What is Open Search Web or Lop.com?

Open Search Web is a search portal created by the makers of Lop.com. It sets your homepage to one that looks similar to the image below, adds tons of items to your favorites folder and takes over your computer. This hijack is a few years old, but still very popular.

How Do I Know If Open Search Web or Lop.com is on my Computer?

If you have been infected with Lop.com, your homepage will change to one similar to this:

opensearchweb (lop.com)

There are more than 70 known portal sites for Lop.com including but not limited to the following domains:

  • aavc.com
  • acjp.com
  • active-max.com
  • allaboutsearching.com
  • amazingautosearch.com
  • contexualsearch.com
  • ebvr.com
  • ecmh.com
  • ecpm.com
  • find-quick.com
  • ibmx.com
  • icwb.com
  • icwo.com
  • icwp.com
  • iddh.com
  • idhh.com
  • ifiz.com
  • iguu.com
  • look-today.com
  • lop.com
  • mysearchnow.com
  • netsearchsoft.com
  • ohyea.org
  • omegasearch.com
  • prosearching.com
  • saoe.com
  • sbnl.com
  • sbnt.com
  • sbvr.com
  • sckr.com
  • scrk.com
  • search200.com
  • searchexe.com
  • searchweb2.com
  • searchwebnow.com
  • sfux.com
  • tdak.com
  • tdko.com
  • tdmy.com
  • tefs.com
  • tfil.com
  • tjar.com
  • tjaw.com
  • tjem.com
  • tjgo.com
  • wabq.com
  • wabu.com
  • wfix.com
  • wflu.com

If you use HijackThis create a logfile, you'll notice the following types of entries (although not exactly the same). Most will have a 04 entry pointing to an Application Data directory with a file there and possibly a Browser Hijack Object or BHO file with the corresponding 02 entry.

O2 - BHO: (no name) - {ECB8B044-33B5-CDA2-ACD2-9C071C83ADE6} - C:/DOCUME~1/RIKKEF~1/APPLIC~1/ADMINB~1/Aim idle.exe

O4 - HKLM\..\Run: [DupeIsoLessMp3] E:\Documents and Settings\All Users\Application Data\foroptiondupeiso\Site save.exe
O4 - HKLM\..\Run: [rdrownswindowboob] C:\WINDOWS\Application Data\Site About Rdr Owns\01 aim.exe
O4 - HKLM\..\Run: [Gpl Aim] C:\PROGRA~1\ARMYDE~1\16 sect.exe
O4 - HKLM\..\Run: [Mail Bias Vc Delete] C:\WINDOWS\All Users\Application Data\Memo Four Mail Bias\2 tick.exe
C:\Documents and Settings\All Users\Application Data\settings each blah about\Ballsect.exe
O4 - HKLM\..\Run: [ bytecitybookjugs ] C:\Documents and Settings\All Users\Application Data\scr support byte city\32 The.exe
O4 - HKLM\..\Run: [Corngrim01itch] C:\Documents and Settings\All Users\Application Data\Audio Phone Corn Grim\32 Time.exe
O4 - HKCU\..\Run: [ARMY BASH] C:\DOCUME~1\Owner\APPLIC~1\PLATFO~1\Junk 32 glue.exe
O4 - HKLM\..\Run: [Axis Camp] C:\PROGRA~1\OnlineExtraView\4ShowTick.exe
O4 - HKLM\..\Run: [FaceMediaToolCdrom] C:\Documents and Settings\All Users\Application Data\global joy face media\64clock.exe
O4 - HKCU\..\Run: [Tora] C:\Documents and Settings\K.Joseph\Application Data\aamo.exe
O4 - HKLM\..\Run: [That Program Ooze Bib] C:\Documents and Settings\All Users\Application Data\downloadkeepthatprogram\Acid Blue.exe
O4 - HKLM\..\Run: [Scr Four Noun Heart] C:\Documents and Settings\All Users\Application Data\WaitHopeScrFour\acid store.exe
O4 - HKCU\..\Run: [idolmixantemanager] C:\Documents and Settings\All Users\Application Data\shim online idol mix\active bone.exe
O4 - HKLM\..\Run: [rulegreat] C:\PROGRA~1\HtmTick\File active mp3.exe
O4 - HKLM\..\Run: [sendtonsstylebits] C:\WINDOWS\Application Data\Bait Funk Send Tons\aim mapi.exe
O4 - HKLM\..\Run: [LOVEEACHDRIVETIME] C:\Documents and Settings\All Users\Application Data\atom mpeg love each\Aim readme.exe
O4 - HKCU\..\Run: [Interwin] C:\DOCUME~1\CBrown\APPLIC~1\CREATI~1\Amen gram.exe
O4 - HKLM\..\Run: [Metameetmessabout] C:\Documents and Settings\All Users\Application Data\pure dumb meta meet\amen mapi.exe

Most HijackThis logs will also have the offending domain placed in the R entries like so:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://thko.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://thko.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=thko.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://thko.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://thko.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://thko.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant=http://thko.com/searchbar.html

Other possible HijackThis entries may be listed similar to the following

O17 - HKLMSystemCCSServicesTcpipParameters: Domain = allaboutsearching.com
O17 - HKLMSoftware..Telephony: DomainName = allaboutsearching.com
O17 - HKLMSystemCCSServicesTcpip..{D196AB38-4D1F-45C1-9108-46D367F19F7E}: Domain = allaboutsearching.com

How Do I Remove Open Search Web (Lop.com)?

Although Open Search Web and its variants can be removed manually, the variations of file names, locations, etc. make it hard to create a straight forward manual approach to remove it.

Lop.com used to host an uninstaller to remove the infection, however since this is an older hijacker, Lop.com is no longer in business and the domain does not exist anymore. If you find yourself infected with a similar homepage hijacker I would recommend downloading MalwareBytes Anti-Malware or Combofix. They should definitely be able to clear the infection for you.
Written by Mark Hasting

Links to Other Important Information

Support for Windows XP and Windows Vista without latest service packs ends in 2010

How to Fix 500 Internal Server Error in PHP 5.4 script

Computer shows Stop error and Continously Reboots after SP3 installed.

Product Key Does Not Match Current Windows SKU Error

Review of FastAgain PC Booster and How to Uninstall it

How to Remove MSBLAST.EXE worm

How to Remove Content Advisor Password in Internet Explorer

How to Fix Google Chrome not Opening Web Pages or Settingsnew

How to Remove Incredimail Automatically

How to Fix Problem of Limited or No Connectivity After installing Windows XP Service Pack 2

How to Recover From a Corrupted Registry in Windows XP

How to Speed Up Windows Boot Time

Acer ERecovery Service is Not Available

Acer Recovery CD Restore Failed Reason: 0xf0000051

How to Fix Problem with No Active Mixer Devices Available in Windows XP

Parents Guide to MySpace.com - a report every parent should read

Save and Restore Desktop Layout of Icons

What is Windows Genuine Advantage and How to Overcome Problems With It

Change Forgotten Administrator Password in Windows XP/2000/Vista

Not Enough Server Storage Error When Connecting to Computer on Network

Installing Windows Vista Upgrade on a Blank Hard Drive

How to Delete Your Windows Vista Logon Password

Remove Unwanted Icons from the Windows Vista Welcome Center

Cannot Connect to Network Printer with Windows Vista

How to Wipe, Delete, Degauss, and Destroy Data on a Hard Drive

Fixing RTHDCPL.EXE - Illegal System DLL Relocation Error in Windows XP

How to Fix Blank or Missing Title Bar in IE9

Unable to Open New Tab in IE9 - Spinning Favicon

Fix 404 Errors for /apple-touch-icon-precomposed.png and /apple-touch-icon.png

What is the Config.Msi folder and Can I Delete It?

Flash Player Installation Issues

How to Set Yahoo Mail as your Default Email Program

Unknown File in Winsock LSP - NWPROVAU.DLL - Can it be Removed?

