MrHop Adware Profile

MrHop is an especially nasty Browser Hijacker.  It is a Cool Web Search variant, and the operating file is often included in other Cool Web Search variant programs to attempt an unremovable infection.  There is no doubt that MrHop is one of the hardest adware programs to kill.

The particular mode of infection for MrHop includes resetting Internet Explorer’s search bar, home page, and search assistant to all point to MrHop’s home page through the  C:\WINDOWS\mrhop.dll/sp.html reference.  Along the way, it will change your desktop by causing it to be in error, disable your printer connection, disable shortcuts to some antispyware and antivirus programs, disable your RSS feeds, change your default search links and many other things that are signature symptoms of a Cool Web Search infection.

MrHop is difficult for many antispyware programs to kill because it makes it harder to open them and it generates a random CLSID when it registers itself as a browser helper object.  This also makes it difficult to manually remove, along with the fact that many of the registry changes it makes are obfuscated.

MrHop was created to be resilient.  Few antispyware programs are able to keep up with the mutations it makes.  It is also extremely difficult to manually remove.  We recommend ZookaWare PC Cleaner to remove this problem.  ZookaWare PC Cleaner’s updating techniques can more than keep up with MrHop’s disguises.

Associated Files:

R1 – HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\mrhop.dll/sp.html (obfuscated)
R1 – HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\mrhop.dll/sp.html (obfuscated)
R1 – HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\mrhop.dll/sp.html (obfuscated)
R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\mrhop.dll/sp.html (obfuscated)
R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\mrhop.dll/sp.html (obfuscated)
R0 – HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\mrhop.dll/sp.html (obfuscated)
R1 – HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 – BHO: (no name) – { randomly generated CLSID } – C:\WINDOWS\mrhop.dll

Download Free Scan
Cyberlab runs on Windows Vista, 7, 8 and 10. It has no ads, popups or bundled software and fully uninstalls by clicking Start > All Programs > select Cyberlab and click Uninstall.

Leave a Reply

Your email address will not be published.