Remove lop (lop.com, C2 Media) from Internet Explorer

Last week, David R. told me about a program called Lop that was installed on his machine:

" I've installed Lop on my computer and now every time I go online, an annoying browsing toolbar that pops up. Now I can't get rid of it! Can you help? "

My Response:

After some digging, I found some excellent resources on Google. A web site called doxdesk.com provided a very complete picture of what Lop is and how to combat it.

http://www.doxdesk.com/parasite/lop.html

Here are some snippets from the doxdesk.com web site:

Description

Lop is a family of programs that set your start page and IE's search features to use the site lop.com ('Live Online Portal') or one of its clone sites.

Some web sites which use Lop will hijack your browser and point you to an advertising portal. Lop also adds shortcuts to advertisers on the installed computer ... and inserts an executable program on Startup which forces the web browser homepage and search button to use Lop.

Also known as

C2, after the company (C2 Media) that makes it. Troj/Tubmo by Sophos anti-virus (for unknown reasons).

Distribution

Installed by ActiveX from many sites, often pop-up ads.

There are often pop-up loops (pop-ups opening pop-ups endlessly) for sites claiming to be MP3 search and download tools, which try to exploit the confusion caused by this to install lop. The executable file pointed to by the ActiveX downloader is likely to have a name like: "mp3.exe mp3search.exe mp3_finder.exe mp3_plugin.exe", etc.

What it does: Advertising

Some shortcut icons are added to the desktop; many more are added to the Favorites menu. More ads are placed on an IE toolbar called 'Accessories'. The process which executes at Startup occasionally executes pop up advertisements.

Privacy violation

No.

Security issues

Yes. The system tray icon part of the software (if installed in this variant) can download and execute arbitrary code from its controlling server.

Stability problems

Running the software may cause many 'dial-up connection' requests to appear if you are not connected. Windows seems to hang temporarily for a few minutes when this happens. Removal

Spybot Search and Destroy can remove most variants of lop/Toolbar. Recent versions of Ad-Aware can remove most variants of lop/Toolbar; both programs are free.

• http://security.kolla.de/
• http://www.lavasoftusa.com/

There is also an uninstall feature in Lop which can usually be found on the round icon in the system tray. To do so: Click the right button on it and choose 'Menu'; on the resulting window, click 'Help', then 'Uninstall'; at this point the lop/IMZ variant will (annoying) ask for a number to be entered to confirm.

Manual removal

Manual removal instructions can be found online the doxdesk.com web site.