How to Delete a Service in Windows Vista

How to Disable the On-Screen Keyboard in Windows Vista

Make Disk Cleanup Run Faster

What is CTFMON.EXE and How Can I Remove It

How to Export MSN Favorites to Internet Explorer

How to Fix Registry Editing Has Been Disabled By Your Administrator Error

How to Change Default Editor in Windows and Fax Viewer

How to Fix Problem when Windows Security Center reports multiple antivirus programs installed

How to Fix Problem when Windows Updates will download but will not install

How to Fix Problem when Windows Automatic Updates Service wont Start

Cannot Download Files With Internet Explorer

How to Keep Your Computer Up-to-Date

How to Fix the Prompt for Click to Run an ActiveX Control on this webpage

How to Remove "This Page Contains Both Secure and NonSecure Items" Warning Message

How to Fix Problem with Blank Add/Remove Control Panel

How to Fix Windows Vista Update Error 80244019

Troubleshooting An Error Occurred During Directory Enumeration

How to View and Decipher Minidump files created by Blue Screen error messages

How to Fix BLService Error on HP Computer in Vista

Google Adsense Hijacking - How to Respond

Windows Defrag Does Not Complete

Review of BigString Recallable Email

Fix Incorrect Time Stamp on Hotmail Messages

Deleting or Editing Typed URLs in the Internet Explorer Address Bar

Belarc Advisor - Quick Computer Inventory Software

How to Get Out of Full Screen Mode in Internet Explorer

How to Correct Missing "Copy to CD" option in My Pictures Tasks

How to Fix Code 39 error with CD or DVD Drive

How to Fix Problems When Windows Installer Popups Error With Missing .MSI Files

How to Fix Problems When Network Setup Wizard and Network Connections Won't Open

How to Fix Problems with Windows Help Errors

How to Delete Individual Entries from Run Command History

Foxit - Adobe Reader Alternative

How to Fix Autochk Program Not Found error

Difference between Master/Slave and Cable Select on a Hard Drive

How to Use Microsoft SyncToy to backup your important files

How to Delete Temporary Internet Files, Cookies, and History files

Review of PCDecrapifer Software Removal Tool

How to Fix Security Flaw in Adobe Reader

Computer Speakers Sound like Chipmunks

How to SVCHOST.EXE Application Error 0x745f2780

Troubleshooting the Unmountable Boot Volume Error in Windows XP

How to Disable, Uninstall, and Remove Windows Messenger instant messaging from Windows XP

How to Remove Windows Messenger in Windows XP

Free DVD Decoder Software and Help

Free CD Burning Software and Help

How to Use Remote Desktop to Access Multiple Computer on Your LAN

HijackThis Tutorial for removing Spyware

Review of Adsense Detective, Getting Stats and Results from Adsense

How to Disable System Restore in Windows ME or Windows XP

How to Uninstall Internet Explorer 7

How to Install NetBEUI in Windows XP

What is the KB891711.exe file in Windows 98 or Windows ME?

How to Troubleshoot and Solve USB Device Error Code 10

Spooler Subsystem App has encountered a problem and needs to close Error and How to Fix it

How to Fix Problem opening Microsoft Outlook

How to Disable News Headlines in Netscape

How to Bring Back Missing Folders in Netscape Communicator

How to Fix Access Denied Error when Using MSCONFIG

How to Fix HPQKBFiltr.Sys Keylogger Error in Kaspersky Antivirus

How to Backup and Restore Outlook Express Mail, Address Book, Blocked Senders List and other Settings

How to Fix Error 501 Permission Denied when changing fonts in Outlook Express

What is the Tilde (~) File on my Desktop?

What is the thumbs.db file and can I remove it

Password is Not Saved in Outlook Express or Outlook in Windows XP

Allow Viewing of Attachments in Outlook Express 6

How to Fix Problem of No Spell Check in Outlook Express

How to Fix Problems Viewing or Accessing Secure Web Sites

How to Start or Boot Windows into Safe Mode

What is the Winmail.dat file attached to emails?

How to Correct Unreadable Fonts in Norton Antivirus or Norton Systemworks

How to correct issue with No Visible Menu Bar or Tabs in Windows XP Task Manager

How Disable/Enable the Windows XP Welcome Screen

How to Fix RTLGINA2.DLL error with Windows XP Welcome Screen and Netgear WG111

How to Fix Windows Update Error 0x80070420

PopUp Ad Removal Software and Help

Review of ErrorNuker program to identify and fix problems with the Windows Registry

Spyware and Adware Removal Help

Review of Netflix Online DVD Rental

Recommended Software for PC Hell Visitors