Description

Like CoolWebSearch and Huntbar, ILookUp (Begin2Search; GlobalWebSearch; SearchBus; Spidersearch; TrafficHog; ILookUp/Abeb; and variants, including ILookUp/B2s, ILookUp/Dsktrf, ILookUp/GWS, and ILookUp/Windec32) is a browser hijacker that resets the start and search pages in Internet Explorer. It also adds bookmarks to the Favorites menu, a search field to the browser toolbar, and targeted pop-up ads—especially porn pop-up ads—to the Desktop.

An ActiveX control, ILookUp installs itself on your system when you visit any Web site affiliated with Aztec Marketing SA.

How To Tell If ILookUp Is Present On Your System

You'll see the appearance of the ILookUp toolbar in the browser window, and ILookUp may redirect the browser start page to Begin2search.com, Globaltoolbar.com, Globalwebsearch.com, I-lookup.com, Isearch.com, Searchbus.com, Spidersearch.com, Superwebsearch.com, and Traffichog.com, among other sites. ILookUp also may generate the "Explorer Has Caused An Error In Ineb.dll" error message.

How To Get Rid Of ILookUp With Ad-Aware SE

A number of anti-spyware utilities will recognize and remove ILookUp. To remove ILookUp with Ad-Aware SE, open the anti-spyware utility and click the Scan Now button. When the search for malware is complete, choose the Critical Objects tab to view the list of identified components. If you've contracted ILookUp, the list should include one or more of its variants. Select all of the spyware-related items, click the Next button, and then click OK to move the selected items to a quarantine folder. In some cases, Ad-Aware cannot remove an item until you reboot. Follow the on-screen instructions for doing so.

WARNING: The following section includes step-by-step information on how to edit the Windows Registry, a large database containing system and program settings that are essential to how the OS (operating system) operates. Follow Registry-editing instructions to the letter and be sure to make a backup of your Registry before you begin. (Registry errors can render your computer inoperable if you don't have a backup.) This procedure differs depending on the OS you use. For more information on backing up and editing the Registry, see these articles: "Protect Yourself " and "Register Here ."

How To Get Rid Of ILookUp Manually

At one time, an uninstaller for ILookUp was available from its developer, Aztec Marketing SA, but the utility has since been pulled from the Internet. Nevertheless, you can get a copy of the uninstaller from third-party anti-spyware sites, including www.pchell.com/downloads/uninstall2.exe and www.cub.net/spyware/uninstall2.exe .

Alternatively, you can remove it manually. Start by pressing CTRL-ALT-DELETE and closing any program that refers to Bundler_mbp_sb.exe, Install.exe, or Ttil.exe. You then can open My Computer and navigate to the WINDOWS\DOWNLOADED PROGRAM FILES folder on the Windows drive. Open this folder and locate the I-Lookup.com Bar file. Delete this file. Repeat this procedure to delete the following files and folders (if present): GlobalToolbar.com Bar, GlobalWebSearch.com Bar, Iiittt Class, Search Bar, SearchBus.com Bar, or {EEF29D20-9A47-4657-ADF7-283EC2504001}.

The next step is to unregister the DLL files associated with ILookUp. You can determine which ones are installed on your PC by opening the Windows search utility and searching the Windows drive for the following files: Abeb.dll, Absnro.dll, Bmeb.dll, Chgrgs.dll, Drbr.dll, Gws.dll, Ineb.dll, Isp.dll, Sbus.dll, Waeb.dll, Windec32.dll, and Winenc32.dll. Make a note of which DLL files are installed on your system and where they are located, including the full path name (for example: C:\WINDOWS\SYSTEM32\Gws.dll). Close the search utility and open the Command Prompt (MS-DOS Prompt in WinMe and Win98) window.

When the Command Prompt (MS-DOS Prompt in WinMe and Win98) window opens, access a C:\WINDOWS\SYSTEM32> (C:\WINDOWS\SYSTEM> in WinMe and Win98) prompt. At this prompt, type regsvr32 /u followed by the location, in quotation marks, of one of the aforementioned DLL files (for example: regsvr32 /u "windows\system32\chgrgs.dll" ). Press ENTER to unregister the file. Repeat these steps for each of the ILookUp-related DLL files on your system. When you finish, type exit at the command prompt and press ENTER to close the window.

After rebooting your PC, open the Registry Editor. Locate and delete the following keys and values (if present):

• HKEY_CLASSES_ROOT\CLSID\{0AAF602E-72A1-45FE-BAB1-06971E07EAA2}

• HKEY_CLASSES_ROOT\CLSID\{FBAA0B9E-A059-43E4-9699-76EB0AEB975B}

• HKEY_CLASSES_ROOT\CLSID\{FE1A240F-B247-4E06-A600-30E28F5AF3A0}

• HKEY_CLASSES_ROOT\INTERFACE\{3FD0EE3A-96AF-434B-8B05-6970699905AE}

• HKEY_CLASSES_ROOT\INTERFACE\{F3A898B0-6D64-4155-BDF9-C26C99E15071}

• HKEY_CLASSES_ROOT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\
EXPLORER\BROWSER HELPER OBJECTS\{0428FFC7-1931-45B7-95CB-3CBB919777E1}

