Lop.com

· Overview ·
· Origins ·
· Distribution ·
· Operation ·
· Risks ·
· Detection and Removal ·
· Research ·

Overview
Summary:	lop is a family of programs that set your start page and IE's search features to use the site lop.com ('Live Online Portal') or one of its clone sites. Known lop sites include: aavc.com acjp.com ebav.com ebaw.com ebch.com ebch.com ebdv.com ebdw.com ebgo.com ebjp.com ebkb.com ebkn.com ebky.com eblv.com wbkb.com ebmu.com ebvr.com ecmh.com ecmp.com ecpm.com ecwz.com ecyb.com edhq.com edty.com eduy.com eeev.com farse.com ibmx.com icwb.com icwo.com icwp.com iddh.com idhh.com ifiz.com iguu.com samz.com saoe.com sbee.com sbjr.com sbnl.com sbnt.com sbvr.com scbm.com sckr.com scrk.com sdry.com seld.com sfux.com sheat.com sipo.com smds.com srib.com srox.com srsf.com ssaw.com ssby.com surj.com tbvg.com tdak.com tdmy.com tefs.com tfil.com tjar.com tjaw.com tjgo.com tjem.com torc.com wabu.com wabq.com wfix.com wflu.com Lop also adds shortcuts to advertisers. Finally it adds a task to run on startup which sets your homepage and search back to lop if you change them.
Alias:	TrojanDownloader.Win32.Swizzor.ae, Adware/Adtomi [Panda], Adware/Apropos [Panda], Adware/Lop [Panda], Adware/nCase [Panda], Adware/NetPals [Panda], Adware/WinActive [Panda], Adware-180Solutions [McAfee], C2 Media, after the company that makes it., Dialer.AL [Panda], Lop, LopAdvert [McAfee], MP3Search [McAfee], MpAdvert [McAfee], Spyware/Infameow [Panda], Trj/Downloader.HC [Panda], Trj/Downloader.HW [Panda], Trj/Downloader.HX [Panda], Trj/Zerolin.A [Panda], Trojan.Win32.SecondThought.h [Kaspersky], TrojanClicker.Win32.Rotarran (for Lop.Com.WinactiveJ), TrojanDownloader.Win32.Small.bp, TrojanDownloader.Win32.Small.bp [Kaspersky], TrojanDownloader.Win32.Swizzor.au [Kaspersky], TrojanDownloader.Win32.Swizzor.ba [Kaspersky], TrojanDownloader.Win32.Swizzor.bm [Kaspersky], TrojanDownloader.Win32.Swizzor.bn [Kaspersky], TrojanDownloader.Win32.Swizzor.br [Kaspersky], TrojanDownloader.Win32.Swizzor.i [Kaspersky], TrojanDownloader.Win32.Swizzor.q [Kaspersky], TrojanDropper.Win32.Small.fl [Kaspersky], VBS.ObjectDataHTA [Computer Associates], VBS.Suzer [Computer Associates], VBS/Inor.gen [Panda], VBS/Suzer.A!Dropper [Computer Associates], Win32/Polbya.A!Trojan [Computer Associates]
See Also:	Lop
Category:	Spyware: Any product that employs a user's Internet connection in the background without their knowledge, and gathers/transmits info on the user or their behavior. Many spyware products will collect referrer info (information from your web browser which reveals what URL you linked from), your IP address (a number that is used by computers on the network to identify your computer), system information (such as time of visit, type of browser used, the operating system and platform, and CPU speed.) Spyware products sometimes wrap other commercial products, and are introduced to machines when those commercial products are installed. See also Adware. Adware: Software that displays popup/popunder ads when the primary user interface is not visible or which do not appear to be assocaited with the product. Browser Helper Object: (BHO). A component that Internet Explorer will load whenever it starts, shares IE's memory context, can perform any action on the available windows and modules. A BHO can detect events, create windows to display additional information on a viewed page, monitor messages and actions. Microsoft calls it "a spy we send to infiltrate the browser's land." BHOs are not stopped by personal firewalls, because they are seen by the firewall as your browser itself. Some exploits of this technology search all pages you view in IE and replace banner advertisements with other ads. Some monitor and report on your actions. Some change your home page. Dialer: Software that dials a phone number. Some dialers connect to local Internet Service Providers and are beneficial as configured. Others connect to toll numbers without user awareness or permission. Downloader: A program designed to retrieve and install additional files, when run. Most will be configured to retrieve from a designated web or FTP site. Dropper: In viruses and trojans, the dropper is the part of the program that installs the hostile code onto the system. Hijacker: Any software that resets your browser's settings to point to other sites. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower. Search Hijacker: Any software that resets your browser's settings to point to other sites when you perform a search. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower. Search results when such a hijacker is running will sometimes differ from non-hijacked results. Toolbar: A group of buttons which perform common tasks. A toolbar for Internet Explorer is nomally located below the menu bar at the top of the form. Toolbars may be created by Browser Helper Objects. Trojan: Any program with a hidden intent. Trojans are one of the leading causes of breaking into machines. If you pull down a program from a chat room, new group, or even from unsolicited e-mail, then the program is likely trojaned with some subversive purpose. The word Trojan can be used as a verb: To trojan a program is to add subversive functionality to an existing program. For example, a trojaned login program might be programmed to accept a certain password for any user's account that the hacker can use to log back into the system at any time. Rootkits often contain a suite of such trojaned programs.
Variants:	Lop.com.WinActive Lop.com.WinActiveJ Lop.com/Active Lop.com/AYB Lop.com/Dialer Lop.com/IMZ Lop.com/Loader Lop.com/RND Lop.com/Toolbar Lop.com/Trinity OmegaSearch Some variants install both the Toolbar software and the AYB software. There are some other drive-by-downloads based around similar code. lop/Trinity only adds the shortcuts and does the homepage/search hijacking. lop/Dialer is a plain porn dialler; lop/Dialer2 is a porn dialer which also includes the startup task but not the links or the toolbar.
Similar Pests:	Spyware · Adware · Browser Helper Object · Dialer · Downloader · Dropper · Hijacker · Search Hijacker · Toolbar · Trojan
Origins
Group:	C2 Media Ltd
Vendor:	WRN.net markets the affiliate program to webmasters.
By This Group:	Lop ·
Programming Language:	Compressed with UPX.
Date of Origin:	Variants from June, 2002 to March, 2005
Distribution
Distribution:	Installed by ActiveX or simple EXE file download from many sites, often through redirecting pop-up ads. The executable file is likely to have a name like: mp3.exe FreeMP3.exe freemp3z.exe FreeMP3Music.exe free_sex_viewer.exe free_deals.exe Software_Plugin.exe download_file.exe The_Ultimate_Browser_Enhancer.exe free_plugin.exe
Prevalence:	Lop.com: 75.1% OmegaSearch: 1.2% More Info
Clot Factor:	Lop.com: 7 The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.
Growth:	Lop.com: Insufficient data to report growth OmegaSearch: Insufficient data to report growth
Operation
Advertising:	Yes. Some shortcut icons are added to the desktop. Many more are added to the Favorites menu. More are on an IE toolbar called 'Accessories'. The process run on startup also occasionally pops up advertisements.
Storage Required:	Lop.com: at least 15009 KB Lop.com.WinActive: at least 4609 KB Lop.com.WinActiveJ: at least 49 KB OmegaSearch: at least 1161 KB
Browser Performance:	Likely to slow performance of Internet Explorer.
Risks
Privacy Issues:	No.
Security Issues:	None known.
Stability Issues:	Running the software may cause many 'dial-up connection' requests to appear if you are not connected. Windows seems to hang temporarily for a few minutes when this happens.
Detection and Removal
Automatic Removal:	PestPatrol detects this. PestPatrol removes this.
