PC Hell: How to Remove Click2FindNow or I-Lookup

What is Click2FindNow or I-Lookup?

Click2FindNow and I-Lookup are homepage hijacking programs that change the IE homepage and search pages resulting in many pop-up ads. They will also add bookmarks to the Favorites menu in IE and in most cases a toolbar as well. Both sites are run by a company called Aztec Marketing SA in San Jose, Costa Rica. I-Lookup also may set the homepage to globalwebsearch.com in some versions. All appear to be installed by an ActiveX download.

Since the first writeup of this page in May, 2003 there have been several variations of I-lookup.com that have appeared:

I-Lookup/Abeb
    Uses abeb.dll and sets homepage to superwebsearch.com

I-Lookup/Bmeb
    Uses bmeb.dll and sets homepage to traffichog.com

I-Lookup/Chgrgs
    Uses chrgrs.dll

I-Lookup/Drbr
    Uses drbr.dll and sets homepage to globaltoolbar.com

I-Lookup/Gws
    Uses gws.dll and sets homepage to globalwebsearch.com

I-Lookup/Ineb
    Uses ineb.dll and sets homepage to i-lookup.com

I-Lookup/Sbus
    Uses sbus.dll and sets homepage to searchbus.com

How to I Remove Click2FindNow or I-Lookup?

Click2FindNow

There was automatic uninstaller located on Click2FindNow.com's website, however this site as well as the initial threat are now dead and buried. Old news in the spyware game.

I-Lookup

As with Click2FindNow, I-Lookup.com had its own uninstaller on its site buried in a FAQ, however this site as well no longer exists along with the I-Lookup software.

Here are manual instructions to the best of my knowledge for uninstalling the different variants of I-Lookup.com

1) Remove the Active X component (may have to be done in Windows Safe Mode)

    * Double-click on the "Downloaded Program Files" folder in the Windows folder
    * Right click on
          o I-Lookup.com Bar or toolbar (Abeb and Ineb variants)
          o GlobalWebSearch.com Bar (Gws and Chgrgs variants)
          o GlobalToolbar.com (Drbr variant)
          o Search Bar (Bmeb variant)
          o SearchBus.com (Sbus variant)
    * Click on Remove and delete the file

2) Open a Dos prompt

    * For Windows 95/98/ME, click on Start, Run, and Type COMMAND and Click OK
    * For Windows XP/2000, click on Start, Run, and Type CMD and Click Ok

3) Unregister the offending DLL file by typing the following lines at the DOS Prompt (pressing Enter after each line)

Abeb variant
    cd "%WinDir%\System"
    regsvr32 /u abeb.dll

Bmeb variant
    cd "%WinDir%\System"
    regsvr32 /u bmeb.dll

Chgrgs variant
    cd "%WinDir%\System"
    regsvr32 /u chgrgs.dll

Drbr variant
    cd "%WinDir%\System"
    regsvr32 /u drbr.dll

Gws variant
    cd "%WinDir%\System"
    regsvr32 /u gws.dll

Ineb variant
    cd "%WinDir%\System"
    regsvr32 /u ineb.dll

Sbus variant
    cd "%WinDir%\System"
    regsvr32 /u sbus.dll

Type EXIT and Press Enter to close the DOS prompt

4) Reset Web Settings in Internet Explorer (homepage and search page)

    * In Internet Explorer, click on Tools, Internet Options
    * Click on the Programs tab
    * Click on Reset Web Settings

5) Remove Registry Entries

    * Click on Start, Run, and type REGEDIT and click OK
    * Click the pluses(+) next to
          o HKey_Current_User
          o Software
    * Right Click on the Ineb folder and click Delete

Lastly, use a spyware removal program to clean up any bits and pieces left from the infection. The freeware program I would recommend would be SpyBot Search and Destroy, an excellent ,and always up-to-date, spyware removal program. Download the software, run their internet update to get the very latest spyware definitions, then use it to search and remove any spyware lurking on your computer.

Spybot Search & Destroy
http://security.kolla.de

Search PCHell.com
site search by freefind	advanced

Click2FindNow and I-Lookup Removal Instructions and Help

What is Click2FindNow or I-Lookup?

How to I Remove Click2FindNow or I-Lookup?

Links to Other Important Information