• HKEY_CLASSES_ROOT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\
EXPLORER\BROWSER HELPER OBJECTS\{18B79968-1A76-4953-9EBB-B651407F8998}

• HKEY_CLASSES_ROOT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\
EXPLORER\BROWSER HELPER OBJECTS\{CBA523B2-1906-4D14-95A2-CD8E233701C7}

• HKEY_CLASSES_ROOT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\
EXPLORER\BROWSER HELPER OBJECTS\{E539DEA3-BA67-4F1F-A897-5F2F4F29A063}

• HKEY_CLASSES_ROOT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\
EXPLORER\BROWSER HELPER OBJECTS\{FBAA0B9E-A059-43E4-9699-76EB0AEB975B}

• HKEY_CLASSES_ROOT\TYPELIB\{0AAF602E-72A1-45FE-BAB1-06971E07EAA2}

• HKEY_CLASSES_ROOT\TYPELIB\{0C9CBFE1-91CD-40C2-BB64-1EC84C4C46AF}

• HKEY_CLASSES_ROOT\TYPELIB\{2038A287-4221-4F76-A7C0-ADDD77AFABB3}

• HKEY_CLASSES_ROOT\TYPELIB\{660B38CB-6349-4C67-A418-AADABAE09C38}

• HKEY_CLASSES_ROOT\TYPELIB\{753AA023-02D1-447D-8B55-53A91A5ABF18}

• HKEY_CLASSES_ROOT\WINDEC.AMO

• HKEY_CLASSES_ROOT\WINDEC.AMO.1

• HKEY_CLASSES_ROOT\WINDEC.DBI

• HKEY_CLASSES_ROOT\WINDEC.DBI.1

• HKEY_CLASSES_ROOT\WINDEC.IIITTT

• HKEY_CLASSES_ROOT\WINDEC.IIITTT.1

• HKEY_CLASSES_ROOT\WINDEC.MOMO

• HKEY_CLASSES_ROOT\WINDEC.MOMO.1

• HKEY_CLASSES_ROOT\WINDEC.OHB

• HKEY_CLASSES_ROOT\WINDEC.OHB.1

• HKEY_CURRENT_USER\SOFTWARE\INEB

• HKEY_CURRENT_USER\SOFTWARE\SHARE_DOCS

• HKEY_LOCAL_MACHINE\CLSID\{0428FFC7-1931-45B7-95CB-3CBB919777E1}

• HKEY_LOCAL_MACHINE\CLSID\{0AAF602E-72A1-45FE-BAB1-06971E07EAA2}

• HKEY_LOCAL_MACHINE\CLSID\{FBAA0B9E-A059-43E4-9699-76EB0AEB975B}

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{0AAF602E-72A1-45FE-BAB1-06971E07EAA2}

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{0C9CBFE1-91CD-40C2-BB64-1EC84C4C46AF}

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{D35A69A7-7A34-4C67-814A-3F508C0BF371}

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{E539DEA3-BA67-4F1F-A897-5F2F4F29A063}

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\CLSID\{FBAA0B9E-A059-43E4-9699-76EB0AEB975B}

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{7E893886-5641-4867-A323-2D8ABB7B4D6D}

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{B0632EC9-BD27-48C4-B16C-294F8823BFF0}

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\INTERFACE\{E6ED4741-A9DF-4BB1-A203-C7461FC00355}

• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\TYPELIB\{EDD73C85-28B8-4145-AB9C-673C74C667E6}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{0AAF602E-72A1-45FE-BAB1-06971E07EAA2}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{0C9CBFE1-91CD-40C2-
BB64-1EC84C4C46AF}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{11F6B95F-0774-4B8D-8C9E-6B552CBCAD14}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{1B13BF1B-A528-4CC4-
B5BF-553CAA6487AC}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{382AA497-20D7-4EBB-A188-74660465940D}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{423BD222-52BE-471A-BE01-75FCCEB3D48F}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{54A85A38-A699-4AEC-8F88-AB542210C93B}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{6EF3AE25-5A7D-40C2-9B44-9ED0068621C0}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{8E4C16F3-45C8-4B24-99E6-F55082B7C4F1}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\
EXPLORER\BROWSER HELPER OBJECTS\{18B79968-1A76-4953-9EBB-B651407F8998}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\
EXPLORER\BROWSER HELPER OBJECTS\{E539DEA3-BA67-4F1F-A897-5F2F4F29A063}

• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\
EXPLORER\BROWSER HELPER OBJECTS\{FBAA0B9E-A059-43E4-9699-76EB0AEB975B}

Close the Registry Editor and reboot the computer. Next, delete the ILookUp-related DLL files that you unregistered. Use My Computer to locate and delete the files from your PC. While you're at it, delete the Install.exe file, which is located in the root directory on the Windows drive (for example: C:\Install.exe, where C is the letter representing the Windows drive). You also should search your system to find and delete the Ineb.inf and Ttil.exe files (if present), as well as any folders that refer to ILookUp (or I-lookup).

Finally, open the Tools menu in IE and select Internet Options. On the Programs tab, click the Reset Web Settings button. Clean out your Favorites menu, too, if necessary.