Manual Removal:	There is an uninstall feature, which can usually be found on the round icon in the system tray. Click the right button on it and choose 'Menu'. On the resulting window, click 'Help', then 'Uninstall'. Some variants also add a 'LOP uninstall' entry to the Control Panel's Add/Remove Programs control which does the same. However this feature does not clear up all the mess lop leaves behind. See below for cleanup info. Open the Application Data folder. This can be found inside the Windows folder on Windows 95/98/Me; on Windows 2000 and XP it is inside your user folder in 'Documents and Settings', but it's hidden, so go to Tools->Folder Options->View and turn on 'Show hidden files and folders' to see it. In Windows NT 4.0 it is in the user folder inside 'WinNT\Profiles'. The filenames of lop files varies for each different lop affiliate distributing the software, but normally there should not be any files inside Application Data (only folders), so it's usually easy to pick out the culprits. Known filenames for the toolbar DLL (lop/Toolbar) or ayb: protocol DLL (lop/AYB) include: eelykofrllfrpr.dll ealymfrprwch.dll yeecrsoustoull.dll heeachmstll.dll ziebaeeoaeepr.dll prxzoustustgr.dll llfggrdr.exe plg_ie[any digit].dll quizbt[any digit].dll blztstull[letter 'a', 'c', 'j', 'p', 's', 't' or 'y'].dll blztstull['pr', 'tr' or 'oo'].dll Known filenames for the system tray task and hijacker file include: oofrkxpe.exe lopsearc.exe shoucrck.exe meemnckyqbr.exe eaymulyl.exe ulyuiexeechp.exe byb_save.exe peebqusz.exe trstdris.exe Other files you may find with some versions include icon libraries (known filenames tchejea.lib and iCndE.lib) and loads of GIFs. These can all be deleted too. You might also have some of the following files in the Windows folder: desktop.htm dnserror.htm jexpoofro.htm i_dnserr.gif s_dnserr.gif r_dnserr.gif b_dnserr.gif tiejexpoo.gif xiejexpoo.gif oiejexpoo.gif uiejexpoo.gif Open the registry (Start->Run->regedit) and find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. If you have not used the uninstall feature there should still be an entry with a value like 'C:\WINDOWS\APPLIC~1\(task name).exe -QuieT'; delete it. The name of this entry changes in different variants; known names are: eeullz ymste abtu zvoah lssxsh pprwly You should also delete the following entries if you have them and they are not just blank: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Telephony\DomainName HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\MSTCP\Domain HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Domain HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{...check all interfaces...}\Domain Also you can remove the lop settings key if you can find it; it is inside HKEY_LOCAL_MACHINE\Software and has, again, a varying name; known examples are: ckotetlllyllshz kseateasteestoe ssaxstxoaieoagrh TrinityAYB (lop/Trinity variant) Next, if you have not used the uninstall feature, open a DOS command prompt window (from Start->Programs->Accessories) and enter the following commands: cd "%WinDir%\System" regsvr32 /u [name of DLL] substituting the full filename of the DLL, whatever its name is, in Application Data. Tip: You can drag the DLL file from Explorer onto the DOS command prompt window to put the name in so you don't have to type it all out. Finally, reboot Windows and you should be able to delete all the files mentioned above, along with the shortcuts added to the desktop and the favorites menu. You can also reset your homepage (from Internet Options->General) and search settings (Internet Options->Programs->Reset Web Settings); if you use Netscape/Mozilla you will need to reset the home page too (Edit->Preferences->Navigator). You may also wish to check your computer for dialers, as the lop.com site has been known to include dialer installers.
	Stop Running Processes: Kill these running processes with Task Manager: 1111.exe 2443.exe 24701.exe activeonce.exe afa6d429.exe ahlrfsoy.exe ante.exe aswnk.exe atiupdate2.exe bags more bold.exe bash second cast.exe bendaceproc.exe bind funk inside.exe binsect.exe bitsplaygrid.exe bore2mags.exe bytemess.exe c:\docume~1\yap@w~1\applic~1\ckcoofrunea.exe campglueflap.exe cash remote.exe corn bold media.exe cyd1.exe debugregs.exe defy view.exe does admin.exe download_plugin.exe each cdrom memo.exe etu1.exe femguyse.exe film.exe fmtah.exe frag drv first boob.exe freemp3z.exe funktypebinfffccc.exe great 1.exe great each close.exe greyplan.exe heartflaw.exe help support.exe hope1media.exe hoxujhed.exe hpt1.exe interarmy.exe jumpnoundate.exe keep comp.exe keyhost.exe kind joy bib.exe kvgpmfiv.exe lejytfqx.exe liesbagslist.exe lite cake loud.exe lniegfer.exe loadcashmeet.exe logo vc.exe longonlineplay.exe lrgluoot.exe mail mess.exe mp3.exe mp3_plugin.exe mp3serch.exe nxfbmzqu.exe pile default.exe pkajulyt.exe plus size.exe profilepath+\application data\brsswthg.exe profilepath+\application data\ckcoofrunea.exe profilepath+\application data\ddinxmdb.exe profilepath+\application data\dgpxzhtb.exe profilepath+\application data\djgxsbcl.exe profilepath+\application data\efjwxjsl.exe profilepath+\application data\eneqckap.exe profilepath+\application data\flmgvmas.exe profilepath+\application data\fqbhyhjh.exe profilepath+\application data\gchmfrea.exe profilepath+\application data\gqlfiqii.exe profilepath+\application data\gzxqpghe.exe profilepath+\application data\hlsctpay.exe profilepath+\application data\hlyvjncf.exe profilepath+\application data\idixbdmf.exe profilepath+\application data\kmigeuhh.exe profilepath+\application data\lckqdcvd.exe profilepath+\application data\list cool loud math\objnew.exe profilepath+\application data\lkxelvrg.exe profilepath+\application data\lopsearch.exe profilepath+\application data\memo01idleheart\roam info.exe profilepath+\application data\mspuztbg.exe profilepath+\application data\muqhatod.exe profilepath+\application data\muxibdom.exe profilepath+\application data\mycvbdqu.exe profilepath+\application data\nimylprv.exe profilepath+\application data\one bolt bleh anti\once each.exe profilepath+\application data\ovnolxvi.exe profilepath+\application data\pbgqwhoj.exe profilepath+\application data\qhiqikdr.exe profilepath+\application data\qtufbghm.exe profilepath+\application data\qwxgxlrv.exe profilepath+\application data\roam surf part tick\junk pure.exe profilepath+\application data\roam surf part tick\puretrust.exe profilepath+\application data\save third mfcd boob\loudmove.exe profilepath+\application data\save third mfcd boob\vga admin.exe profilepath+\application data\sefiqovd.exe profilepath+\application data\srytuikb.exe profilepath+\application data\taecoidy.exe profilepath+\application data\trmugnsu.exe profilepath+\application data\trstlskb.exe profilepath+\application data\uljpmexe.exe profilepath+\application data\vlluafrq.exe profilepath+\application data\vygaeifz.exe profilepath+\application data\wa_inst.exe profilepath+\application data\xxdfwvli.exe profilepath+\application data\ysaebwco.exe profilepath+\application data\zaeoxdiu.exe profilepath+\application data\zdmlfhmh.exe profilepath+\application data\zvpkxxtu.exe profilepath+\application data\zvxcypnh.exe profilepath+\local settings\temp\ayw17f.exe profilepath+\local settings\temp\bae1.exe profilepath+\local settings\temp\bvj13.exe profilepath+\local settings\temp\den1.exe profilepath+\local settings\temp\fbf1.exe profilepath+\local settings\temp\hqe1.exe profilepath+\local settings\temp\now1.exe profilepath+\local settings\temp\pfn1.exe profilepath+\local settings\temp\pnt1.exe profilepath+\local settings\temp\prab.exe profilepath+\local settings\temp\pyo25.exe profilepath+\local settings\temp\qhy81.exe profilepath+\local settings\temp\rem15.exe profilepath+\local settings\temp\rem24.exe profilepath+\local settings\temp\rem25.exe profilepath+\local settings\temp\rem2ea.exe profilepath+\local settings\temp\rny1.exe profilepath+\local settings\temp\sml1.exe profilepath+\local settings\temp\sta3.exe profilepath+\local settings\temp\szwe.exe