Fjerning av I-lookup

[rks]

Noen som har vært borti I-lookup? Det er en form for "hijacking" av IE, setter startsiden til I-lookup.com, legger inn en toolbar og starter 4-5 popups når man starter IE. Har prøvd forskjellige løsninger for å fjerne dette, men uten hell. Det kommer tilbake samma f... :gretten:

 

Noen som har gode tips?

[Gunnar B]

Les her: http://www.pchell.com/support/click2findnow.shtml

[Bernt R]

Jeg henger meg på innlegget:

 

Jeg fikk samme problemet, men klarte ikke å løse det med noe av det som forrige innlegg henviste til. Fant ingen av de aktuelle dll-filene. Fant heller ikke noe av det aktuelle i "Downloaded Program Files".

I henhold til andre råd kjørte jeg imidlertid HijackThis og fjernet alt som var relatert til I-Lookup. Det ser nå ut til at nesten alt nå er i orden. Imidlertid: på startsiden min (SOL) er det fortsatt en link til I-Lookup som kommer inn i stedenfor linken en annen rettmessig link (GE Capital Bank).

 

Jeg har kjørt HijackThis på nytt med følgende log. Er det en eller annen som kan se om det er noe her som bør/kan/må slettes:

 

Logfile of HijackThis v1.97.2

Scan saved at 22:25:30, on 10.11.2003

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Programfiler\Norton AntiVirus\SAVScan.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Programfiler\Logitech\iTouch\iTouch.exe

C:\Programfiler\Caere\OmniPagePro90\opware32.exe

C:\Programfiler\ahead\InCD\InCD.exe

C:\Programfiler\Free Surfer\fs20.exe

C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

C:\Programfiler\PestPatrol\PPControl.exe

C:\Programfiler\PestPatrol\PPMemCheck.exe

C:\Programfiler\PestPatrol\CookiePatrol.exe

C:\WINDOWS\system32\ntvdm.exe

C:\PROGRA~1\Novosoft\HANDYB~1\hbagent.exe

C:\Programfiler\Microsoft Office\Office\FINDFAST.EXE

C:\Programfiler\Microsoft Office\Office\OSA.EXE

C:\Programfiler\Zone Labs\ZoneAlarm\zonealarm.exe

C:\Programfiler\Microsoft Office\Office\1044\msoffice.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\PROGRA~1\WINZIP\winzip32.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\Documents and Settings\Bernt\Lokale innstillinger\Temp\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sol.no/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: ohb - {18B79968-1A76-4953-9EBB-B651407F8998} - C:\WINDOWS\System32\windec32.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programfiler\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programfiler\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programfiler\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [OmniPage] C:\Programfiler\Caere\OmniPagePro90\opware32.exe

O4 - HKLM\..\Run: [inCD] C:\Programfiler\ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [freesurfer] C:\Programfiler\Free Surfer\fs20.exe

O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

O4 - HKLM\..\Run: [pdfFactory Dispatcher v2] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe

O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Programfiler\PestPatrol\PPControl.exe

O4 - HKLM\..\Run: [PPMemCheck] C:\Programfiler\PestPatrol\PPMemCheck.exe

O4 - HKLM\..\Run: [CookiePatrol] C:\Programfiler\PestPatrol\CookiePatrol.exe

O4 - HKCU\..\Run: [Handy Backup 3.9] C:\PROGRA~1\Novosoft\HANDYB~1\hbagent.exe -logon

O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe

O4 - Startup: iFinger.lnk = C:\Programfiler\iFinger\iFinger.exe

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Microsoft Hurtigsøk.lnk = C:\Programfiler\Microsoft Office\Office\FINDFAST.EXE

O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: Office Oppstart.lnk = C:\Programfiler\Microsoft Office\Office\OSA.EXE

O4 - Global Startup: ZoneAlarm.lnk = C:\Programfiler\Zone Labs\ZoneAlarm\zonealarm.exe

O9 - Extra button: iFinger (HKLM)

O9 - Extra button: Free Surfer (HKLM)

O9 - Extra 'Tools' menuitem: Free Surfer (HKLM)

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab

O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - https://www.skandiabanken.no/CertControl/x86/xenroll.dll

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://apple.speedera.net/qtinstall.info.a...meInstaller.exe

O16 - DPF: {5B27C20D-FFB6-4054-BA78-DE4A059BC75A} (Microsoft Office Template Downloader) - http://office.microsoft.com/norge/templateGallery/msotd.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/...B?37602.6028125

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab