I wont go into details, but I stupidly installed some proggy.

I have in my CPanel a program called L.O.P and I cannot delete it!

I cannot uninstall it.  It asks me to key in a code to prove I'm human.  I key in the numbers and it fails. I cannot do a system restore.

If i browse with zonealarm on, I get a page with an search engine and cannot download mail.

If i turn off the zonealarm i can browse and d/l mail.  I reinstalled Zonealarm and can browse and get mail now.

The extra tool bar that appears in my broswer is called llbrcrimzoo.  it wont go away.

I also have a program mllenzje.exe on my system  i have one also called red4.exe

I've run adaware and virus scans.

Argh I'm freaking out.. help please!

Not exactly sure what you've done.. but you might want to check out:

http://www.spywareinfo.com/articles/lop/

and make sure you are using the latest version of adaware to scan for it...

hope that helps!

- Ed

Yeah I read that article last nite and bloody lop.com!  Don't go there!

If I go there and do their uninstall it happens all over again..

argh..

lol.. I'd rather not.  I've just got done with that a few days ago and finally have the system up and running.

It is a worry that I can't do a system restore though.

There has to be a removal tool.

Twebman where are you!!!!?

Been there.. done that..

Don't mean to strike you guys down  

Amy.. in the short run.. a reformat is the easiest solution! There are things that just dont seem to die with this thing (from what I've read!)

But.. not all hope is lost.. here are a few things you might want to try:

 

quote:

---

Here are the steps to uninstall Lop.com -
you may have to search your system and the registry for the remnants.

As an aside, I would not use AdAware until they issue the updated version.. present version not updated since September and may easily damage your systems..

Removal instructions for lop.com:
Rightclick system tray icon and click on MENU to open license agreement. Click HELP and click UNINSTALL. This runs LOP's uninstaller, to remove Internet Explorer favorites that were added; though it may leave the Mozilla bookmarks. It also removes most,
but not all, of the components installed.

Please note that it is not necessary to do this, but it does remove every single internet shortcut installed by the lop installers. If you don't have this icon in the system tray and cannot uninstall it normally, it just means that you will have to manually delete all of the bookmarks added by lop.

Next you should run Spybot to clean up the remnants left by lop's uninstaller. Now, log off.

Go to C/Windows (winnt for NT/2K) and the TEMP folder. Delete the contents of folder. If Windows cannot delete a file, skip that
file and delete all the rest.

Depending on which installer you encountered, you may need to remove one or two more files.
Open C/Windows\Web\Wallpaper folder (winnt\web\wallpaper for NT/2K)
and look for desktop.htm and desktop.swf. Delete either or both.
You may need to change your desktop's wallpaper setting.

---

quote:

---

There is an uninstall feature, which can usually be found on the round icon in the system tray. Click the right button on it and choose 'Menu'. On the resulting  window, click 'Help', then 'Uninstall'. Some variants also add a 'LOP uninstall' entry to the Control Panel's Add/Remove Programs control which does the same. However this feature does not clear up all the mess lop leaves behind. See below for cleanup info.

Open the Application Data folder. This can be found inside the Windows folder on Windows 95/98/ Me; on Windows 2000 and XP it is inside your user folder in 'Documents and Settings', but it's hidden, so go to Tools->Folder Options->View and turn on 'Show hidden files and folders' to see it. In Windows NT 4.0 it is in the user folder inside 'WinNT\Profiles'.

The filenames of lop files varies for each different lop affiliate distributing the software, but normally there should not be any files inside Application Data (only folders), so it's usually easy to pick out the culprits. Known filenames for the toolbar DLL (lop/Toolbar) or ayb: protocol DLL (lop/ AYB) include:

eelykofrllfrpr.dll
ealymfrprwch.dll
yeecrsoustoull.dll
heeachmstll.dll
ziebaeeoaeepr.dll
prxzoustustgr.dll
llfggrdr.exe
plg_ie[any digit].dll
quizbt[any digit].dll
blztstull[letter 'a', 'c', 'j', 'p', 's', 't' or 'y'].dll
blztstull['pr', 'tr' or 'oo'].dll
Known filenames for the system tray task and hijacker file include:

oofrkxpe.exe
lopsearc.exe
shoucrck.exe
meemnckyqbr.exe
eaymulyl.exe
ulyuiexeechp.exe
byb_save.exe
peebqusz.exe
trstdris.exe
Other files you may find with some versions include icon libraries (known filenames tchejea.lib and iCndE.lib) and loads of GIFs. These can all be deleted too. You might also have some of the following files in the Windows folder:

desktop.htm
dnserror.htm
jexpoofro.htm
i_dnserr.gif
s_dnserr.gif
r_dnserr.gif
b_dnserr.gif
tiejexpoo.gif
xiejexpoo.gif
oiejexpoo.gif
uiejexpoo.gif
Open the registry (Start->Run->regedit) and find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. If you have not used the uninstall feature there should still be an entry with a value like 'C:\WINDOWS\APPLIC~1\(task name).exe -QuieT'; delete it. The name of this entry changes in different variants; known names are:

eeullz
ymste
abtu
zvoah
lssxsh
pprwly
You should also delete the following entries if you have them and they are not just blank:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Telephony\DomainName
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\MSTCP\Domain
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{...check all interfaces...}\Domain
Also you can remove the lop settings key if you can find it; it is inside HKEY_LOCAL_MACHINE\Software and has, again, a varying name; known examples are:

ckotetlllyllshz
kseateasteestoe
ssaxstxoaieoagrh
TrinityAYB (lop/Trinity variant)
Next, if you have not used the uninstall feature, open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands:

cd "%WinDir%\System"
regsvr32 /u [name of DLL]
substituting the full filename of the DLL, whatever its name is, in Application Data. Tip: You can drag the DLL file from Explorer onto the DOS command prompt window to put the name in so you don't have to type it all out.

Finally, reboot Windows and you should be able to delete all the files mentioned above, along with the shortcuts added to the desktop and the favorites menu. You can also reset your homepage (from Internet Options->General) and search settings (Internet Options->Programs->Reset Web Settings); if you use Netscape/Mozilla you will need to reset the home page too (Edit- >Preferences->Navigator).

You may also wish to check your computer for diallers, as the lop.com site has been known to include dialler installers.

---

I would recommend the second set of instrucitons myself..

and when its all over.. or you still need mroe advice.. check out: http://www.nastylop.com/

- Ed :-)

No prob! :-)

- Ed