C2.lop browser hijacker

If security settings of IE are low, the TeenSex dialer is installed without asking the user. If not, the every few clicks a message box will pop up asking to install the direct access (means dialer). The user can choose to set lop.com as his IE start page by clicking a link to the bottom.

c:\windows\application data\shchelyveest.dll

Reference: //www.lop.com/about.html