Google Answers Logo
View Question
 
Q: My Browser Has Been Hijacked! ( Answered 5 out of 5 stars,   1 Comment )
Question  
Subject: My Browser Has Been Hijacked!
Category: Computers > Internet
Asked by: lynncat-ga
List Price: $15.00
Posted: 18 Aug 2003 13:16 PDT
Expires: 17 Sep 2003 13:16 PDT
Question ID: 246099
Help!
A site called "i-lookup.com" has planted a worm in my browser (I.E.)
that automatically changes the homepage default to "i-lookup.com"
which I delete and change back to "google.com", then this malicious
script changes it back automatically when the browser is closed and
re-opened - i.e., I reset the the homepage default to
://www.google.com and this worm changes it back when the browser
is closed then reopened. It also alters its own URL in the Security
site block option under Tools/Security, so that it cannot be blocked.
Itr also re-installs its own Tool Bar each time!
How do I get rid of this malicious little script? Must I completely
delete I.E. and reinstall? Will I lose my Favorites list if I do that?
Where do I find a safe site to download a new copy of I.E., if I have
to reinstall? Any help greatly appreciated.
- Lynncat
Answer  
Subject: Re: My Browser Has Been Hijacked!
Answered By: serenata-ga on 18 Aug 2003 15:51 PDT
Rated:5 out of 5 stars
 
Hi Lynncat ~

It does seem as though your browser has been hijacked by Ezula's
I-Lookup. It has a tendency to insert it in something you may have
downloaded from the Internet (Ezula apparently feels this is "legal"
since you "voluntarily" downloaded something else and didn't read the
fine print!). This type of software is often referred to as 'scumware'

Oh, I-Lookup does give you a way to get rid of it, too ... buried very
deeply in the FAQ and -- "probably" -- feels pretty sure you won't
come back and go looking because you're thoroughly disgusted by now.

The good news is you don't have to reset or reinstall IE.


======================
Uninstalling I-Lookup
======================


Before you go to the I-Lookup.com FAQ to get its uninstaller, I would
recommend downloading two different spyware detection/removal programs
which will help remove any traces of I-Lookup and any other scumware
you may have residing on your computer without your being aware of it.

The first is Lavasoft's Ad-Aware, which is free can be downloaded
here:
   - http://www.lavasoft.nu/software/adaware/

They also have a couple of "for-pay" versions, but I have always had
success with the free version, and it is one of CNet's and ZDNet's top
10 downloads.

The second is Spybot Search & Destroy, which is also free. The Spybot
Search & Destroy site is here and specifically mentions I-Lookup in
the far right-hand column (about half-way down):
   - http://spybot.safer-networking.de/

This software, too, is recommended to help get rid of the scumware and
trackers left by CNet & ZDNet.

Spybot specifically mentions I-Lookup.


Next ...

I-Lookup.com has its own uninstaller on its site - buried deeply in a
FAQ. The only reason I recommend this uninstaller is that it will
remove the toolbar and browser software and restore your old version
(even if it "accidently" leaves a few trackers). You don't have to use
this

*** Repeat, You DO NOT HAVE TO USE the I-Lookup uninstaller. ***

Spybot Search & Destroy will remove this software, but you "may" have
to re-set your original browser information and preferences after
using Spybot Search & Destroy. It has been known on some systems with
certain setups not to reset the older browser, etc.


If you decide to use the I-Lookup uninstaller, you click on the link
below to download and run the I-Lookup.com uninstaller.

http://www.i-lookup.com/uninstall.exe


AFTER that, run both the Ad-Aware and Spybot Search & Destroy software
(in either order) to check and quarantine any other spyware or
scumware it may find on your computer.


==================
Other Information
==================

PC Hell has a page on I-Lookup, and they recommend the I-Lookup
uninstaller. You can read the directions in "Click2FindNow and
I-Lookup Removal Instructions and Help" here:
   - http://www.pchell.com/support/click2findnow.shtml


I-Lookup's Frequently Asked Questions:

         "How did i-lookup.com become my homepage?

          There are several ways this could happen:

         1. You clicked on the “make i-lookup my
            homepage” link on the i-lookup.com webpage.
         2. You may have installed our I-lookup
            Toolbar software from the i-lookup.com
            webpage or from one of our many partner sites.

         "How do I uninstall the i-lookup toolbar and
          change the start page?

         1. To uninstall the I-Lookup Toolbar please
            click on the following link
            http://toolbar.i-lookup.com/uninstall.exe and
            when prompted click 'open'."


==================
Search Terms Used
==================

   - I-Lookup
   - ilookup
   - spyware
   - removing i-lookup


I usually run Ad-Aware and Spybot Search & Destroy at least once a
week, and more often if I'm doing a lot of heavy research on the
Internet. You may want to run it at least once a week yourself.

Good luck,
Serenata
lynncat-ga rated this answer:5 out of 5 stars

Comments  
Subject: Re: My Browser Has Been Hijacked!
From: lri41-ga on 20 Aug 2003 18:33 PDT
 
How to fix a hijacked homepage setting
 
http://www.cyberwalker.net/columns/oct02/241002.html


http://www.geekgirls.com/net_hijacked.htm

Browser Hijacking

http://www.spywareinfo.com/articles/hijacked/

Has something started redirecting your browser to whazit.com? We have
the solution!
http://www.spywareinfo.com/

Manual remove:

http://whazit.com/manualremove.html


restore a hijacked browser, or if you want to know whether that free
software you just downloaded might have a parasite bundled into it,
you've come to the right place.
http://www.spywareinfo.com/


[langalist] LangaList Standard Edition 2002-01-24  
Date: 1/23/2002 9:18:06 PM Pacific Standard Time

Free "Anti-Parasite" Browser Check

Esther Schindler, who helps edit and produce columns and discussions
for
InformationWeek.Com (including mine!), sent along a note about

http://and.doxdesk.com/parasite/
 :

     Nice utility page that automatically detects spyware in your
     Windows Explorer browser, and generates instructions for
     removing it....

Thanks, Esther. The page runs a small JavaScript that looks for
"exploitationware"  and other "parasite" add-ons that may have
barnacled
themselves to your browser without your knowledge.


Lockergnome Windows Digest] Electronic Toolbar and the Lovers  
Date: 3/16/2003 1:44:12 PM Pacific Standard Time

IE Restrictions v1.0 [478k] W9x/2k/XP FREE

http://www.mywebattack.com/gnomeapp.php?id=105964

IE Restrictions allows you to disable certain modifications to
Internet Explorer. Many of them are commonly abused by invasive
Web sites that, for example, change your home page settings,
modify the toolbar, open pages in full- screen mode, and more.
Others are more of an administrative nature, allowing you to
disable the registry editor, page source viewing, and other
settings. [MWA]


MOSSBERGS'S MAILBAG  WSJ
June 6, 2002  


Software Can Prevent Porn Sites From Monopolizing Start Pages
By WALTER S. MOSSBERG

There's no other major item most of us own that is as confusing,
unpredictable and unreliable as our personal computers. Everybody has
questions about them, and we aim to help. Here are a few questions
about computers I've received recently from people like you, and my
answers. I have edited and restated the questions a bit, for
readability.

This week my mailbox contained questions about disabling malicious
porn site settings, finding a book about Windows XP and printing
directly from digital cameras.

Q: A gross porn site, apparently once visited by my teenage son, has
taken over my browser and installed itself as my start page. Every
time I launch Internet Explorer, this porn page appears, and it spawns
multiple other porn pages so fast I can't close them. Even if I go
into the settings menu and change the start page back to something I
want, the porn page overrides my choice the next time I reboot the PC.
How can I get rid of it?

A: Porn sites aren't the only ones who try and take over your browser
by changing your start page, which is the Web page that appears first
whenever you launch Internet Explorer. Some sleazy marketing sites do
this, too. These sites install malicious code on your PC, some of
which controls the browser start page setting, overriding your own
selections.

But I have found a free program to be very effective in blocking such
sabotage. It's called StartPage Guard and was developed by a
programmer named Piotr J. Walczak. The program not only kills
malicious code and allows you to restore your favorite start page, but
it can automatically check to make sure your choice isn't overridden
again. You can download StartPage Guard at

www.download.com  (search for "start page") or at
http://pjwalczak.com/


Lockergnome Windows Digest] Superimposed Symphony and the Aliasing  
Date: 7/5/2003 4:37:19 PM Pacific Daylight Time

Browser Hijack Blaster v1.0 [393k] W98/2k/XP FREE


Browser Hijack Blaster protects your system from browser hijackers
and spyware that alters your Internet Explorer settings. It runs
in the system tray and silently monitors the settings for IE
Homepage, IE Default Page, IE Search Page, and BHOs (Browser
Helper Objects). If any of these settings are changed, it will
intercept and warn you, giving you the option to undo the changes.
[MWA]

 
http://www.mywebattack.com/gnomeapp.php?id=106649

http://www.wilderssecurity.net/bhblaster.html


HijackThis

HijackThis examines certain key areas of the Registry and Hard Drive
and lists their contents. These are areas which are used by both
legitimate programmers and hijackers. It's up to you to decide what
should be removed. Some items are perfectly fine. You should not
remove them. Never remove everything. Doing that could leave you with
missing items needed to run legitimate programs and add-ins. This Page
will help you work with the Experts to clean up your system. For those
of you needing instructions on how to Copy and Paste the contents of a
text file into a Forum Post, please look at the Table of Contents. A
link to the instructions is included.

http://www.tomcoyote.org/hjt/


[Lockergnome Windows Digest] SIC 2003 Special Edition  
Date: 8/6/2003 4:01:33 PM Pacific Daylight Time

Secure IE 2003 [3.9MB] W9x/NT/2k/XP US$29.95

 The name of this software says it all (well, almost). Secure IE 
offers advanced protection from JavaScript, ActiveX controls, and 
VB Script, as well as effectively blocking malicious file 
downloads. Secure IE offers control over browser security 
settings, allowing you full access to trusted sites, while 
eliminating the potential nasties found on unknown sites. Pop-up 
blocking technology offers built-in elimination of annoying offer 
messages. Automatic configuration options let you lock down the 
most vulnerable portions of your browser in seconds. Tabbed 
browsing rounds out my favorite features of Secure IE, 
complimenting security enhancements with this required usability 
booster. This app is a must have for anyone who wants to secure 
their computer from browsing nasties or just wants to protect the 
corporate network from outside threats.
.
 http://www.secureie.com/

Important Disclaimer: Answers and comments provided on Google Answers are general information, and are not intended to substitute for informed professional medical, psychiatric, psychological, tax, legal, investment, accounting, or other professional advice. Google does not endorse, and expressly disclaims liability for any product, manufacturer, distributor, service or service provider mentioned or any opinion expressed in answers or comments. Please read carefully the Google Answers Terms of Service.

If you feel that you have found inappropriate content, please let us know by emailing us at answers-support@google.com with the question ID listed above. Thank you.
Search Google Answers for
Google Answers  


Google Home - Answers FAQ - Terms of Service - Privacy Policy