messenger Plus! uninstall windows DO NOT mention this, but it is essential
that all other programmes be shut down during uninstall, especially Internet
Explorer. Use Task Manager to ensure that no iexplore.exe processes are running
before attempting an uninstall of Messenger Plus!. Also, anti-adware programmes,
antivirus programmes that actively monitor a computer system can interfere.
Sometimes the lop.com provided uninstaller works - available here:
http://lop.com/help.html
If you're still having problems, we get into the heavy stuff....
Troubleshooting
advice
A selection of information links about lop.com malware (detected as Swizzor Trojan by some antivirus programmes) follows:
http://sarc.com/avcenter/venc/data/adware.lop.html (Symantec)
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453076024 (Computer
Associates)
http://vil.mcafeesecurity.com/vil/content/v_120626.htm (McAfee)
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_SWIZZOR.AG
(Trend Micro)
http://www.f-secure.com/v-descs/swizzor.shtml (F-Secure)
http://www.sophos.com/virusinfo/analyses/trojswizzorbq.html (Sophos)