1. MYSEARCHNOW REMOVE TOOLBAR TUTORIAL
On line help to remove the blue toolbar MYSEARCHNOW from LOP. We are trying to provide clear instructions in details, and easy steps to follow to remove toolbar. As this is free toolbar removal tutorial, we will appreciate your donation through Paypal
But in the mean time, here is what you could get from my tutorial: REMOVAL MYSEARCHNOW TOOLBAR
Item Title: Tutorial - Mysearchnow Remove Toolbar
This blue LOP toolbar goes back as far as August 2003. LOP means (live on portal), we can help you or remove it for you!
IT IS A POWERFUL SPYWARE THAT LOOKS AT WHAT YOU HAVE ON YOUR PC ALL THE TIME AND SELL IT TO OTHER COMPANIES, EMAIL, LINKS, ETC. MESSENGER PLUS 2! (PATCHOU) IS SPONSORED BY C2MEDIA AND LOP. IT COLLECTS DATA USING COOKIES, YOU ARE WATCHED ALL THE TIME ON WHAT YOU TYPE, READ, THAT'S WHY THE SUBJECT ON EACH OF THE BUTTONS ON TOOLBAR MYSEARCHNOW ARE CHANGING ALL THE TIME. BY LOOKING AT MY STATS, I BELIEVE THAT ALMOST ALL THE COUNTRIES IN THE ENTIRE WORLD GOT HIT.
1. You can try to remove it by doing right click on the toolbar of myseachnow, and uncheck the weird file name. But it will start again! This is where this gets frustrating. And the smoke is coming out of your ears! How will I get ride of this nasty thing from LOP ?
2. You, more than likely, got it when trying to upgrade MSN Messenger 5.0 to MSN Messenger 6.0 but you got Messenger Plus! 2 made by Patchou. This is the non official version of MSN MESSENGER 6.0. A strange coincidence that the real MSN Messenger was coming out two weeks later... This was free because they use the sponsor LOP! In other words you got Hijack without your permission from both mysearchnow and Patchou!!! On the internet, there is lots of articles talking about Patchou. All of this was good timing for them, it was time for your to upgrade your MSN Messenger version, and they took advantage of it, that's it!
3. Don't try to remove it by doing "start/control/settings/add remove programs" because it does not work. You will never find a program there.
4. An important thing that does not work at all: do not try to go to lop.com and choose the uninstall.exe because it is totally useless. Don't send them an e-mail because they will never reply!
5. Don't try to remove the blue toolbar MYSEARCHNOW by doing "start/control/settings/add remove programs" because you will not find anything in there!
6. LOP is using different methods to generate different file names, different key registry in each of their attacks to us, making it very difficult to tell someone which files need to be removed, get the whole picture! So everybody gets more or less the same pattern, beside file names, folder names, and this task becomes more difficult, challenging.
7. I have been able to remove both of them but it is a lot of work, you may want to re-format your whole hard drive, then you will get ride of it.....But before you do, save your important files on CD Re-writable with CD Writer (CD Burner).
8. Here is what they did, I believe : ( the "......." are my comments )
O2 - BHO: (no name) - {efa1a3dd-bab9-4ceb-a46d-f7ffb70f21a3} - C:\DOCUME~1\username\APPLIC~1\slyssplevrr.dll
.......... lop inserting files and folders in your application data
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
......... LOP is trying to screw up your system files.
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
......... May be Norton Antivirus, tried to catch it ?
O3 - Toolbar: wnytrruii - {d5a32358-3f36-4683-aa38-1d791699d85f} - C:\DOCUME~1\username\APPLIC~1\slyssplevrr.dll
......... The MYSEARCHNOW toolbar is installed, damn! The random name is created, could be "wnytrruii" as example.
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
........ Now, LOP is installing your Messenger Plus! 2. This is not an official version of MSN MESSENGER.
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
........ Norton Antivirus, is trying to catch it?
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
........ LOP wants to overwrite your Media program, could be ACDC, or anything else that opens pictures. Now every time you want to see picture, Quick Time opens it, not your favorite program. Grrrrr! LOP installs a Quick Time version (modified or not, I do not know).
O4 - HKLM\..\Run: [qcrdrp] C:\DOCUME~1\username\APPLIC~1\zlubnxyee.exe -QuieT
........ LOP Quick Time version is now installed. Grrrrrrrr!