profilepath+\local settings\temp\txo1.exe profilepath+\local settings\temp\uqg1.exe profilepath+\local settings\temp\vyz1.exe profilepath+\local settings\temp\wry1.exe profilepath+\local settings\temp\znp1.exe profilepath+\local settings\temporary internet files\content.ie5\s9grsz83\cam-6415[1].exe profilepath+\owner\local settings\temp\rem18c.exe programfilesdir+\active download\16537.exe programfilesdir+\armymo~1\3549.exe programfilesdir+\burn media meta\bdvcnypx.exe programfilesdir+\cityai~1\binidledumb.exe programfilesdir+\creati~1\jynqzshx.exe programfilesdir+\creati~1\oozeboob.exe programfilesdir+\creati~1\pazgtrve.exe programfilesdir+\creati~1\plus thunk mags.exe programfilesdir+\creati~1\settings browse.exe programfilesdir+\creati~1\skfvhmqz.exe programfilesdir+\driveh~1\64bikeabout.exe programfilesdir+\dvdfindload\bore active info funk.exe programfilesdir+\dvdfindload\bqssapdm.exe programfilesdir+\dvdfindload\ftulpefl.exe programfilesdir+\dvdfindload\funktypebin.exe programfilesdir+\elsewa~1\16021.exe programfilesdir+\fourat~1\bowsbleh.exe programfilesdir+\fourat~1\fkrbssba.exe programfilesdir+\fourat~1\ford wma dead.exe programfilesdir+\fourat~1\gagmqvaf.exe programfilesdir+\fourat~1\kcwarhnv.exe programfilesdir+\fourat~1\pure bash.exe programfilesdir+\fourat~1\qsrdfyqj.exe programfilesdir+\freein~1\fastfirst.exe programfilesdir+\freein~1\knynnyma.exe programfilesdir+\global~1\mfcdpingwarnfast.exe programfilesdir+\greato~1\activebitsflap.exe programfilesdir+\greato~1\afniekvu.exe programfilesdir+\greato~1\cakerdrplan.exe programfilesdir+\greato~1\idle barb ball.exe programfilesdir+\greato~1\vzmhfjyb.exe programfilesdir+\inside~1\manager free.exe programfilesdir+\manager ace gram\1072.exe programfilesdir+\mathte~1\bold grim.exe programfilesdir+\memoli~1\bzqzgkdq.exe programfilesdir+\memoli~1\cjcegzut.exe programfilesdir+\memoli~1\dentcurbfree.exe programfilesdir+\memoli~1\drv list part corn.exe programfilesdir+\memoli~1\flaw army name.exe programfilesdir+\memoli~1\hojxfjdu.exe programfilesdir+\memoli~1\loyftzhg.exe programfilesdir+\nounbe~1\curbuser.exe programfilesdir+\objcdrom\16logplayprogram.exe programfilesdir+\objcdrom\bait cake part bash.exe programfilesdir+\objcdrom\safesoaplicenseplay.exe programfilesdir+\objels~1\sizebuildlogo.exe programfilesdir+\oozejo~1\14599.exe programfilesdir+\oozejo~1\19205.exe programfilesdir+\oozejo~1\24758.exe programfilesdir+\oozejo~1\29923.exe programfilesdir+\progra~1\city tons.exe programfilesdir+\progra~1\clock mags inter book.exe programfilesdir+\progra~1\cmbjcmrq.exe programfilesdir+\progra~1\else iso user bows.exe programfilesdir+\progra~1\flapholdlogo.exe programfilesdir+\progra~1\inter phone pile default.exe programfilesdir+\progra~1\one cdrom type more.exe programfilesdir+\progra~1\wipekind.exe programfilesdir+\progra~1\zwsghqhs.exe programfilesdir+\proxyn~1\boldabout.exe programfilesdir+\proxyn~1\citydog.exe programfilesdir+\proxyn~1\more.exe programfilesdir+\proxyn~1\realaudio.exe programfilesdir+\proxyn~1\roam.exe programfilesdir+\proxyn~1\salrukuu.exe programfilesdir+\roamju~1\delete play.exe programfilesdir+\roamse~1\rulefindcamp.exe programfilesdir+\roamse~1\window skip.exe programfilesdir+\safeba~1\stop hope.exe programfilesdir+\sectmp~1\skipbase.exe programfilesdir+\showsu~1\ewgcgvzk.exe programfilesdir+\showsu~1\jxmiyjlq.exe programfilesdir+\showsu~1\lfgaukbm.exe programfilesdir+\showsu~1\media else rdr.exe programfilesdir+\showsu~1\nnzmpuhm.exe programfilesdir+\showsu~1\wtmtyuls.exe programfilesdir+\showsupport\media else rdr.exe programfilesdir+\sitein~1\eksthzea.exe programfilesdir+\sitein~1\gcvbdwdc.exe programfilesdir+\sitein~1\intramemocomp.exe programfilesdir+\sitein~1\jeursyec.exe programfilesdir+\sitein~1\lsocnmju.exe programfilesdir+\sitein~1\ocyixkfk.exe programfilesdir+\sitein~1\uyibygkh.exe programfilesdir+\sitein~1\zgplkbke.exe programfilesdir+\thirda~1\etarwlaf.exe programfilesdir+\thirda~1\glue blue tons.exe programfilesdir+\thirda~1\mediawebdownload.exe programfilesdir+\thirda~1\ozrkesxz.exe programfilesdir+\thirda~1\qmgytdru.exe programfilesdir+\thirda~1\ruledatawma.exe programfilesdir+\trayokay\eygfyuoe.exe programfilesdir+\trayokay\rppzstyl.exe programfilesdir+\waveba~1\32437.exe programfilesdir+\wavebo~1\20044.exe programfilesdir+\wavebo~1\7310.exe programfilesdir+\wavesu~1\1716.exe programfilesdir+\window active\winactive.exe refslow.exe removelop.exe rgg1.exe rpzgnwux.exe rvimsmkf.exe sect name.exe sign support mags.exe sizewaitgrim.exe soft team.exe software_plugin.exe sta1f.exe sta2.exe systemroot+\application data\asshuktr.exe systemroot+\application data\bilyooas.exe systemroot+\application data\byb_save.exe systemroot+\application data\crgbeaoa.exe systemroot+\application data\dmvcrthl.exe systemroot+\application data\eaymulyl.exe systemroot+\application data\eeublidc.exe systemroot+\application data\glxshmcr.exe systemroot+\application data\ijlysseb.exe systemroot+\application data\jqumysto.exe systemroot+\application data\kfriegbs.exe systemroot+\application data\llfggrdr.exe systemroot+\application data\lltckiey.exe systemroot+\application data\lopsearc.exe systemroot+\application data\meemnckyqbr.exe systemroot+\application data\meepajlr.exe systemroot+\application data\mprcouie.exe systemroot+\application data\oofrkxpe.exe systemroot+\application data\peebqusz.exe systemroot+\application data\quveioot.exe systemroot+\application data\shoucrck.exe systemroot+\application data\ssmeeibl.exe systemroot+\application data\tchpeatr.exe systemroot+\application data\tglblrll.exe systemroot+\application data\trdzhtxf.exe systemroot+\application data\trstdris.exe systemroot+\application data\ulyuiexeechp.exe systemroot+\application data\vestufck.exe systemroot+\application data\vfthrcbr.exe systemroot+\application data\xogyfhp.exe systemroot+\application data\ykphmbre.exe systemroot+\application data\ylynfste.exe systemroot+\downloaded program files\the_ultimate_browser_enhancer.exe systemroot+\system32\sxbmat.exe systemroot+\temp\rem9b.exe systemroot+\temp\remd.exe systemroot+\ubipwdk.exe tfsuxbtg.exe time funk aim.exe toolbar_uninstall.exe waybait.exe web default one.exe winactivej.exe winactivej_unpacked.exe wshbrybr.exe xlj1.exe xxeoxiqu.exe xyq.exe ystck32.exe yxogltoo.exe
	Remove AutoRun Reference: Go To the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\blehantimapimeta, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\cam-6415[1], delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\defyactive, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ford site, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\frckshll, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\idle heart free wipe, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\iso real, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\list 4, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\loud math help cash, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\meta mail, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\mfcd boob film frag, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\move delete, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\parttickwaitjugs, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\proxycity, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\setup wipe, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\start idle, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\two bags, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\twquh, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ubipwdk, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\uqzborauqedw, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\winactive, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\window balm, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ws2f35t, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\wstpsh, delete it and reboot the machine immediately. If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ybmk, delete it and reboot the machine immediately.
	Unregister DLLs: Unregister these DLLs with Regsvr32, then reboot: antedefault.dll bike poke.dll cast idle.dll ckouvcrcgcea.dll eshglkfvcr.dll filmpeak.dll ktbxbllyth.dll lyzkisnf.dll profilepath+\application data\drstesprpee.dll profilepath+\application data\frlyjeebtrn.dll profilepath+\application data\frlyjeebtru.dll profilepath+\application data\frsezaeaast.dll profilepath+\application data\frsezaeaav.dll profilepath+\application data\glckqksdr.dll profilepath+\application data\ieeblostqly.dll profilepath+\application data\llssalycshh.dll profilepath+\application data\nshelstpgl.dll profilepath+\application data\oostshthptrv.dll profilepath+\application data\plg_ie0.dll profilepath+\application data\prnshgrdssb.dll profilepath+\application data\zxenmgrbl.dll programfilesdir+\64comp~1\rule keep.dll programfilesdir+\acidme~1\barbboob.dll programfilesdir+\active download\store funk.dll programfilesdir+\active~1\store funk.dll programfilesdir+\armymo~1\antitype.dll programfilesdir+\armymo~1\hole title.dll programfilesdir+\elsewa~1\thatlong.dll programfilesdir+\logobi~1\deafdoes.dll programfilesdir+\mapigr~1\peak that.dll programfilesdir+\metaac~1\phone internet.dll programfilesdir+\oozejo~1\copy data.dll programfilesdir+\oozejo~1\dent team.dll programfilesdir+\waveba~1\aim 1.dll programfilesdir+\wavebo~1\acid team.dll programfilesdir+\wavebo~1\elsemode.dll programfilesdir+\wavesu~1\great ante.dll programfilesdir+\waymov~1\curb bind.dll programfilesdir+\wayvga~2\info wait.dll programfilesdir+\window active\unbzip2s.dll setup time.dll software grim.dll systemroot+\application data\chksbdriya.dll systemroot+\application data\droxtrdchdoo.dll systemroot+\application data\eaeeishllblc.dll systemroot+\application data\ealymfrprwch.dll systemroot+\application data\eelykofrllfrj.dll systemroot+\application data\eelykofrllfrpr.dll systemroot+\application data\epllkeeoopr.dll systemroot+\application data\freabrlaouw.dll systemroot+\application data\gldqumssfrie.dll systemroot+\application data\heeachmstll.dll systemroot+\application data\hglllyxrxw.dll systemroot+\application data\icdrhwno.dll systemroot+\application data\meepajlr.dll systemroot+\application data\ousszidrta.dll systemroot+\application data\prnouestssstx.dll systemroot+\application data\prxzoustustgr.dll systemroot+\application data\quglwachfs.dll systemroot+\application data\sstroallhqch.dll systemroot+\application data\tblchepruprgr.dll systemroot+\application data\trstshcrscksr.dll systemroot+\application data\ukfroigl.dll systemroot+\application data\upckeetoutw.dll systemroot+\application data\veaeyglckr.dll systemroot+\application data\woafrquzn.dll systemroot+\application data\yeecrsoustoull.dll systemroot+\application data\ziebaeeoaeepr.dll systemroot+\system\donk_bar.dll systemroot+\system\plg_ie0.dll systemroot+\system32\donk_bar.dll systemroot+\system32\npddeapi.dll systemroot+\system32\plg_ie0.dll systemroot+\system32\veg32.dll.dll
	Clean Registry: Remove these registry items (if present) with RegEdit: HKEY_CLASSES_ROOT\clsid\{00000012-890e-4aac-afd9-000000000000} HKEY_CLASSES_ROOT\clsid\{03e3d2bf-051f-5094-5068-c5ee261285bc} HKEY_CLASSES_ROOT\clsid\{07c0d34d-11d7-43f7-832b-c6bb41726f5f} HKEY_CLASSES_ROOT\clsid\{0d4312e2-5e4d-4a27-a9d8-043e43904277} HKEY_CLASSES_ROOT\clsid\{139e58c9-85b4-45db-9fc9-3919813709f0} HKEY_CLASSES_ROOT\clsid\{1502ab76-0376-4b7b-8226-d34c941072f2} HKEY_CLASSES_ROOT\clsid\{162ab497-087d-4fb3-83ba-4f5159613796} HKEY_CLASSES_ROOT\clsid\{189210a0-36c2-11d7-9928-444553540000} HKEY_CLASSES_ROOT\clsid\{18fd2e3d-35df-aa65-0952-7875de70845f} HKEY_CLASSES_ROOT\clsid\{1a35419c-7394-4989-b3c5-6189eb06bd66} HKEY_CLASSES_ROOT\clsid\{1e62ecd8-ae05-988b-f40a-369b2026409e} HKEY_CLASSES_ROOT\clsid\{24f13043-edfc-446c-a07c-8ed6beb9e39e} HKEY_CLASSES_ROOT\clsid\{25f1bb0d-2d8c-4dda-ad46-684719d09b7e} HKEY_CLASSES_ROOT\clsid\{289848e1-2d29-4d00-9ff1-0c09a1256662} HKEY_CLASSES_ROOT\clsid\{2e1162f8-d289-359d-b1e4-0a4d9301a7d1} HKEY_CLASSES_ROOT\clsid\{3247f2dc-f2a1-9d95-a072-dbb3e1690643} HKEY_CLASSES_ROOT\clsid\{3dcdb313-84a2-6218-64ee-1110caa46fb5} HKEY_CLASSES_ROOT\clsid\{4b8edc53-6cfd-4ee4-9504-38ce7a5bc416} HKEY_CLASSES_ROOT\clsid\{562a6158-bcae-e53f-d40e-403ef85b70a4} HKEY_CLASSES_ROOT\clsid\{56d59f1a-e81a-c85f-d7bb-07a6f380a834} HKEY_CLASSES_ROOT\clsid\{7b49a2a5-b45f-46f3-ac60-2578477671ee} HKEY_CLASSES_ROOT\clsid\{80fddae7-d472-4e1f-8c3a-36b75a091c44} HKEY_CLASSES_ROOT\clsid\{84b55b37-aff7-8942-25ac-f0c5d7a32619} HKEY_CLASSES_ROOT\clsid\{8522f9b3-38c5-4aa4-ae40-7401f1bbc851} HKEY_CLASSES_ROOT\clsid\{8f1a15a7-92b0-4467-ad12-369f60174008} HKEY_CLASSES_ROOT\clsid\{914d0f58-630a-465d-8e28-aea5158e6606} HKEY_CLASSES_ROOT\clsid\{9b35a850-66ab-4c6d-8a66-136ecadcd904} HKEY_CLASSES_ROOT\clsid\{a27d4f42-3018-59ed-19ff-4c1b7a2c18fa} HKEY_CLASSES_ROOT\clsid\{b0a11536-00dc-268e-042a-6cb617e6965e} HKEY_CLASSES_ROOT\clsid\{b9c38317-4e71-4d7b-b072-3aa8dda923b3} HKEY_CLASSES_ROOT\clsid\{bcd5534b-2f54-428e-b3f3-e03b6f10a233} HKEY_CLASSES_ROOT\clsid\{bd8fd0b2-0e6b-4ffa-916f-db8ff7411d5f} HKEY_CLASSES_ROOT\clsid\{c4b41c0c-4e7b-37e0-7b80-ed6437c8eb2c} HKEY_CLASSES_ROOT\clsid\{c5d6b9c5-1c08-43f9-bd04-6aefa21dd754} HKEY_CLASSES_ROOT\clsid\{c61c874f-60bb-4ee7-8afa-92dc85b180c9} HKEY_CLASSES_ROOT\clsid\{c65cad7f-e382-4b90-95c6-89123d0aee61} HKEY_CLASSES_ROOT\clsid\{cfadae1d-f67a-c8f7-46a6-eb20e32a92cd} HKEY_CLASSES_ROOT\clsid\{d1d9e2f6-c179-4386-b197-c4a85c026f67} HKEY_CLASSES_ROOT\clsid\{d3119527-9be0-422c-b9fa-5143d75dfbea} HKEY_CLASSES_ROOT\clsid\{d31e488c-9ed3-4fb0-8f82-f1d559553c06} HKEY_CLASSES_ROOT\clsid\{d44b5436-b3e4-4595-b0e9-106690e70a58} HKEY_CLASSES_ROOT\clsid\{e58e7c45-c426-993a-2a9f-3640a22bf60e} HKEY_CLASSES_ROOT\clsid\{e69e6d3b-861e-4c8b-bdd4-a8b7a61af313} HKEY_CLASSES_ROOT\clsid\{eb9bdd24-ccf1-4a87-98c0-579dba9bda83} HKEY_CLASSES_ROOT\clsid\{ec28a907-37ac-4d9a-a928-ee2ba555a141} HKEY_CLASSES_ROOT\clsid\{f2a5a613-88e0-b267-ce78-aedd8db3ce45} HKEY_CLASSES_ROOT\clsid\{fe289ae1-16e9-9235-420a-95ff90a194f4} HKEY_CLASSES_ROOT\clsid\{fe54e96b-f246-4ed7-97a2-e27086ce5b21} HKEY_CLASSES_ROOT\coal.insidechic HKEY_CLASSES_ROOT\coal.insidechic.1 HKEY_CLASSES_ROOT\dybvi.rngrstrm HKEY_CLASSES_ROOT\dybvi.rngrstrm.1 HKEY_CLASSES_ROOT\invisiblepop.invisible HKEY_CLASSES_ROOT\invisiblepop.invisible.1 HKEY_CLASSES_ROOT\pop.phonebird HKEY_CLASSES_ROOT\pop.phonebird.1 HKEY_CLASSES_ROOT\proto.handler HKEY_CLASSES_ROOT\proto.handler.1 HKEY_CLASSES_ROOT\protocols\handler\ayb HKEY_CLASSES_ROOT\software\microsoft\windows\currentversion\explorer\browser helper objects\{d44b5436-b3e4-4595-b0e9-106690e70a58} HKEY_CLASSES_ROOT\swish.browserhelper HKEY_CLASSES_ROOT\swish.browserhelper.1 HKEY_CLASSES_ROOT\swish.toolband HKEY_CLASSES_ROOT\swish.toolband.1 HKEY_CLASSES_ROOT\typelib\{1a35419c-7394-4989-b3c5-6189eb06bd66} HKEY_CLASSES_ROOT\typelib\{8f1a15a7-92b0-4467-ad12-369f60174008} HKEY_CLASSES_ROOT\typelib\{c65cad7f-e382-4b90-95c6-89123d0aee61} HKEY_CLASSES_ROOT\typelib\{d31e488c-9ed3-4fb0-8f82-f1d559553c06} HKEY_CLASSES_ROOT\typelib\{dffe1ccf-e1e8-4470-9962-73277cc2c898} HKEY_CLASSES_ROOT\typelib\{fe54e96b-f246-4ed7-97a2-e27086ce5b21} HKEY_CLASSES_ROOT\udhiu.rngrstrjyvscd HKEY_CLASSES_ROOT\udhiu.rngrstrjyvscd.1 HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{18fd2e3d-35df-aa65-0952-7875de70845f} HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{2e1162f8-d289-359d-b1e4-0a4d9301a7d1} HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{38d8beb0-8e9c-48e2-b36e-759615f9930f} HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{562a6158-bcae-e53f-d40e-403ef85b70a4} HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{56d59f1a-e81a-c85f-d7bb-07a6f380a834} HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{84b55b37-aff7-8942-25ac-f0c5d7a32619} HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{a27d4f42-3018-59ed-19ff-4c1b7a2c18fa} HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{b0a11536-00dc-268e-042a-6cb617e6965e} HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{e58e7c45-c426-993a-2a9f-3640a22bf60e} HKEY_CURRENT_USER\software\microsoft\internet explorer\toolbar\webbrowser\{fe289ae1-16e9-9235-420a-95ff90a194f4} HKEY_CURRENT_USER\software\microsoft\windows\currentversion\backup HKEY_CURRENT_USER\software\trinityayb HKEY_CURRENT_USER\software\winactive HKEY_CURRENT_USER\software\xsswbrwougouecr HKEY_LOCAL_MACHINE\software\classes\clsid\{092d8662-f5c6-41a3-be1d-14d940f6010d} HKEY_LOCAL_MACHINE\software\classes\clsid\{139e58c9-85b4-45db-9fc9-3919813709f0} HKEY_LOCAL_MACHINE\software\classes\clsid\{162ab497-087d-4fb3-83ba-4f5159613796} HKEY_LOCAL_MACHINE\software\classes\clsid\{289848e1-2d29-4d00-9ff1-0c09a1256662} HKEY_LOCAL_MACHINE\software\classes\clsid\{33a4af42-fc94-4873-8bc0-1da97d6edd6d} HKEY_LOCAL_MACHINE\software\classes\clsid\{80fddae7-d472-4e1f-8c3a-36b75a091c44} HKEY_LOCAL_MACHINE\software\classes\clsid\{914d0f58-630a-465d-8e28-aea5158e6606} HKEY_LOCAL_MACHINE\software\classes\clsid\{9b35a850-66ab-4c6d-8a66-136ecadcd904} HKEY_LOCAL_MACHINE\software\classes\clsid\{b0a11536-00dc-268e-042a-6cb617e6965e} HKEY_LOCAL_MACHINE\software\classes\clsid\{b9c38317-4e71-4d7b-b072-3aa8dda923b3} HKEY_LOCAL_MACHINE\software\classes\clsid\{bd8fd0b2-0e6b-4ffa-916f-db8ff7411d5f} HKEY_LOCAL_MACHINE\software\classes\clsid\{c5d6b9c5-1c08-43f9-bd04-6aefa21dd754} HKEY_LOCAL_MACHINE\software\classes\clsid\{c8a113e0-6da0-4f0e-bb89-9726212aaf32} HKEY_LOCAL_MACHINE\software\classes\clsid\{d3119527-9be0-422c-b9fa-5143d75dfbea} HKEY_LOCAL_MACHINE\software\classes\clsid\{d44b5436-b3e4-4595-b0e9-106690e70a58} HKEY_LOCAL_MACHINE\software\classes\clsid\{e69e6d3b-861e-4c8b-bdd4-a8b7a61af313} HKEY_LOCAL_MACHINE\software\classes\clsid\{f689307b-c3cd-4d10-aaf2-d1f75358a5c2} HKEY_LOCAL_MACHINE\software\classes\clsid\{fe289ae1-16e9-9235-420a-95ff90a194f4} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{18fd2e3d-35df-aa65-0952-7875de70845f} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{1e62ecd8-ae05-988b-f40a-369b2026409e} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{289848e1-2d29-4d00-9ff1-0c09a1256662} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{2e1162f8-d289-359d-b1e4-0a4d9301a7d1} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{562a6158-bcae-e53f-d40e-403ef85b70a4} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{56d59f1a-e81a-c85f-d7bb-07a6f380a834} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{7b49a2a5-b45f-46f3-ac60-2578477671ee} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{80fddae7-d472-4e1f-8c3a-36b75a091c44} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{84b55b37-aff7-8942-25ac-f0c5d7a32619} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{914d0f58-630a-465d-8e28-aea5158e6606} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{9b35a850-66ab-4c6d-8a66-136ecadcd904} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{a27d4f42-3018-59ed-19ff-4c1b7a2c18fa} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{b0a11536-00dc-268e-042a-6cb617e6965e} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{c4b41c0c-4e7b-37e0-7b80-ed6437c8eb2c} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{c5d6b9c5-1c08-43f9-bd04-6aefa21dd754} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{d3119527-9be0-422c-b9fa-5143d75dfbea} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{e58e7c45-c426-993a-2a9f-3640a22bf60e} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{ec28a907-37ac-4d9a-a928-ee2ba555a141} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{f689307b-c3cd-4d10-aaf2-d1f75358a5c2} HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\toolbar\{fe289ae1-16e9-9235-420a-95ff90a194f4} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{03e3d2bf-051f-5094-5068-c5ee261285bc} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{092d8662-f5c6-41a3-be1d-14d940f6010d} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{139e58c9-85b4-45db-9fc9-3919813709f0} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{162ab497-087d-4fb3-83ba-4f5159613796} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{24f13043-edfc-446c-a07c-8ed6beb9e39e} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{26dc15e7-ea6e-378b-68aa-cd224b3ad7c3} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3247f2dc-f2a1-9d95-a072-dbb3e1690643} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{33a4af42-fc94-4873-8bc0-1da97d6edd6d} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{3dcdb313-84a2-6218-64ee-1110caa46fb5} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{4b8edc53-6cfd-4ee4-9504-38ce7a5bc416} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{b9c38317-4e71-4d7b-b072-3aa8dda923b3} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{bd8fd0b2-0e6b-4ffa-916f-db8ff7411d5f} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{c8a113e0-6da0-4f0e-bb89-9726212aaf32} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{cfadae1d-f67a-c8f7-46a6-eb20e32a92cd} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{d44b5436-b3e4-4595-b0e9-106690e70a58} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{e69e6d3b-861e-4c8b-bdd4-a8b7a61af313} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{f2a5a613-88e0-b267-ce78-aedd8db3ce45} HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\installer\products\c8d617f6f8933d11581e000540386890\webpublfiles\usage HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\blehantimapimeta HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\cam-6415[1] HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\defyactive HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ford site HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\frckshll HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\idle heart free wipe HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\iso real HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\list 4 HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\loud math help cash HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\meta mail HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\mfcd boob film frag HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\move delete HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\parttickwaitjugs HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\proxycity HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\setup wipe HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\start idle HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\two bags HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\twquh HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ubipwdk HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\uqzborauqedw HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\winactive HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\window balm HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ws2f35t HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\wstpsh HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\ybmk HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\nthlllleth HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\pprwazmprss HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\shubryochuss
	Remove Files: Remove these files (if present) with Windows Explorer: 1111.exe 2443.exe 24701.exe 2dimensionofexploits.asm 2dimensionofexploitsenc.hta 2dimensionofexploitsenc.php 455ba634cc activeonce.exe afa6d429.exe agreement-.htm ahlrfsoy.exe ante.exe antedefault.dll aswnk.exe aswwxs.reg atiupdate2.exe backup.reg bags more bold.exe bash second cast.exe bendaceproc.exe bike poke.dll bind funk inside.exe binsect.exe bitsplaygrid.exe bore2mags.exe bytemess.exe c:\docume~1\yap@w~1\applic~1\ckcoofrunea.exe campglueflap.exe cash remote.exe cast idle.dll ckouvcrcgcea.dll corn bold media.exe cyd1.exe debugregs.exe defy view.exe desktopdir+\adult.lnk desktopdir+\gambling and online casinos.lnk desktopdir+\mp3 music search.lnk desktopdir+\news and sports.lnk desktopdir+\online movies.lnk does admin.exe download_plugin.exe each cdrom memo.exe eshglkfvcr.dll etu1.exe exploit1.htm favorites+\ adult entertainment.url favorites+\ adult\adult chat.url favorites+\ adult\amateur photo.url favorites+\ adult\asian sex.url favorites+\ adult\ebony.url favorites+\ adult\fetish.url favorites+\ adult\gay and lesbian.url favorites+\ adult\hardcore.url favorites+\ adult\live video feeds.url favorites+\ adult\matchmaking.url favorites+\ adult\xxx cartoons.url favorites+\ business and finance\b to b.url favorites+\ business and finance\banking.url favorites+\ business and finance\business.url favorites+\ business and finance\careers.url favorites+\ business and finance\credit cards.url favorites+\ business and finance\finance.url favorites+\ business and finance\insurance.url favorites+\ business and finance\office.url favorites+\ business and finance\printing.url favorites+\ computers and tech\computer games.url favorites+\ computers and tech\computer stores.url favorites+\ computers and tech\dedicated server.url favorites+\ computers and tech\domain names.url favorites+\ computers and tech\hardware.url favorites+\ computers and tech\laptops.url favorites+\ computers and tech\software.url favorites+\ computers and tech\telecommunication\mobile phones.url favorites+\ computers and tech\telecommunication\telecommunication.url favorites+\ computers and tech\telecommunication\telephone.url favorites+\ computers and tech\telecommunication\text sms messaging.url favorites+\ computers and tech\web design.url favorites+\ computers and tech\web hosting.url favorites+\ cool stuff\auction.url favorites+\ cool stuff\classifieds.url favorites+\ cool stuff\free emails.url favorites+\ cool stuff\free homepages.url favorites+\ cool stuff\free services.url favorites+\ cool stuff\school essays and homework.url favorites+\ cool stuff\services.url favorites+\ entertainment\adult entertainment.url favorites+\ entertainment\automotive.url favorites+\ entertainment\dvd.url favorites+\ entertainment\entertainment.url favorites+\ entertainment\hot games and gaming.url favorites+\ entertainment\mp3.url favorites+\ entertainment\travel.url favorites+\ gambling.url favorites+\ gambling\black jack.url favorites+\ gambling\chips.url favorites+\ gambling\craps.url favorites+\ gambling\multi player.url favorites+\ gambling\online casinos.url favorites+\ gambling\poker.url favorites+\ gambling\roulette.url favorites+\ gambling\slots.url favorites+\ gambling\sports books.url favorites+\ games.url favorites+\ mp3 music.url favorites+\ news.url favorites+\ on lifestyle\art.url favorites+\ on lifestyle\astrology.url favorites+\ on lifestyle\books.url favorites+\ on lifestyle\community.url favorites+\ on lifestyle\ebooks.url favorites+\ on lifestyle\education\education.url favorites+\ on lifestyle\education\training.url favorites+\ on lifestyle\health and beauty\beauty.url favorites+\ on lifestyle\health and beauty\health and fitness.url favorites+\ on lifestyle\health and beauty\pharmacy.url favorites+\ on lifestyle\home and garden\construction.url favorites+\ on lifestyle\home and garden\furniture.url favorites+\ on lifestyle\home and garden\home and garden.url favorites+\ on lifestyle\home and garden\real estate.url favorites+\ on lifestyle\home and garden\utilities.url favorites+\ on lifestyle\kids.url favorites+\ on lifestyle\magazines.url favorites+\ on lifestyle\matchmaking.url favorites+\ on lifestyle\pets.url favorites+\ on lifestyle\self help.url favorites+\ on lifestyle\wine.url favorites+\ on lifestyle\women.url favorites+\ shopping and gifts\accessories.url favorites+\ shopping and gifts\apparel.url favorites+\ shopping and gifts\cards.url favorites+\ shopping and gifts\electronics.url favorites+\ shopping and gifts\flowers.url favorites+\ shopping and gifts\gifts.url favorites+\ shopping and gifts\jewlery.url favorites+\ shopping and gifts\retail products.url favorites+\ shopping and gifts\shoes.url favorites+\ shopping and gifts\shopping.url favorites+\ shopping and gifts\toys.url favorites+\entertainment\games.url femguyse.exe film.exe filmpeak.dll fmtah.exe frag drv first boob.exe freemp3z.exe fullscreenbar.htm funktypebinfffccc.exe glzchtb.lib great 1.exe great each close.exe greyplan.exe header (1).htm header (2).htm header (3).htm header.htm heart setup inside.bin heartflaw.exe help support.exe hope1media.exe hoxujhed.exe hpt1.exe install.htm install.txt installation report download_plugin.htm interarmy.exe jumpnoundate.exe keep comp.exe keyhost.exe khzc256.tmp kind joy bib.exe ktbxbllyth.dll kvgpmfiv.exe lejytfqx.exe liesbagslist.exe links.txt lite cake loud.exe lniegfer.exe loadcashmeet.exe logo vc.exe longonlineplay.exe lop notes.txt lrgluoot.exe lyzkisnf.dll mail mess.exe mp3.exe mp3_plugin.exe mp3serch.exe nxfbmzqu.exe onlinecontent.lnk passthrough[1].htm pile default.exe pkajulyt.exe plus size.exe popupbaropener[1].htm profilepath+\application data\aybgwarn.htm profilepath+\application data\aybwarn.htm profilepath+\application data\brsswthg.exe profilepath+\application data\chblgrstd.lib profilepath+\application data\ckcoofrunea.exe profilepath+\application data\ddinxmdb.exe profilepath+\application data\deskicon.lib profilepath+\application data\dgpxzhtb.exe profilepath+\application data\djgxsbcl.exe profilepath+\application data\drstesprpee.dll profilepath+\application data\efjwxjsl.exe profilepath+\application data\eneqckap.exe profilepath+\application data\flmgvmas.exe profilepath+\application data\fqbhyhjh.exe profilepath+\application data\frlyjeebtrn.dll profilepath+\application data\frlyjeebtru.dll profilepath+\application data\frsezaeaast.dll profilepath+\application data\frsezaeaav.dll profilepath+\application data\gchmfrea.exe profilepath+\application data\glckqksdr.dll profilepath+\application data\gqlfiqii.exe profilepath+\application data\gzxqpghe.exe profilepath+\application data\hlsctpay.exe profilepath+\application data\hlyvjncf.exe profilepath+\application data\idixbdmf.exe profilepath+\application data\ieeblostqly.dll profilepath+\application data\kmigeuhh.exe profilepath+\application data\lckqdcvd.exe profilepath+\application data\list cool loud math\objnew.exe profilepath+\application data\lkxelvrg.exe profilepath+\application data\llssalycshh.dll profilepath+\application data\lopsearch.exe profilepath+\application data\memo01idleheart\roam info.exe profilepath+\application data\mspuztbg.exe profilepath+\application data\muqhatod.exe profilepath+\application data\muxibdom.exe profilepath+\application data\mycvbdqu.exe profilepath+\application data\nimylprv.exe profilepath+\application data\nshelstpgl.dll profilepath+\application data\one bolt bleh anti\once each.exe profilepath+\application data\oostshthptrv.dll profilepath+\application data\ovnolxvi.exe profilepath+\application