Business Residential Customer Service: 1.888.682.1884    Technical Support: 1.877.288.8389  
Visionary
Search


Browse By Category

Visionary Support Knowledge Base
Knowledge Base

How to Remove "Search the Web!" (a.k.a. lop) From Your Computer

What is Lop?

Lop is a family of horrible programs that hijack your computer to use lop.com (Live Online Portal) or one of its clone sites. If your computer suddenly started always opening a page that says "Search the Web!", you're infected with lop.

(For your info, known lop sites include: aavc.com, acjp.com, ebch.com, ebdv.com, ebdw.com, ebjp.com, ebkn.com, ebky.com, eblv.com, ebmu.com, ebvr.com, ecmh.com, ecpm.com, ecwz.com, ecyb.com, eduy.com, eeev.com, ibmx.com, icwb.com, icwo.com, icwp.com, iddh.com, idhh.com, ifiz.com, iguu.com, samz.com, saoe.com, sbjr.com, sbnl.com, sbnt.com, sbvr.com, scbm.com, sckr.com, scrk.com, sdry.com, seld.com, sfux.com, sipo.com, smds.com, srib.com, srox.com, srsf.com, ssaw.com, ssby.com, surj.com, tbvg.com, tdak.com, tdko.com, tdmy.com, tefs.com, tfil.com, thko.com, tjar.com, tjaw.com, tjdo.com, tjem.com, tjgo.com, torc.com, wabq.com, wabu.com, wbkb.com, wfix.com, and wflu.com. Also sbee.com and scmb.com, which no longer house lop clones, are believed to have been used in the past.)

 

Lop Removal

Automatic Removal with Spybot

Spybot Search and Destroy can usually remove lop, which it calls C2 (because C2 is the company that makes lop). So, we ll try running Spybot first, because that s easy. Download Spybot here, then install and open, get the latest updates, then click Search and Destroy and do a scan. Delete everything it finds, of course, and hopefully C2 is one of the things it finds. You may have to restart your computer to let Spybot dispose of all lop s pieces. The most recent version of Ad-Aware also might be able to remove lop.

Semiautomatic Removal

Spybot didn t work? It s possible to spend many hours trying to remove Lop, only to discover that it can be removed extremely easily through its own uninstall command, Add/Remove Programs, or by downloading Lop's official uninstall program.  So these methods will be our next line of attack.

The lop/Toolbar variant normally puts a round icon in the system tray. Try right-clicking this, choosing Menu , then on the resulting window, clicking Help , then Uninstall . With newer variants you will have to answer an annoying riddle before it will go away.


Go to your Start Menu, open Control Panel, then choose the Add / Remove Programs option. Depending on which version of the software you have installed, locate Lop.com, LOP SEARCH, Live Online Portal, L.O.P. Uninstall, Window Searching, Window Active, Browser Enhancer, Ultimate Browser Enhancer, Search Plugin, or similar entries from the menu and remove them. I say or similar entries because there are many variations, such as: Browser Enhance r, Brows er Enhancer, Ultimate Browse r Enhancer, Ultimate Browser En hancer, L.O P. Un insta11, L O.P. Un instal1, Live 0n line Portal, Live.0nli ne Porta1, etc.


You can download lop s official uninstaller from http://lop.com/new_uninstall.exe .  Normally you should be very suspicious about downloading so-called uninstallers from these spyware companies. However, this one seems to actually do what it s supposed to get rid of lop. If you run this uninstaller and you still have a toolbar from lop, try the toolbar uninstaller at http://lop.com/toolbar_uninstall.exe .


Manual Removal

Still can t get lop to leave? Open the Application Data folder. This can be found inside the Windows folder on Windows 95/98/Me; on Windows 2000 and XP it is inside your user folder in Documents and Settings , but it s hidden, so go to Tools->Folder Options->View and turn on Show hidden files and folders to see it. In Windows NT 4.0 it is in the user folder inside WinNTProfiles .

The filenames of lop files can vary for each different installation, but usually under Windows there should not be any files inside Application Data (only folders), so it s generally easy to pick out the culprits. Known filenames for the toolbar DLL (lop/Toolbar, lop/Rnd) or ayb: protocol DLL (lop/AYB) include:

* blztstull[letter a , c , j , p , s , t or y ].dll
* blztstull[ pr , tr or oo ].dll
* chksbdrlya.dll
* dmvcrthl.exe
* eaeeishllblc.dll
* eelykofrllfrpr.dll
* eelykofrllfrj.dll
* ealymfrprwch.dll
* epllkeeoopr.dll
* freabrlaouw.dll
* gldqumssfrie.dll
* hglllyxrxw.dll
* icdrhwno.dll
* heeachmstll.dll
* meepajlr.dll
* ousszidrta.dll
* plg_ie[any digit].dll
* prxzoustustgr.dll
* prnouestssstx.dll
* quizbt[any digit].dll
* quglwachfs.dll
* sstroallhqch.dll
* tblchepruprgr.dll
* trdzhtxf.exe
* trstshcrscksr.dll
* ukfroigl.dll
* upckeetoutw.dll
* veaeyglckr.dll
* woafrquzn.dll
* yeecrsoustoull.dll
* ziebaeeoaeepr.dll

Known filenames for the system tray task and hijacker file include:

