Lop.com & Comet cursor stay un-checked

Discussion in 'other security issues & news' started by Cajunbelle, Jun 17, 2005.

Thread Status:
Not open for further replies.
  1. Cajunbelle

    Cajunbelle Registered Member

    Joined:
    Jun 17, 2005
    Posts:
    7
    I just downloaded the newest version, 3.4 and even after uninstalling and getting another installation from a different mirror, I keep having the protection status show that IE has two items disabled: Lop.com & Comet cursor. Even after I check them and click to enable, I can watch the screen as the box becomes unchecked again. I have read through the files on this and others seem to have had this problem. I had never had this problem until I inadvertantly uninstalled the program with some others I had recently downloaded to try to get rid of the incescent and evil Lop.com toolbar. Even with SB running, it showed up. My status screen had always shown 0 items have protection disabled under IE, restricted sites, and Mozilla. I now show that IE protection is enabled, but to the right of that it states that the two items have protection disabled and nothing I can do seems to change that status. And I particularly lothe Lop.com. I also continue to run adAware, Spybot S&D, Zone Alarm, and AVG. I check updates 2 or 3 times per week for everything except Zone Alarm (they don't update as often and send a notice when they have a new version). I have a Dell loaded with XP home.

    From my reading, I cannot see where this problem was ever solved. Any help would be appreciated.
     
    Last edited by a moderator: Jun 17, 2005
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Hey Cajunbelle,

    I have split your post off into a thread of your own to offer better assistance.

    One question before getting deeper. Does this user have Admin rights on this XP machine ?
     
  3. Cajunbelle

    Cajunbelle Registered Member

    Joined:
    Jun 17, 2005
    Posts:
    7
    Yes, the user has admin rights on XP home. :D Since my original post, I have turned off the computer, and started back up. The same two items are showing as unprotected. (I noticed with other threads their list of unchecked items would change.) If you quickly scroll to the bottom of the items list and start going back up with the scroll bar, when you hit the Lop.coms and they have numbers in parentheses next to them, it's the Lop.com with no number next to it at the top of that "run". The Comet Cursors is just a little way above that and it is the one with (2) next to it. I checked both of them and clicked "protect against all checked items" and again, you can see the box become empty again. I don't know if it makes any difference, but the Lop.com is written in red until I check it and it turns black, but Comet Cursors (2) is written in black.
     
    Last edited: Jun 18, 2005
  4. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Something I forgot to ask earlier and without assuming wrongly again....the Comet Cursors (2) is a Cookie correct ? If so....is the Lop.com entry a cookie also ?

    Also....if you do not mind and feel comfortable in the registry....would you Please export the below History key and attach that .reg file as an attachment. In order to upload that file here....simply change the .reg to .txt extension so it will be allowed.

    Export the below key:
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History
     
  5. HD rider UK

    HD rider UK Registered Member

    Joined:
    Feb 16, 2005
    Posts:
    121
    Location:
    Gloucestershire, UK
    Cajunbelle
    can i ask if your friend has got Messenger Plus installed? The reason i ask is that i had a saw a similar problem with LOP which was installed along with Msgr+. The solution in that case was to uninstall messenger+ and spywareblaster, then reinstall spywareblaster and update it. Messenger+ was then reinstalled, this time without accepting its additional malware content. Dont know if this is any help to you, but it was justa thought.

    HDRiderUK
     
  6. Cajunbelle

    Cajunbelle Registered Member

    Joined:
    Jun 17, 2005
    Posts:
    7
    Apparently I am not subscribed to my own post thread! OMHeck! ! Sorry it has taken so long to respond. Yes, they are both listed as cookies. And this shows just what a total incomp I am, but I have no idea how to export the history. But I think I have what you want below:

    ~snip....Total list of cookies contained in the attached Canjunbelle.txt file below....Bubba~
     
    Last edited by a moderator: Aug 4, 2005
  7. Cajunbelle

    Cajunbelle Registered Member

    Joined:
    Jun 17, 2005
    Posts:
    7
    ~snip....Total list of cookies contained in the attached Canjunbelle.txt file:....Bubba~
     

    Attached Files:

    Last edited by a moderator: Aug 4, 2005
  8. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Hey Cajunbelle,

    I have combined the long list of cookies that you posted into that .txt file for ease of discussion. I'll post the layout that you posted only showing cometcursor.com and lop.com

    Spywareblaster displays them as:
    Comet Cursors (2) = cometcursor.com is shown in IE's Privacy\Managed Web Sites.
    Lop.com = lop.com is shown in IE's Privacy\Managed Web Sites.

    Key Name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\cometcursor.com
    Class Name: <NO CLASS>
    Last Write Time: 6/16/2005 - 11:51 PM
    Value 0
    Name: <NO NAME>
    Type: REG_DWORD
    Data: 0x5

    Key Name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History\.lop.com
    Class Name: <NO CLASS>
    Last Write Time: 6/11/2005 - 10:06 PM
    Value 0
    Name: <NO NAME>
    Type: REG_DWORD
    Data: 0x5
    ==================================================

    Let's try something Please.

    If you are using Spybot....Please go into that program and undo it's Immunization feature temporarily and then close Spbot down.

    Then....with all Internet Explorer Windows closed....open Open Spywareblaster and in the top section next to the Status tab....select the Internet Explorer tab. Then un-check the little box next to Prevent ad / tracking cookies....then select Remove protection for un-checked items in the bottom corner. Close Spywareblaster and open a Internet Explorer Window. Then select Tools\Internet Options\Privacy tab....then the Edit button bottom right corner. What Managed Web Sites are listed....and what is their setting....Always Allow or Block ?

