Can't get rid of www.landingsavetubevideo.com trojan in I.E.

[j72]

Cheers John, I really appreciate all of this and feel like I am learning a lot as I go on, as requested.

[ArcaVir]
2010-11-28 Found nothing
[G DATA]
2010-11-28 Found nothing
[Avast! antivirus]
2010-11-28 Found nothing
[Ikarus]
2010-11-28 Found nothing
[Grisoft AVG Anti-Virus]
2010-11-28 Found nothing
[Kaspersky Anti-Virus]
2010-11-28 Found nothing
[Avira AntiVir]
2010-11-27 Found nothing
[ESET NOD32]
2010-11-28 Found nothing
[Softwin BitDefender]
2010-11-28 Found nothing
[Panda Antivirus]
2010-11-28 Found nothing
[ClamAV]
2010-11-28 Found nothing
[Quick Heal]
2010-11-26 Found nothing
[CPsecure]
2010-11-28 Found nothing
[Sophos]
2010-11-28 Found nothing
[Dr.Web]
2010-11-28 Found nothing
[VirusBlokAda VBA32]
2010-11-26 Found nothing
[Frisk F-Prot Antivirus]
2010-11-27 Found nothing
[VirusBuster]
2010-11-28 Found nothing
[F-Secure Anti-Virus]
2010-11-28 Found nothing

Computer is working fine thank you

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=81cabf26509e0040adf970f6d0b3d5db
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-11-28 08:05:43
# local_time=2010-11-29 09:05:43 (+1200, New Zealand Daylight Time)
# country="New Zealand"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1797 16775165 100 94 0 50104398 0 0
# compatibility_mode=5892 16776573 100 100 0 127665633 0 0
# compatibility_mode=8192 67108863 100 0 2152 2152 0 0
# scanned=152608
# found=35
# cleaned=0
# scan_time=3038
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3CJPEG.DLL Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3DTACTL.DLL Win32/Adware.FunWeb application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3HISTSW.DLL Win32/Adware.FunWeb application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3HKSTUB.DLL Win32/Toolbar.MyWebSearch.G application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3HTMLMU.DLL Win32/Adware.FunWeb application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3HTTPCT.DLL Win32/Adware.FunWeb application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3POPSWT.DLL Win32/Adware.FunWeb application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3PSSAVR.SCR Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3REGHK.DLL Win32/Toolbar.MyWebSearch.G application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3REPROX.DLL Win32/Adware.FunWeb application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3RESTUB.DLL Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3SCHMON.EXE Win32/Adware.FunWeb application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\F3SCRCTR.DLL Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3AUXSTB.DLL Win32/Toolbar.MyWebSearch.H application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3DLGHK.DLL a variant of Win32/Toolbar.MyWebSearch.I application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3HTML.DLL Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3IMPIPE.EXE Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3MSG.DLL Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3NTSTBR.JAR Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3OUTLCN.DLL Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3PLUGIN.DLL Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3SKIN.DLL Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3SKPLAY.EXE Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3SLSRCH.EXE Win32/Toolbar.MyWebSearch.J application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\M3SRCHMN.EXE a variant of Win32/Toolbar.MyWebSearch.I application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\MWSBAR.DLL a variant of Win32/Toolbar.MyWebSearch.K application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\MWSOEMON.EXE Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\MWSOEPLG.DLL Win32/Toolbar.MyWebSearch.J application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\MWSOESTB.DLL Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\MWSSRCAS.DLL a variant of Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\MWSSVC.EXE Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch\bar\1.bin\NPMYWEBS.DLL Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\FU_Backup\FU_Backup_2010-11-16\Windows\system32\f3pssavr.scr Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\Program Files\Windows Live\Messenger\msimg32.dll Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I
C:\Program Files\Windows Live\Messenger\riched20.dll Win32/Toolbar.MyWebSearch application 00000000000000000000000000000000 I

[tequesta]

Hello j72,

Computer is working fine thank you

Glad to hear it! Now lets keep going, we are on the home stretch.