* asshuktr.exe
* bilyooas.exe
* byb_save.exe
* crgbeaoa.exe
* eaymulyl.exe
* eeublidc.exe
* glxshmcr.exe
* ijlysseb.exe
* jqumysto.exe
* kfriegbs.exe
* llfggrdr.exe
* lltckiey.exe
* lopsearc.exe
* meemnckyqbr.exe
* meepajlr.exe
* mprcouie.exe
* oofrkxpe.exe
* peebqusz.exe
* quveioot.exe
* shoucrck.exe
* ssmeeibl.exe
* tchpeatr.exe
* tglblrll.exe
* trstdris.exe
* ulyuiexeechp.exe
* vestufck.exe
* vfthrcbr.exe
* xogyfhp.exe
* ykphmbre.exe
* ylynfste.exe

Other files you may find with some versions include icon libraries (known filenames tchejea.lib and iCndE.lib) and loads of GIFs. These can all be deleted too. You might also have some of the following files in the Windows folder:

* desktop.htm
* dnserror.htm
* jexpoofro.htm
* i_dnserr.gif
* s_dnserr.gif
* r_dnserr.gif
* b_dnserr.gif
* tiejexpoo.gif
* xiejexpoo.gif
* oiejexpoo.gif
* uiejexpoo.gif

Open the registry (Start->Run->regedit) and find the key HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun. If you have not used the uninstall feature there should still be an entry with a value like C:WINDOWSAPPLIC~1(task name).exe -QuieT ; delete it. The name of this entry changes in different variants; known names are:

* abtu
* brchfgl
* brfrgroo
* chytrw
* eeullz
* eedrtss
* lldrlyk
* lssxsh
* stoafv
* oooami
* oooik
* oucno
* phqtr
* pprwly
* qncu
* stjlee
* uaouea
* trglckea
* xckja
* ymste
* zvoah

In the lop/Active variant, there will instead be a winactive entry pointing to winactive.exe. Delete this too.

You should also delete the following entries if you have them and they are not just blank:

* HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionTelephonyDomainName
* HKEY_LOCAL_MACHINESystemCurrentControlSetServicesVxDMSTCPDomain
* HKEY_LOCAL_MACHINESystemCurrentControlSetServicesTcpipParametersDomain
* HKEY_LOCAL_MACHINESystemCurrentControlSetServicesTcpipParametersInterfaces{...check all interfaces...}Domain

Also you can remove the lop settings key if you can find it; it is inside HKEY_LOCAL_MACHINESoftware and has, again, a varying name; known examples are:

* ckotetlllyllshz
* kseateasteestoe
* rhvlveasteafpr
* ssaxstxoaieoagrh
* TrinityAYB (lop/Trinity variant)

Next, if you have not used the uninstall feature, open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands:

cd "%WinDir%System"
regsvr32 /u [name of DLL]

Of course substitute the full filename of the DLL, whatever its name is, in Application Data. Tip: You can drag the DLL file from Explorer onto the DOS command prompt window to put the name in so you don t have to type it all out.


Finally, reboot Windows and you should be able to delete all the files mentioned above, along with the shortcuts added to the desktop and the favorites menu. For the lop/Active variant you should delete the entire Active Window folder inside Program Files.

You can also reset your homepage (from Internet Options->General) and search settings (Internet Options->Programs->Reset Web Settings), and delete the entries added to your Favorites menu. If you use Netscape/Mozilla you will need to reset the home page (Edit->Preferences->Navigator) and remove the Bookmarks too.

Since you had lop, you almost certainly have other spyware too. I'd recommend following the steps in the Preventing Spyware Problems article to get rid of any other junk. You may also wish to check your computer for dialers, as the lop.com site has been known to include dialer installers (dialers use your computer to dial foreign or toll phone numbers and then you get a huge phone bill with calls to Sweeden for example). If you have the lop/IMZ variant it is also possible that FavoriteMan/IMZ may have installed other parasites such as BargainBuddy, IGetNet and n-Case.


-- Many thanks to DOXdesk for a great web site, from which the manual removal instructions and some of the other info was taken. The parasite pages (comprising pages stored under URLs beginning with http://www.doxdesk.com/parasite/) are original works 2001-2005 Andrew Clover, and are available for public licensing under the terms of the Creative Commons license BY-NC.

How helpful was this article to you?

Related Articles

article Removing Spyware Manually in "Add/Remove Programs"
* CAUTION: Before reading this article, do the steps in Preventing Spyware Problems, if you have not already. The procedures described below are only for users who feel comfortable doing such...

  February 9, 2005    Views: 36968   
article How to Remove MediaPass/MediaPassK spyware
You could become infected with MediaPass/MediaPassK any number of ways. It likely came in along with a whole bundle of other various spyware. If you're just wondering if you're infected, open...

  March 22, 2005    Views: 10341   
article Preventing Spyware Problems
A little bit of prevention can save you hours of nightmarish work trying to recover from a spyware disaster. Spyware can wreak total havoc on your computer on your computer! Please take the...

  February 2, 2005    Views: 16062   

User Comments

Comment LA Web Associates <krs@lawebasc.com>
March 17, 2005 at 10:02am

Removing "Search the Web" from IE Address Bar
Sir,

Your site was very insiteful and helpful I'm sure to many. I wasn't able to remove "Search the Web" from my IE toolbar (address bar) until I found the HKEY "uninstall" folder. Once there the "Search the Web" folder contains a file ( C:PROGRA~1MYWEBS~1bar1.binmwsbar.dll,O) that once pasted and ran in the "Run" bar, IMMEDIATELY uninstalls this pest.

I hope this is helpful to you and your audience...Keep up the good work.
Comment rregister
November 30, 2005 at 10:46am

another variant: Need2Find
I had a variant of this problem related to the Need2find program. I was able simply to use Add Remove Programs to remove Search the Web from the address bar.

Or try searching on Need2Find for removal instructions.