I-Lookup Description:

I-Lookup is homepage hijacking program that changes the IE homepage and search pages resulting in many pop-up ads. It will also add bookmarks to the Favorites menu in IE and in most cases a toolbar as well. It run by a company called Aztec Marketing SA in San Jose, Costa Rica. I-Lookup also may set the homepage to globalwebsearch.com in some versions. All appear to be installed by an ActiveX download.

Since the first writeup of this page in May, 2003 there have been several variations of I-lookup.com that have appeared:

ILookup/Abeb     Uses abeb.dll and sets homepage to superwebsearch.com

 

ILookup/Bmeb    Uses bmeb.dll and sets homepage to traffichog.com

 

ILookup/Chgrgs  Uses chrgrs.dll

 

ILookup/Drbr      Uses drbr.dll and sets homepage to globaltoolbar.com

 

ILookup/Gws      Uses gws.dll and sets homepage to globalwebsearch.com

 

ILookup/Ineb     Uses ineb.dll and sets homepage to i-lookup.com

 

ILookup/Sbus     Uses sbus.dll and sets homepage to searchbus.com

I-Lookup Automatic Removal:

Using Spyware Doctor to detect and remove I-Lookup AUTOMATICALLY!

I-Lookup Manual Removal:

1) Remove the Active X component (may have to be done in Windows Safe Mode)

• Double-click on the "Downloaded Program Files" folder in the Windows folder
• Right click on
  • I-Lookup.com Bar or toolbar (Abeb and Ineb variants)
  • GlobalWebSearch.com Bar (Gws and Chgrgs variants)
  • GlobalToolbar.com (Drbr variant)
  • Search Bar (Bmeb variant)
  • SearchBus.com (Sbus variant)
• Click on Remove and delete the file

2) Open a Dos prompt

• For Windows 95/98/ME, click on Start, Run, and Type COMMAND and Click OK
• For Windows XP/2000, click on Start, Run, and Type CMD and Click Ok

3) Unregister the offending DLL file by typing the following lines at the DOS Prompt (pressing Enter after each line)

Abeb variant

cd "%WinDir%\System"
regsvr32 /u abeb.dll

Bmeb variant

cd "%WinDir%\System"
regsvr32 /u bmeb.dll

 

Chgrgs variant

cd "%WinDir%\System"
regsvr32 /u chgrgs.dll

Drbr variant

cd "%WinDir%\System"
regsvr32 /u drbr.dll

Gws variant

cd "%WinDir%\System"
regsvr32 /u gws.dll

 

Ineb variant

cd "%WinDir%\System"
regsvr32 /u ineb.dll

Sbus variant

cd "%WinDir%\System"
regsvr32 /u sbus.dll

Type EXIT and Press Enter to close the DOS prompt

4) Reset Web Settings in Internet Explorer (homepage and search page)

• In Internet Explorer, click on Tools, Internet Options
• Click on the Programs tab
• Click on Reset Web Settings

5) Remove Registry Entries

• Click on Start, Run, and type REGEDIT and click OK
• Click the pluses(+) next to
  • HKey_Current_User
  • Software
• Right Click on the Ineb folder and click Delete

Lastly, use a spyware removal program to clean up any bits and pieces left from the infection. The freeware program I would recommend would be Spyware Doctor Search and Destroy, an excellent ,and always up-to-date, spyware removal program. Download the software,  run their internet update to get the very latest spyware definitions, then use it to search and remove any spyware lurking on your computer.

More Removal Instructions for Adware/Spyware Programs - 'I'