When Adware.Lop is installed, it does the following:
- May create the file %UserProfile%\Application Data\[RANDOM CHARACTERS].dll.
Note: %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).
- May create multiple copies of the following file:
%ProgramFiles%\[RANDOM FOLDER NAME]\[RANDOM FILE NAME]
Note:
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
- [RANDOM FOLDER NAME] and [RANDOM FILE NAME] are composed of random English words, such as the following:
- team pure
- bolt date book
- OozeBind
- Hold way amok
- KEEP AXIS
- Adds the .dll file as a Browser Helper Object in the registry.
- May create multiple copies of the following files:
- %Windir%\[RANDOM FILE NAME].htm
- %Windir%\[RANDOM FILE NAME].gif
Note: %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
- May create the following files:
- %Temp%\Delete.me\Xpp.idx
- %Temp%\Delete.me\Tbt.idx
Note: %Temp% is a variable that refers to the Windows temporary folder. By default, this is C:\Windows\TEMP (Windows 95/98/Me/XP) or C:\WINNT\Temp (Windows NT/2000).
- Adds a toolbar and search button to Internet Explorer.
- Adds one of the values:
"(Default)" = "%ProgramFiles%\[RANDOM FOLDER NAME]\[RANDOM FILE NAME]"
"(Default)" = "%UserProfile%\Application Data\[RANDOM CHARACTERS].dll"
to one of the following registry subkeys:
HKEY_CLASSES_ROOT\CLSID\[RANDOM CLSID]\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\[RANDOM CLSID]\InprocServer32
