1. /
  2. Security Response/
  3. Adware.Lop

Adware.Lop

Updated:
February 13, 2007 11:34:29 AM
Type:
Adware
Publisher:
lop.com
Risk Impact:
High
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Adware.Lop is installed, it does the following:
  1. May create the file %UserProfile%\Application Data\[RANDOM CHARACTERS].dll.

    Note: %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).

  2. May create multiple copies of the following file:

    %ProgramFiles%\[RANDOM FOLDER NAME]\[RANDOM FILE NAME]


    Note:
    • %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
    • [RANDOM FOLDER NAME] and [RANDOM FILE NAME] are composed of random English words, such as the following:

      • team pure
      • bolt date book
      • OozeBind
      • Hold way amok
      • KEEP AXIS

  3. Adds the .dll file as a Browser Helper Object in the registry.

  4. May create multiple copies of the following files:

    • %Windir%\[RANDOM FILE NAME].htm
    • %Windir%\[RANDOM FILE NAME].gif

      Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

  5. May create the following files:

    • %Temp%\Delete.me\Xpp.idx
    • %Temp%\Delete.me\Tbt.idx

      Note: %Temp% is a variable that refers to the Windows temporary folder. By default, this is C:\Windows\TEMP (Windows 95/98/Me/XP) or C:\WINNT\Temp (Windows NT/2000).

  6. Adds a toolbar and search button to Internet Explorer.

  7. Adds one of the values:

    "(Default)" = "%ProgramFiles%\[RANDOM FOLDER NAME]\[RANDOM FILE NAME]"
    "(Default)" = "%UserProfile%\Application Data\[RANDOM CHARACTERS].dll"


    to one of the following registry subkeys:

    HKEY_CLASSES_ROOT\CLSID\[RANDOM CLSID]\InprocServer32
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\[RANDOM CLSID]\InprocServer32



Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver