Spyware, Viruses, & Security forum

General discussion

Anyone know a name for this new Internet Explorer Pest?

by R. Proffitt Forum moderator / December 31, 2004 5:56 AM PST
Discussion is locked
You are posting a reply to: Anyone know a name for this new Internet Explorer Pest?
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Anyone know a name for this new Internet Explorer Pest?
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Has NOT a "special" name, yet - as
by Marianna Schmudlach / December 31, 2004 7:28 AM PST

it can be cleaned in HJT.

Most of the time it's IN the R1 and R0, 02, 04 and 09 entries.

Have a look here:


there are MORE "ugly heads" running around like the new VX2 variant and the Goologic exploit !! Yikes !

Collapse -
Am I reading this right?
by MarkFlax Forum moderator / December 31, 2004 8:05 AM PST

Is this a pest that "just" replaces the current desktop wallpaper image with a new one? And the new one has images of icons instead of real icons?

Or is there more to it than that?

I can see that the pest needs removeal, and HJT is needed to do this, but is that how the pest is recognised?


Collapse -
"unwanted icons"
by Marianna Schmudlach / December 31, 2004 8:20 AM PST

is what I read out of the HJT logs which can NOT be removed.

Here is a different HJT log - look at the R1,02 - this "darn" eSyndicate" is something "new" too.
then look at these entries:

O4 - HKLM\..\Run: [FafLN] C:\documents and settings\user\local settings\temp\FafLN.exe
O4 - HKLM\..\Run: [ex9Ig6] C:\documents and settings\user\local settings\temp\ex9Ig6.exe

these this "temp.file stuff" ??

Here is the thread: http://castlecops.com/postt95932.html

Collapse -
Thanks Marianna
by MarkFlax Forum moderator / December 31, 2004 8:28 AM PST
In reply to: "unwanted icons"


Collapse -
Mark, You're Welcome and Happy New year ;)
by Marianna Schmudlach / December 31, 2004 8:36 AM PST
In reply to: Thanks Marianna
Collapse -
Here's some info Bob
by Tufenuf / December 31, 2004 8:03 AM PST

Bob, The mystery of the undeletable desktop icons is Messenger Plus!. I frequent many other forums and many are experiencing this problem. There are 2 ways to get rid of it which it is indeed the old "lop" spyware. Here's a link where you scroll down to "How do I uninstall one of your software products?" then at this line "- Additionally a separate universal uninstall program may be downloaded here" download & run the "new_uninstall.exe"


The second way to get rid of it is at the link below under:

"Rumor: once installed, the sponsor program is extremely hard to remove"

"There is only one procedure to uninstall the sponsor: open the Add/Remove Programs panel, select "Messenger Plus!", click on the "Uninstall" button and follow the instructions displayed by C2Media's uninstaller program. That's all".


Note: Both ways will get rid of the undeleteable icons.

Happy New Year,

Collapse -
Not "quite" correct !
by Marianna Schmudlach / December 31, 2004 8:16 AM PST
In reply to: Here's some info Bob

If there is NO Messenger PLus on the computer it is NOT Lop what has to be removed. In case of Messenger Plus YES - you have to remove Lop as it is installed with the "sponsor ".

Messenger Plus is an add-on. It is not written by Microsoft. It installs spyware. LOP to be exact. You installed the Sponsor and you have spyware as a result.

If it is still there. You need to uninstall it and then if you still want to use it, then reinstall and choose not to install the Sponsor.

First uninstall Plus via Add\remove

And now we have to uninstall the spyware it added.

Go to Add/remove programs and remove:
"Window Search" and *Win Tools*
You will be given a security code to insert, do so
And reboot when done.

If not there then use these two uninstallers:


Sometimes the lop.com site doesn't work. Here's a mirror site for both the toolbar uninstaller and the main uninstaller.


Collapse -
Thanks Marianna and
by Tufenuf / December 31, 2004 8:23 AM PST
In reply to: Not "quite" correct !

Just about all of the people at the other forums that had the icon problem had Messenger Plus! installed and used the "new_uninstall.exe" to get rid of the icon problem. Thanks for the extra info and I agree that people should read more closely prior to installing some programs.

Happy New Year,

Collapse -
Tufenuf - You're Welcome ;)
by Marianna Schmudlach / December 31, 2004 8:35 AM PST
In reply to: Thanks Marianna and

did you have a look at the links I posted?? NO MessengerPlus in it at all - these "unwanted icons" are coming up more and more.

Happy New Year to you too Happy

Collapse -
Thank you for the replies.
by R. Proffitt Forum moderator / December 31, 2004 8:43 AM PST

It's been reported across Windows 98, ME, 2000, XP and the common item is when I ask them if they use "just Internet Explorer".

Whatever I'm removing, it appears to crawl in via IE. I'm a little fed up with IE's open door policy.


Collapse -
Marianna, Checked out the links and
by Tufenuf / December 31, 2004 9:03 AM PST

The link below that you posted in a previous reply the poster(ashttbg) had Messenger Plus! under Running Processes:
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"


Is this madness ever going to end? LOL


Collapse -
LOL - I just had another one with MessengerPlus in it
by Marianna Schmudlach / December 31, 2004 9:26 AM PST
Collapse -
Thank you both...
by glenn30 / December 31, 2004 8:40 AM PST
In reply to: Thanks Marianna and

For clearing up what sometimes is misunderstood about Messenger Plus and the culprit Sponsor. It does pay to read the "fine print" but it is plainly there when installing the software. As in many things "the devil is in the details". Wink

Happy New Year!


Collapse -
no such thing as Messenger Plus as written by Microsoft.
by dawillie / December 31, 2004 2:04 PM PST
In reply to: Thanks Marianna and

ergo anybody who downloads the crappy so called add -on, is only asking for trouble.

take it out.

Collapse -
by R. Proffitt Forum moderator / January 1, 2005 8:22 AM PST
Collapse -
Yep - is also "something new" - Google already
by Marianna Schmudlach / January 1, 2005 8:43 AM PST
Collapse -
IE has too many uncertainties in regards to security
by omerta2177 / January 1, 2005 10:32 AM PST

I switched to Mozilla Firefox 1.0 and have never been happier. I am sure you already know this but I am just so happy with it that I wanted to share it with everyone!! Happy New Year...I think IE is being fazed out by competitors.


Collapse -
At SWI they call it now "LOP 2.0?"

They are now also getting lop infections though there is NO MessengerPlus !!!!!!

Stay tuned LOL

Popular Forums
Computer Newbies 10,686 discussions
Computer Help 54,365 discussions
Laptops 21,181 discussions
Networking & Wireless 16,313 discussions
Phones 17,137 discussions
Security 31,287 discussions
TVs & Home Theaters 22,101 discussions
Windows 7 8,164 discussions
Windows 10 2,657 discussions


Your favorite shows are back!

Don’t miss your dramas, sitcoms and reality shows. Find out when and where they’re airing!