What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HELP! LOPDOTCOM REMOVAL

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Upon starting Spybot Search and Destroy, I recieved a message that it had been altered since the last time it was ran, and this was most likely due to some sort of malware. I ran S&D and found nothing. I ran AVG and found nothing. I then chose to download the free version of Spysweeper and it found the Lopdotcom spyware, with some other cookies (yieldmanager, atwola, and i cant remember the last). Ive been searching how to remove the Lopdotcom and Im a bit confused, so i figured i might get some help here. It would really be appreciated!
Post #2
Logfile of HijackThis v1.99.1
Scan saved at 8:09:02 PM, on 10/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\AOL\1157127196\ee\AOLSoftware.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\HiJack\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common Files\AOL\1157127196\ee\AOLSoftware.exe"
O4 - HKLM\..\Run: [IPHSend] "C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\RunOnce: [SpySweeperUninstallSurvey] http://products.webroot.com/disp0201.php?p…;omn=1&rsc=
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Post #4
i dont think so, but i am not totally sure on how to use hijack the totally correct way. any help would be much appreciated, since i dont think any program deleted lopdotcom yet.
Post #5

i dont think so, but i am not totally sure on how to use hijack the totally correct way. any help would be much appreciated, since i dont think any program deleted lopdotcom yet.

HijackThis doesn't delete anything by itself. Did you save the spysweeper scan?

This is how to run and save a log that you can post here and I'll take a look.

Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!

When the sweep has finished, click Remove. Click Select All and then Next

From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.
Post #6
Im sorry, I wasnt specific. The only version of spysweeper i downloaded was the free one, which only allows you to scan, but not remove infections. After the scan by spysweeper i found the lopdotcom. i tried to scan with avg, adaware, and spybot s&d, but they couldnt find it. i guess im asking what to do know, and will hijack somehow help. sorry for the confusion and i truly appreciate all help
Post #7
So after the scan you weren't able to save the results?

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download ewido anti-spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program
  • Once you have downloaded ewido anti-spyware, locate the icon on the desktop
    and double-click it to launch the set up program.
  • Once the setup is complete you will need run ewido and update the definition
    files.
  • On the main screen select the icon "Update" then select the "
    Update now    " link.
    • Next select the "Start Update" button, the update will start and a
      progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of
    the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then
    select ""Quarantine".".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.
  • Reboot your computer into SafeMode. You can do this by restarting
    your computer and continually tapping the F8 key until a menu appears.

    Use your up arrow key to highlight SafeMode then hit enter.
    IMPORTANT: Do not open any other windows or
    programs while ewido is scanning, it may interfere with the scanning proccess:
  • Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab
    then click on "Complete System Scan".
  • ewido will now begin the scanning process, be patient this may take a little
    time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all
    actions    "
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the
    screen and save it to a text file on your system (make sure to remember where
    you saved that file, this is important).
  • Close ewido and reboot your system back into Normal Mode and post the
    results of the ewido report scan along with a new HijackThis log.
Post #8
When i went to the site to download the ewido, it gave me a new version which is avg anti spyware 7.5. will this be ok, and should i follow the same steps? thanks
Post #10
heres the reports: ——————————————————— AVG Anti-Spyware - Scan Report ——————————————————— + Created at: 10:48:11 PM 10/4/2006 + Scan result: :mozilla.82:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Adserver : Cleaned. :mozilla.83:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Adserver : Cleaned. :mozilla.122:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.123:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.46:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.47:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.48:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.49:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.53:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.79:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.80:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.81:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned. :mozilla.33:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned. :mozilla.17:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.22:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.32:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.96:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.92:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.66:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.68:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.69:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.76:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.77:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.78:C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\2a4kn54f.default\cookies.txt -> TrackingCookie.Zedo : Cleaned. ::Report end and the hijack Logfile of HijackThis v1.99.1 Scan saved at 11:02:24 PM, on 10/4/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Common Files\AOL\1157127196\ee\aolsoftware.exe C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\iPod\bin\iPodService.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\iTunes\iTunes.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\HiJack\HijackThis.exe O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HostManager] "C:\Program Files\Common Files\AOL\1157127196\ee\AOLSoftware.exe" O4 - HKLM\..\Run: [IPHSend] "C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Post #12
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI