movieland removal

Status
Not open for further replies.

Tedster

Posts: 5,746   +14
from: http://www.vcn.com/knowledgebase/article.php?id=422

How to Remove Movieland
Problem:

Movieland has infected your computer. It takes over the whole screen and probably keeps telling you that you owe them money.

Solution:

First, don't pay them or give them any credit card or other info. You don't owe them any money. Movieland is spyware; in other words it's a bad program that you should get rid of.

Here's how to get rid of it:

Click the Start menu, and Control Panel should be in there (or Settings, then Control Panel). Then open Add/Remove Programs. It should open with a big list of things. Look through the list for:

* AltPayments,
* Media Pipe, or
* P2Pnetworks.


Probably just P2PNetworks will be there, and so click on it so it's highlighted, and then click the Remove (or Change/Remove or Add/Remove) button. Tell it you do want to uninstall, and go through its process, then click close. Now it should be gone from the list. If either AltPayments or Media Pipe do happen to be there, do the same process to remove them.

Now close Add/Remove Programs and we're going to Program Files. Open My Computer, then open "Local Disk (C:)", then open Program Files (click on show contents if contents are hidden in either folder). The items we want to delete in there are:

* AltPayments or altpayV2
* fsupport
* ITBills (If you have this one, you probably will have to go into safe mode to remove. Or you can end the itbill process if you know how to do that.)
* MediaPipe
* You also have something called MovieLand Terms or MovieLand Hotmail Something (I don't remember exactly, sorry), possibly at the end of the list rather than under "M" where you'd expect. Delete that also. Anything with Movieland in the title, delete.
* You probably don't have p2pnetworks in Program Files (since we just removed it in Add/Remove Programs), but if you do delete it too.

Now once all that is gone, go back into Add/Remove Programs and see if you have Notification Utility. If you do have it in the list, remove it (thanks to the commenters below for this tip).

If It Didn't Work:

You may get a message that says it cannot delete the file due to it is being used by another person or program and to close all programs. If you get this message, you've got to do more work. Do the following:

1) Download Pocket KillBox from: http://www.downloads.subratam.org/KillBox.zip .

2) Restart your computer into safe mode now. To go into safe mode, go into the Start menu, choose Restart just as you normally would, then start hitting the F8 key at the top of the keyboard. Just keep hitting F8 over and over every second or so until it brings you to a black screen giving you some choices. Using your arrow keys on the keyboard, choose Safe Mode, then hit Enter. Then wait a while and it will eventually bring you into Windows Safe Mode.

3) Try deleting the folders in safe mode. Quite possibly you will be able to successfully delete them now. If not, continue with the steps below to have Pocket KillBox force it to delete.

4) Double-click on Killbox.exe to run it.

5) Now put a tick by Standard File Kill.

6) In the "Full Path of File to Delete" box, copy and paste C:/Program Files/altpayv2 , C:/Program Files/MediaPipe , C:/Program Files/p2pnetworks , and any of the other folders you couldn't delete one at a time. Then click on the button that has the red circle with the X in the middle after you enter each file. It will ask for confimation to delete the file. Click Yes. Continue with that same procedure until you have copied and pasted all of these in the "Paste Full Path of File to Delete" box.

Note: It is possible that Killbox will tell you that one or more files do not exist. If that happens, just continue on with all the files. Be sure you don't miss any.

So, to recap, paste these folders in and make sure Deltree is checked before hitting the red x:

C:/Program Files/altpayv2 (and/or AltPayments)
C:/Program Files/MediaPipe
C:/Program Files/p2pnetworks
C:/Program Files/[any folder or file with Movieland in the title]
Also delete ITBills and fsupport if they are present (Thanks to the commenters below for letting us know about these variants!). Also anything with Notification or Notifier in the name is highly suspect and should probably be deleted.

Hopefully that does it!

In my experience, deleting these files has successfully cleaned Movieland. So, the hijacking and pop-ups should stop now. But, it's possible there's more than one version of Movieland, so if this doesn't work, you could get serious and do some of the more thorough and time-comsuming steps here:

http://forums.techguy.org/security/421861-movieland-media-pipe-spyware-removal.html

or here:

http://www.bleepingcomputer.com/forums/topic36432.html

Also, if you had Movieland, chances are good you have other spyware infections as well. So if you have the time, you really should also do the steps in the Preventing Spyware Problems article here: http://home.vcn.com/knowledgebase/article.php?id=346
 
:bounce: Thanks Tedster and anyone else's computer infected by Movieland use his advice first because ITBILL needs to be removed in safe mode and he has the tips to do it. As a matter of fact, I would just go ahead and remove all files mentioned by Tedster in safe mode first. I managed to delete them all in safe mode without using killbox. I had the altpays, itbill, fsupport,mediapipe,p2pnetworks, and movieland. exe's but no notification ones. No pop ups ever since :angel: Also thanks to this website as well
 
Nice post tedster, this should be made a sticky in the "Sicurity AND THE WEB" fourm, this will help alot of people
 
Status
Not open for further replies.
Back