Delete Multiple Files and Folders
We need to delete some files and folders.
It will be easier and less error prone, if we create a batch file to do this... please follow these steps:

1. Copy all text in the quote box (below)...to Notepad.
   

   @echo off
   rd /s /q "C:\FU_Backup\FU_Backup_2010-11-16\Program Files\mywebsearch"
   del /f /s /q "C:\FU_Backup\FU_Backup_2010-11-16\Windows\system32\f3pssavr.scr"
   del %0

   
   
2. Save the Notepad file on your desktop...as delfile.bat... save type as "All Files"
   
   delfile.bat <<------------- you should see this on your desktop.
3. Right click and choose run as administrator delfile.bat to execute it.
   A black CMD window will flash, then disappear...this is normal.
4. The files and folders, if found...will have been deleted and the "delfile.bat" file will also be deleted.

Now:

OTC

Download OTC by Old Timer and save it to your Desktop. This tool will remove all the tools we used to clean your pc.

• Right-click OTC.exe And select " Run as administrator " to run it.
• Click the CleanUp! button
• Select Yes when the Begin cleanup Process? Prompt appears
• If you are prompted to Reboot during the cleanup, select Yes
• The tool will delete itself once it finishes, if not delete it by yourself

Note: If you receive a warning from your firewall or other security programs regarding OTC attempting to contact the internet, please allow it to do so.


Congratulations... you system appears to be clean
Please follow these simple guidelines in order to help keep your computer clean and secure:

Please follow these simple guidelines in order to help keep your computer clean and secure:

Create a new - clean SRP (System Restore Point)
Now that you're clean, it's a great time to create a new, clean SRP and remove any old entries that may possibly be compromised.
Create a new SRP

1. Go to Start > All Programs > Accessories > System Tools > System Restore
2. Select Create a restore point... then press the Next...button.
3. Type a name for the new SRP... like All Clean... then press the Create... button.
4. When finished... press the Close...button.
   Now you have a good clean SRP that can be used, if needed.

Remove old SRP entries

1. Now... Go to Start > Run... type in: cleanmgr...press the OK...button.
   The Disk Cleanup window will show it is "calculating" the amount of space saved by compressing old files. This could take a few seconds, to minutes.
2. When available... select the More Options... tab.
   In the System Restore section... at the bottom of the window...
3. Press the Clean up...button. Reply Yes to the "Are you sure you want to delete all but the most recent restore point?" prompt.
4. Press the X to close and exit.
   All existing restore points will be deleted... except the new one you just created.

• Security Updates for Windows, Internet Explorer & Microsoft Office
  Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.
  NOTE: The update process uses ActiveX, so you will need to use internet explorer for it and allow the ActiveX control to install.
  
• Update Non-Microsoft Programs
  Microsoft isn't the only company whose products can contain security vulnerabilities. To check whether other programs running on your PC are in need of an update, you can use the Secunia Software Inspector or F-secure Health Check. I suggest that you run one of them at least once a month.

Update your Antivirus programs and other security products regularly.
Avoid new threats that could infect your system. You can also check if any application updates are needed for your PC.
Secunia Software Inspector - Copyright © Secunia.
F-secure Health Check - Copyright © F-Secure Corporation.

You can try...some free programs, that will help improve your computer's security.
These kinds of protection programs (adware, spyware, etc...) tend to overlap in coverages.
Many feel that having a "layered" protection scheme, is beneficial. Each individual has to decide what works best for their situation.
There are many available...here are a few you can look into, if you want.

Malwarebytes' Anti-Malware
I recommend you keep Malwarebytes' Anti-Malware, keep it updated and run it once a week.
I also recommend you keep ATF Cleaner to clean out temp files.

SpywareBlaster
Download it from © Javacool Software LLC.
A SpywareBlaster knowledgebase can be found Here.

WinPatrol
Download it from Copyright © BillP Studios
Information about how WinPatrol works, is available Here.
(The free version of WinPatrol...does not provide any real-time protection)


Stay Safe!

John

[j72]

I cannot thank you enough John, I feel like I have learned a great deal and your instructions have been very clear and easy to use, awesome job friend

[tequesta]

Hello j72,

I am glad I could help, and thank you for the kind words.

John

[Wingman]

As your problems appear to have been resolved, this topic is now closed.
We are pleased we could help you resolve your computer's malware issues.

If you are satisfied with our assistance and wish to donate to help with the costs of this volunteer site, please read :
Donations For Malware Removal