Google Answers Logo
View Question
 
Q: IE highjacked by parasite ecpm.com ( Answered,   1 Comment )
Question  
Subject: IE highjacked by parasite ecpm.com
Category: Computers > Operating Systems
Asked by: ranrod7-ga
List Price: $5.00
Posted: 30 Apr 2003 14:31 PDT
Expires: 30 May 2003 14:31 PDT
Question ID: 197645
I was forwarded a google reply about a problem with a computer
parasite called ECPM.com.  I followed all the instructions to delete
files and keys and even downloaded Spybot and ran it.  The thing seems
dormant, but the toolbar remains. It has a name under
Views/Toolbars...called " hssylabrchi " Any advice on how I can remove
the toolbar???? I must have missed something, Thanks, Randy
Answer  
Subject: Re: IE highjacked by parasite ecpm.com
Answered By: aceresearcher-ga on 30 Apr 2003 16:57 PDT
 
Greetings, ranrod7!

According to information I found for you, ecpm.com is a variant of the
"Lop" spyware:

From DoxDesk, an excellent source of information about "scumware"
(spyware, adware, and other annoyances):

"lop is a family of programs that set your start page and IE's search
features to use the site lop.com ('Live Online Portal') or one of its
clone sites. Known lop sites include:
... ecpm.com ...

Removal
Spybot S&D can remove most variants of lop/Toolbar. Ad-Aware 5 can
remove older variants of lop/Toolbar.

Some lop installations have an uninstall feature. If lop has put a
round icon in the system tray, try right-clicking this, choosing
'Menu', then on the resulting window, clicking 'Help', then
'Uninstall'. With newer variants you will have to answer an annoying
riddle before it will go away.

Manual removal
Open the Application Data folder. This can be found inside the Windows
folder on Windows 95/98/Me; on Windows 2000 and XP it is inside your
user folder in 'Documents and Settings', but it's hidden, so go to
Tools -> Folder Options -> View and turn on 'Show hidden files and
folders' to see it. In Windows NT 4.0 it is in the user folder inside
'WinNT\Profiles'.

The filenames of lop files can vary for each different installation,
but usually under Windows there should not be any files inside
Application Data (only folders), so it's generally easy to pick out
the culprits. Known filenames for the toolbar DLL (lop/Toolbar,
lop/Rnd) or ayb: protocol DLL (lop/AYB) include...."
(Please go to this link to read full removal instructions)
http://www.doxdesk.com/parasite/lop.html


User Traci posted the following information at IT Works International
Forum from a letter she received in response to her complaint to the
makers of LOP:

"There are several methods available to you should you wish to
uninstall any of our software products you had previously chosen to
install:

- You can go to your Start Menu--Control Panel, then choose the 'Add /
Remove Programs' option then select 'Lop.com' or 'LOP SEARCH' or
‘Browser Enhancer’ from the menu to run the uninstaller.

- You can also locate the globe type icon in the bottom right hand
corner of your screen (near the clock), right click on it then click
Menu. From the main menu you will see a help button on the top right
hand corner. Click the help button then choose 'uninstall'.

- Additionally a separate uninstall program may be downloaded here:
http://lop.com/new_uninstall.exe"
http://www.itwi.com/wwwboard/messages/71.html

However, I would put more confidence in the removal methods advocated
by DoxDesk than by the scumware company C2 Media itself.


Search Strategy

ecpm parasite
://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=ecpm+parasite&btnG=Google+Search&num=100&filter=0


Before Rating my Answer, if you have any questions about this
information, please post a Request for Clarification.
      
I hope that this Answer provides exactly the information that you
needed. Best Wishes on getting your system cleaned up and free of
parasites!
     
Regards,     
       
aceresearcher

Clarification of Answer by aceresearcher-ga on 01 May 2003 12:59 PDT
Hello again, ranrod7!

Spybot just released the newest version on Monday (April 28), and it
includes fixes for the following:
 
"2003-04-28 
Hijacker 
++ 17plus  
++ CnsMin.EasyService  
++ EZ-Searching  
++ HotAndSexy  
++ GlobalWebSearch  
++ Grokster.Mayan  
++ SexOcean  
++ SuperSpider  
++ TopSearcher  
++ Unknown + I-Lookup + RapidBlaster  
+ SexArena + ShopNav + SubSearch" 
 
You can either download and install the new version: 
  
Spybot Search & Destroy 1.2  
(donorware - free, but you can donate if you wish)  
http://security.kolla.de/index.php?lang=en&page=download  
 
or, if you have already installed an earlier version of Spybot, start
it up and click "Search for Updates" (I think that this option is much
easier and quicker).

I hope that this additional information will prove useful to you!

Regards,

aceresearcher
Comments  
Subject: Re: IE highjacked by parasite ecpm.com
From: feilong-ga on 30 Apr 2003 15:44 PDT
 
Try applying the instructions given by our fine colleague,
aceresearcher, and see if it'll work for you:
https://answers.google.com/answers/main?cmd=threadview&id=188046

Important Disclaimer: Answers and comments provided on Google Answers are general information, and are not intended to substitute for informed professional medical, psychiatric, psychological, tax, legal, investment, accounting, or other professional advice. Google does not endorse, and expressly disclaims liability for any product, manufacturer, distributor, service or service provider mentioned or any opinion expressed in answers or comments. Please read carefully the Google Answers Terms of Service.

If you feel that you have found inappropriate content, please let us know by emailing us at answers-support@google.com with the question ID listed above. Thank you.
Search Google Answers for
Google Answers  


Google Home - Answers FAQ - Terms of Service - Privacy Policy