    If their is still a long list of them....We may have to temporarily un-Immunize Spybot's protection and repeat what I just instructed.
     
  9. Cajunbelle

    Cajunbelle Registered Member

    Joined:
    Jun 17, 2005
    Posts:
    7
    I went through your instructions. I don't usually use IE (love Mozilla--in fact I have done everything I know how to force my kids to also use Mozilla rather than IE) but I opened an IE window and got all the way to" ...then the Edit button bottom right corner." Don't have that, but did have a SITES button on the left, so I clicked that and it was headed "Managed Web Sites" so I assume it's the same. There were only 4 sites listed:

    adultdvdexplore.com Block
    adultfilmdatabase.com Block
    aol.com Allow
    cnet.com Block

    I can add or delete/allow or block additional sites on that tabbed page. Now what? Can I turn Spybot S&D back on? Do I need to do something with SpywareBlaster first?
     
  10. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    My bad....I forgot about XP :( Yes....that is the Sites button.

    What that confirmed to me was....this does not appear to be a Spywareblaster problem.

    That does not mean we can not continue. If you would....open only one IE Window and do what you did earlier....in regards to the steps below.

    Windows XP SP2 users

    1. Open Internet Explorer.
    2. Go to the Tools Menu.
    3. Select the Internet Options Menu.
    4. Select the “Privacy” tab. (see below)
    5. Click the “Sites” button

    Once there....add www.cometcursor.com

    7. The website address should now appear in the “Managed Web Sites” box.
    8. Click “OK” on the “Per Site Privacy Actions” window.
    9. Click “OK” on the Internet Options window.
    10. Close that IE browser window and then re-open a IE browser Window.

    Is that Cometcursor entry still there ?

    Please do not turn Spybot back on just yet.
     
  11. Cajunbelle

    Cajunbelle Registered Member

    Joined:
    Jun 17, 2005
    Posts:
    7
    You said to "add www.cometcursor.com" but you didn't say whether to add by allowing or blocking--so I clicked block. Closed out like you said and then re-opened an IE window (and the defalt on IE has a pop-up window blocker on by the way) and went back into the "Managed Web Sites" and cometcursor is NOT listed. I even tried by adding without the www. at the front since my listed sites don't show the www.--just aol.com, etc. Didn't work that way either. Spybot is still off.

    I noticed that in SpyBlaster, it is only the Internet Explorer that usually shows the 2 sites not enabled. Restricted sites and Mozilla/Firefox usually show no troubles. The cookie list under the Mozilla/Firefox protection show Lop & Cometcursor checked and protected against. It is usual to protect one browser and not another?

    Let me know the next step.
     
  12. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Sorry....I assumed wrongly....I thought it was understood that we are attempting to Block cookies :doubt:

    In any case....by doing what we just did....that further confirms what I mentioned earlier....in regards to Spywareblaster not being part of this problem.

    The cookie protection storage location is different in regards to where each browser maintains info concerning Allow or Blocked cookies. Internet Explorer stores that info in a certain location of the registry....and when we enable cookie protection in Spywareblaster....it stores the cookie protection in that same location.

    This registry key:
    HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History

    Other browsers like Mozilla\Firefox store their cookies in a folder....not the registry....which is why you are not experiencing problems seeing Lop or Cometcursor in regards to Spywareblasters Mozilla/Firefox protection.

    The problem you have is that some application is preventing you from adding Lop and Cometcursor to the registry in the proper Internet Explorer location. What that application We do not know yet.

    I'm going to take a shot and assume for a moment that it might be Spybot. Would you open Windows Explorer and locate the following Excludes folder.

    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Excludes

    In that folder....if there is a file by the name of RegKeyWhite.sbe....right click that file and select Open With ....then select Notepad. Please Copy\Paste all the info contained to a new post Please.

    If there is no RegKeyWhite.sbe file ....We or You are then going to have to figure out which of your programs....besides Spywareblaster....is not letting you Block those sites via IE nor Spywareblaster :doubt:
     
  13. Cajunbelle

    Cajunbelle Registered Member

    Joined:
    Jun 17, 2005
    Posts:
    7
    Found the Excludes folder but no RegKeyWhite.sbe file. I even did a C:/ search for that file and got no results. The files in the Excludes folder include:

    Bots
    FileExt
    Single
    UpdateDL
    Cookies
    Links
    SystemInternals
    WaitFor

    Folders in the Application Data include
    Adobe
    Avery
    Dell
    Grisoft
    InstallShield
    QuickTime
    SecTaskMan
    Viewpoint
    DESKTOP (Configuration Settings)
    AOL
    AVG7
    DVD Shrink
    GTek
    Microsoft
    SBSI
    Spybot - Search & Destroy
    Warn Mail Flap Logo

    Where do I go next?
     
  14. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    "If there is no RegKeyWhite.sbe file ....We or You are then going to have to figure out which of your programs....besides Spywareblaster....is not letting you Block those sites via IE nor Spywareblaster"

    Since this is not a Spywareblaster issue....I will be moving the whole thread to a more appropriate Forum later in hopes that others may assist you. In the meantime....the best I can offer....is you need to take a close look at all of your Security/Privacy programs being used....and attempt to figure out which one of those programs is preventing this action.
     
Thread Status:
Not open for further replies.