data\pbgqwhoj.exe profilepath+\application data\plg_ie0.dll profilepath+\application data\prnshgrdssb.dll profilepath+\application data\qhiqikdr.exe profilepath+\application data\qtufbghm.exe profilepath+\application data\qwxgxlrv.exe profilepath+\application data\roam surf part tick\junk pure.exe profilepath+\application data\roam surf part tick\puretrust.exe profilepath+\application data\save third mfcd boob\loudmove.exe profilepath+\application data\save third mfcd boob\vga admin.exe profilepath+\application data\sefiqovd.exe profilepath+\application data\srytuikb.exe profilepath+\application data\taecoidy.exe profilepath+\application data\trmugnsu.exe profilepath+\application data\trstlskb.exe profilepath+\application data\uljpmexe.exe profilepath+\application data\vlluafrq.exe profilepath+\application data\vygaeifz.exe profilepath+\application data\wa_inst.exe profilepath+\application data\xxdfwvli.exe profilepath+\application data\ysaebwco.exe profilepath+\application data\zaeoxdiu.exe profilepath+\application data\zdmlfhmh.exe profilepath+\application data\zvpkxxtu.exe profilepath+\application data\zvxcypnh.exe profilepath+\application data\zxenmgrbl.dll profilepath+\local settings\temp\ayw17f.exe profilepath+\local settings\temp\bae1.exe profilepath+\local settings\temp\bvj13.exe profilepath+\local settings\temp\den1.exe profilepath+\local settings\temp\fbf1.exe profilepath+\local settings\temp\hqe1.exe profilepath+\local settings\temp\now1.exe profilepath+\local settings\temp\pfn1.exe profilepath+\local settings\temp\pnt1.exe profilepath+\local settings\temp\prab.exe profilepath+\local settings\temp\pyo25.exe profilepath+\local settings\temp\qhy81.exe profilepath+\local settings\temp\rem15.exe profilepath+\local settings\temp\rem24.exe profilepath+\local settings\temp\rem25.exe profilepath+\local settings\temp\rem2ea.exe profilepath+\local settings\temp\rny1.exe profilepath+\local settings\temp\sml1.exe profilepath+\local settings\temp\sta3.exe profilepath+\local settings\temp\szwe.exe profilepath+\local settings\temp\txo1.exe profilepath+\local settings\temp\uqg1.exe profilepath+\local settings\temp\vyz1.exe profilepath+\local settings\temp\wry1.exe profilepath+\local settings\temp\znp1.exe profilepath+\local settings\temporary internet files\content.ie5\s9grsz83\cam-6415[1].exe profilepath+\owner\local settings\temp\rem18c.exe programfilesdir+\64comp~1\rule keep.dll programfilesdir+\acidme~1\barbboob.dll programfilesdir+\acidme~1\chin mfcd.bin programfilesdir+\active download\16537.exe programfilesdir+\active download\store funk.dll programfilesdir+\active~1\store funk.dll programfilesdir+\armymo~1\3549.exe programfilesdir+\armymo~1\antitype.dll programfilesdir+\armymo~1\hole title.dll programfilesdir+\armymo~1\longpuresoft.bin programfilesdir+\burn media meta\bdvcnypx.exe programfilesdir+\cityai~1\binidledumb.exe programfilesdir+\creati~1\jynqzshx.exe programfilesdir+\creati~1\oozeboob.exe programfilesdir+\creati~1\pazgtrve.exe programfilesdir+\creati~1\plus thunk mags.exe programfilesdir+\creati~1\settings browse.exe programfilesdir+\creati~1\skfvhmqz.exe programfilesdir+\driveh~1\64bikeabout.exe programfilesdir+\dvdfindload\455ba634 programfilesdir+\dvdfindload\bore active info funk.exe programfilesdir+\dvdfindload\bqssapdm.exe programfilesdir+\dvdfindload\ftulpefl.exe programfilesdir+\dvdfindload\funktypebin.exe programfilesdir+\elsewa~1\16021.exe programfilesdir+\elsewa~1\thatlong.dll programfilesdir+\fourat~1\bowsbleh.exe programfilesdir+\fourat~1\fkrbssba.exe programfilesdir+\fourat~1\ford wma dead.exe programfilesdir+\fourat~1\gagmqvaf.exe programfilesdir+\fourat~1\kcwarhnv.exe programfilesdir+\fourat~1\pure bash.exe programfilesdir+\fourat~1\qsrdfyqj.exe programfilesdir+\freein~1\fastfirst.exe programfilesdir+\freein~1\knynnyma.exe programfilesdir+\global~1\mfcdpingwarnfast.exe programfilesdir+\greato~1\activebitsflap.exe programfilesdir+\greato~1\afniekvu.exe programfilesdir+\greato~1\cakerdrplan.exe programfilesdir+\greato~1\idle barb ball.exe programfilesdir+\greato~1\vzmhfjyb.exe programfilesdir+\inside~1\manager free.exe programfilesdir+\jugsse~1\pile inter grim.bin programfilesdir+\logobi~1\deafdoes.dll programfilesdir+\manager ace gram\1072.exe programfilesdir+\mapigr~1\acid slow.bin programfilesdir+\mapigr~1\peak that.dll programfilesdir+\mathte~1\bold grim.exe programfilesdir+\memoli~1\bzqzgkdq.exe programfilesdir+\memoli~1\cjcegzut.exe programfilesdir+\memoli~1\dentcurbfree.exe programfilesdir+\memoli~1\drv list part corn.exe programfilesdir+\memoli~1\flaw army name.exe programfilesdir+\memoli~1\hojxfjdu.exe programfilesdir+\memoli~1\loyftzhg.exe programfilesdir+\metaac~1\phone internet.dll programfilesdir+\nounbe~1\curbuser.exe programfilesdir+\objcdrom\16logplayprogram.exe programfilesdir+\objcdrom\bait cake part bash.exe programfilesdir+\objcdrom\safesoaplicenseplay.exe programfilesdir+\objels~1\sizebuildlogo.exe programfilesdir+\oozejo~1\14599.exe programfilesdir+\oozejo~1\19205.exe programfilesdir+\oozejo~1\24758.exe programfilesdir+\oozejo~1\29923.exe programfilesdir+\oozejo~1\copy data.dll programfilesdir+\oozejo~1\dent team.dll programfilesdir+\progra~1\city tons.exe programfilesdir+\progra~1\clock mags inter book.exe programfilesdir+\progra~1\cmbjcmrq.exe programfilesdir+\progra~1\else iso user bows.exe programfilesdir+\progra~1\flapholdlogo.exe programfilesdir+\progra~1\inter phone pile default.exe programfilesdir+\progra~1\one cdrom type more.exe programfilesdir+\progra~1\wipekind.exe programfilesdir+\progra~1\zwsghqhs.exe programfilesdir+\proxyn~1\boldabout.exe programfilesdir+\proxyn~1\citydog.exe programfilesdir+\proxyn~1\more.exe programfilesdir+\proxyn~1\realaudio.exe programfilesdir+\proxyn~1\roam.exe programfilesdir+\proxyn~1\salrukuu.exe programfilesdir+\roamju~1\delete play.exe programfilesdir+\roamse~1\rulefindcamp.exe programfilesdir+\roamse~1\window skip.exe programfilesdir+\safeba~1\stop hope.exe programfilesdir+\sectmp~1\skipbase.exe programfilesdir+\showsu~1\ewgcgvzk.exe programfilesdir+\showsu~1\jxmiyjlq.exe programfilesdir+\showsu~1\lfgaukbm.exe programfilesdir+\showsu~1\media else rdr.exe programfilesdir+\showsu~1\nnzmpuhm.exe programfilesdir+\showsu~1\wtmtyuls.exe programfilesdir+\showsupport\media else rdr.exe programfilesdir+\sitein~1\eksthzea.exe programfilesdir+\sitein~1\gcvbdwdc.exe programfilesdir+\sitein~1\intramemocomp.exe programfilesdir+\sitein~1\jeursyec.exe programfilesdir+\sitein~1\lsocnmju.exe programfilesdir+\sitein~1\ocyixkfk.exe programfilesdir+\sitein~1\uyibygkh.exe programfilesdir+\sitein~1\zgplkbke.exe programfilesdir+\thirda~1\etarwlaf.exe programfilesdir+\thirda~1\glue blue tons.exe programfilesdir+\thirda~1\mediawebdownload.exe programfilesdir+\thirda~1\ozrkesxz.exe programfilesdir+\thirda~1\qmgytdru.exe programfilesdir+\thirda~1\ruledatawma.exe programfilesdir+\trayokay\eygfyuoe.exe programfilesdir+\trayokay\rppzstyl.exe programfilesdir+\waveba~1\32437.exe programfilesdir+\waveba~1\aim 1.dll programfilesdir+\wavebo~1\20044.exe programfilesdir+\wavebo~1\7310.exe programfilesdir+\wavebo~1\acid team.dll programfilesdir+\wavebo~1\elsemode.dll programfilesdir+\wavesu~1\1716.exe programfilesdir+\wavesu~1\great ante.dll programfilesdir+\wavesu~1\moreamok.bin programfilesdir+\waymov~1\acid stop.bin programfilesdir+\waymov~1\curb bind.dll programfilesdir+\wayvga~2\info wait.dll programfilesdir+\window active\unbzip2s.dll programfilesdir+\window active\winactive.exe refslow.exe removelop.exe rgg1.exe rpzgnwux.exe rvimsmkf.exe sect name.exe setup time.dll sfx71e4.tmp sfxbe.tmp sign support mags.exe sizewaitgrim.exe soft team.exe software grim.dll software_plugin.exe ssaxstxoaieoagrh.reg sta1f.exe sta2.exe systemroot+\application data\asshuktr.exe systemroot+\application data\aybgwarn.htm systemroot+\application data\aybwarn.htm systemroot+\application data\bilyooas.exe systemroot+\application data\byb_save.exe systemroot+\application data\chksbdriya.dll systemroot+\application data\crgbeaoa.exe systemroot+\application data\dmvcrthl.exe systemroot+\application data\droxtrdchdoo.dll systemroot+\application data\eaeeishllblc.dll systemroot+\application data\ealymfrprwch.dll systemroot+\application data\eaymulyl.exe systemroot+\application data\eelykofrllfrj.dll systemroot+\application data\eelykofrllfrpr.dll systemroot+\application data\eeublidc.exe systemroot+\application data\epllkeeoopr.dll systemroot+\application data\freabrlaouw.dll systemroot+\application data\gldqumssfrie.dll systemroot+\application data\glxshmcr.exe systemroot+\application data\heeachmstll.dll systemroot+\application data\hglllyxrxw.dll systemroot+\application data\icdrhwno.dll systemroot+\application data\ijlysseb.exe systemroot+\application data\jqumysto.exe systemroot+\application data\kfriegbs.exe systemroot+\application data\llfggrdr.exe systemroot+\application data\lltckiey.exe systemroot+\application data\lopsearc.exe systemroot+\application data\meemnckyqbr.exe systemroot+\application data\meepajlr.dll systemroot+\application data\meepajlr.exe systemroot+\application data\mprcouie.exe systemroot+\application data\oofrkxpe.exe systemroot+\application data\ousszidrta.dll systemroot+\application data\peebqusz.exe systemroot+\application data\prnouestssstx.dll systemroot+\application data\prxzoustustgr.dll systemroot+\application data\quglwachfs.dll systemroot+\application data\quveioot.exe systemroot+\application data\shoucrck.exe systemroot+\application data\ssmeeibl.exe systemroot+\application data\sstroallhqch.dll systemroot+\application data\tblchepruprgr.dll systemroot+\application data\tchpeatr.exe systemroot+\application data\tglblrll.exe systemroot+\application data\trdzhtxf.exe systemroot+\application data\trstdris.exe systemroot+\application data\trstshcrscksr.dll systemroot+\application data\ukfroigl.dll systemroot+\application data\ulyuiexeechp.exe systemroot+\application data\upckeetoutw.dll systemroot+\application data\veaeyglckr.dll systemroot+\application data\vestufck.exe systemroot+\application data\vfthrcbr.exe systemroot+\application data\woafrquzn.dll systemroot+\application data\xogyfhp.exe systemroot+\application data\yeecrsoustoull.dll systemroot+\application data\ykphmbre.exe systemroot+\application data\ylynfste.exe systemroot+\application data\ziebaeeoaeepr.dll systemroot+\b_dnserr.gif systemroot+\desktop.htm systemroot+\dnserror.htm systemroot+\downloaded program files\the_ultimate_browser_enhancer.exe systemroot+\i_dnserr.gif systemroot+\jexpoofro.htm systemroot+\r_dnserr.gif systemroot+\s_dnserr.gif systemroot+\system\donk_bar.dll systemroot+\system\plg_ie0.dll systemroot+\system32\donk_bar.dll systemroot+\system32\npddeapi.dll systemroot+\system32\plg_ie0.dll systemroot+\system32\sxbmat.exe systemroot+\system32\veg32.dll.dll systemroot+\temp\rem9b.exe systemroot+\temp\remd.exe systemroot+\ubipwdk.exe systemroot+\web\wallpaper\desktop.htm systemroot+\web\wallpaper\desktop.swf tchstlmmdrm.htm tfsuxbtg.exe time funk aim.exe toolbar_uninstall.exe twunk001.mtx ulyfchcrcrdcr.htm waybait.exe web default one.exe winactivej.exe winactivej_unpacked.exe wshbrybr.exe xlj1.exe xxeoxiqu.exe xyq.exe ystck32.exe yxogltoo.exe
	Remove Directories: Remove these directories (if present) with Windows Explorer: favorites+\ shopping and gifts profilepath+\local settings\temp\delete.me profilepath+\temp\delete.me programfilesdir+\dvdfindload programfilesdir+\elsewa~1 programfilesdir+\logobi~1 programfilesdir+\proxyn~1 programfilesdir+\roamju~1 programfilesdir+\showsu~1 programfilesdir+\showsupport programfilesdir+\sitein~1 programfilesdir+\waveba~1 programfilesdir+\wavesu~1 programfilesdir+\waymov~1 programfilesdir+\wayvga~2 programfilesdir+\window active
	Restore Settings: After following the instructions above, you will still need to restore your original settings and prevent this from happening again. Here''s how.
Research
File Analyses:	Lop.com: 1111.exe · 14599.exe · 2443.exe · 24701.exe · 2dimensionofexploits.asm · 2dimensionofexploitsenc.hta · 2dimensionofexploitsenc.php · 455ba634cc · activeonce.exe · adult entertainment.url · adult.lnk · afa6d429.exe · agreement-.htm · ahlrfsoy.exe · ante.exe · antedefault.dll · aswnk.exe · aswwxs.reg · atiupdate2.exe · backup.reg · barbboob.dll · bike poke.dll · binsect.exe · bitsplaygrid.exe · boldabout.exe · bore2mags.exe · campglueflap.exe · cast idle.dll · ckcoofrunea.exe · ckouvcrcgcea.dll · corn bold media.exe · cyd1.exe · debugregs.exe · delete play.exe · Dentcurbfree.exe · desktop.htm · desktop.swf · does admin.exe · download_plugin.exe · each cdrom memo.exe · eshglkfvcr.dll · etu1.exe · exploit1.htm · film.exe · filmpeak.dll · Flaw Army Name.exe · fmtah.exe · freemp3z.exe · fullscreenbar.htm · funktypebinfffccc.exe · gambling and online casinos.lnk · glckqksdr.dll · glzchtb.lib · great 1.exe · header (1).htm · header (2).htm · header (3).htm · header.htm · heart setup inside.bin · help support.exe · hpt1.exe · install.htm · install.txt · installation report download_plugin.htm · intramemocomp.exe · jumpnoundate.exe · keyhost.exe · khzc256.tmp · ktbxbllyth.dll · kvgpmfiv.exe · links.txt · lite cake loud.exe · lniegfer.exe · loadcashmeet.exe · longonlineplay.exe · lop notes.txt · lrgluoot.exe · lyzkisnf.dll · media else rdr.exe · mfcdpingwarnfast.exe · mp3 music search.lnk · mp3.exe · mp3_plugin.exe · mp3serch.exe · news and sports.lnk · nxfbmzqu.exe · online movies.lnk · onlinecontent.lnk · passthrough[1].htm · pile default.exe · pkajulyt.exe · plg_ie0.dll · plus size.exe · popupbaropener[1].htm · qwxgxlrv.exe · refslow.exe · removelop.exe · rgg1.exe · rpzgnwux.exe · rulefindcamp.exe · rvimsmkf.exe · sect name.exe · setup time.dll · sfx71e4.tmp · sfxbe.tmp · sizewaitgrim.exe · software_plugin.exe · ssaxstxoaieoagrh.reg · stop hope.exe · tchstlmmdrm.htm · tfsuxbtg.exe · the_ultimate_browser_enhancer.exe · toolbar_uninstall.exe · twunk001.mtx · ulyfchcrcrdcr.htm · vlluafrq.exe · wa_inst.exe · waybait.exe · web default one.exe · wshbrybr.exe · xlj1.exe · xxeoxiqu.exe · ystck32.exe · yxogltoo.exe · zvpkxxtu.exe · zxenmgrbl.dll Lop.com.WinActive: activebitsflap.exe · bags more bold.exe · bendaceproc.exe · bind funk inside.exe · binidledumb.exe · bold grim.exe · bowsbleh.exe · bytemess.exe · defy view.exe · ford wma dead.exe · great each close.exe · greyplan.exe · heartflaw.exe · hope1media.exe · hoxujhed.exe · idle barb ball.exe · interarmy.exe · keep comp.exe · kind joy bib.exe · liesbagslist.exe · logo vc.exe · mail mess.exe · mediawebdownload.exe · oozeboob.exe · pile default.exe · plus thunk mags.exe · ruledatawma.exe · sign support mags.exe · soft team.exe · software grim.dll · time funk aim.exe · unbzip2s.dll · winactive.exe · xyq.exe Lop.com.WinActiveJ: winactivej.exe · winactivej_unpacked.exe OmegaSearch: bash second cast.exe · cash remote.exe · femguyse.exe · frag drv first boob.exe · lejytfqx.exe · sta1f.exe · sta2.exe
More Info:	Nastylop is a site set up to fight Lop. AllTheWeb, AltaVista, AOL Search, Ask Jeeves, Google, HotBot, Lycos, LookSmart, MSN, Yahoo!
Research By:	Andrew Clover PestPatrol's Pest Research Center
Last Revised:	April 03, 2005