9. Delete the suspicious folder named "Games" in your IE bookmarks.
10. On your desktop, right click on Start button, click open, click on "Programs", look for folder "Messenger Plus 2!", delete it.
11. On IE Page, click on "tools" button from top toolbar.
Select "Internet Options" ;
In "General/" folder, go in Home Page: change address from
http://www.mysearchnow.com
to what web site you were used to have before you got Mysearchnow, i.e. as example : http://www.yahoo.com
Click "apply" button ;
on that same page, we just want to do some clean up, so in "Temporary Internet Files" section,
Click "Delete cookies"
Click "Delete files" in "History" section, keep days to keep at about 7 days,
Click "clear" history. Now you can close the page.
12. If you do not like Quicktime, just delete the program that is located
Start/Programs/QuickTime. I am not sure if LOP did modify it or not.
13. Now, it is time to remove the weird file name you tried to remove in doing the right click on that mysearchnow toolbar.
Here is the easy way to do remove it, you can go to:
C:\WINDOWS\Profiles\your name\Application Data\mozilla\profile\default", or
C:\WINDOWS\Application Data\mozilla\profile\default",
in there, there is a lot of funny files names, ending by extension .dll. and a folder named "chrome".
Also, a file name ending with extension .slt is the one that make their Search ToolBar appearing on your Internet Explorer page.
Delete the folder "default", delete the folder "profile",
Delete the folder "mozilla".
14. By the way, MYSEARCHNOW got also in Netscape but it is not so visible,
the folder is "c:\program files\netscape\netscape6\defaults\profile".
You find like IE a chrome folder too in there.
Useful hint, uninstall your Netscape program in doing this from your desktop
"START/SETTINGS/CONTROL PANEL/ADD REMOVE PROGRAMS",
and look for NETSCAPE program, remove it. You can always re-install it later if you want by going to Netscape web site and download it again.
15. Also, you need to remove LOP and Messenger Plus! 2 by Patchou from your registry, it is a fake Messenger version not an upgrade from MSN Messenger 5.0.
16. In case that Messenger Plus 2! is still there, you have to uncheck it by following this procedure : on your desktop
START/PROGRAMS/ACCESSORIES/SYSTEM TOOLS/SYSTEM INFORMATION/TOOLS/SYSTEM CONFIGURATION UTILITY
Go to start up, "UNCHECK" MessengerPlus2, then click "APPLY".
17. NOW THE MORE TECHNICAL STUFF I.E. YOUR WINDOWS REGISTRY.
You have to edit your Windows registry editor or USING NORTON SYSTEM WORKS:
HERE IS THE PATH:
NORTON SYSTEM WORKS/NORTON UTILITIES/REGISTRY MANAGEMENT/NORTON REGISTRY EDITOR
Click on the icon of NORTON REGISTRY EDITOR, click CONTINUE.
Now you see LOCAL REGISTRY, and you have to look in the four different paths :
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search
The following is what you have to do in each ones:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main
You should now see
Search Bar do right click on default value icon,
click "Modify" than erase it, write :
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Click "Apply".
Search Page do right click on default value icon,
Click "Modify" than erase it, write :
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Click "Apply".
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search
the default value of Search should be blank, if you have
http://www.mysearchnow.com, do right click on default value icon,
Click "Modify" than erase it, then click "Apply".
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Look for "Start page" and you will see that http://www.mysearchnow.com is no longer there and was replaced by what you wrote as web site as example, http://www.google.com . Remember you did this, just changed it with IE page on Tools button, Internet Options, then Home page.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Search
if you see http://www.mysearchnow.com in the default value, you have to erase it. To do it, just do right click, modify, erase http://www.mysearchnow.com , than apply.
Now, mysearchnow toolbar should be removed.
##############
To conclude, we hope that this information could have been useful to you.
I know it is not an easy task to remove the LOP Toolbar / MYSEARCHNOW toolbar, it can vary for different operating systems such as Windows 98, NT and XP. And if you have Messenger Plus 3! with the add-ons.
Now, mysearchnow toolbar should now be removed.
Conclusion, hope that this information could have been useful to you.
I know it is not an easy task to remove the LOP Toolbar / MYSEARCHNOW toolbar, it can slighly vary for different operating systems such as Windows 98, NT and XP.
After doing all these instructions, you should have removed toolbar mysearchnow.
By the way, it is possible that the toolbar removal instructions could differently be removed for Messenger Plus 3!
Top of Page
|
