Help got virus etc on laptop and no antivirus in place

dogmaryxx

Maverick1984 wrote: »

If the problem is more prominant however, use a tool called Combofix which is also free. It's a utility which will only run in safe mode and cleans all low level spyware on registry level.

News to me.

Browntoa

an1179 wrote: »

I did download programmes to laptop in safe mode then the request for payment came up . I need to transfer the files I have downloaded onto my pc ontio a DVDR to put into laptop but having problems with that at the moment. Not sure where I am going wrong tried highlighting and moving to DVDR - not working tried highlights cut/paste not working.

download this

http://www.filehippo.com/download_imgburn/

install and burn the file to the dvd

you want "write files/folders to disc"

dogmaryxx

Detailed instructions for removal can be found here.

Scroll down to
Automated Removal Instructions for System Tool using Malwarebytes' Anti-Malware:

Try directly on infected computer before worrying about downloading/burning etc.

an1179

I had downloaded ImgBurn and I lthought I had burned malwarebytes and PC Tools securrity followed by Combo
I have only got shortcuts on the 1st 2 which I thought I had copied from programmes and the complete Combo which i copied from Applications - My Documents
OMGoodness I am useless at this

spakkker

Can you download combofix to the laptop using safe mode with networking ?

http://www.bleepingcomputer.com/download/anti-virus/combofix

Save to desktop if you can.

Browntoa

and attempt to then run it in safe mode

Toxteth_OGrady

an1179 wrote: »

I had downloaded ImgBurn and I lthought I had burned malwarebytes and PC Tools securrity followed by Combo
I have only got shortcuts on the 1st 2 which I thought I had copied from programmes and the complete Combo which i copied from Applications - My Documents
OMGoodness I am useless at this

It sounds like you are downloading and then installing the programs on your PC, then copying the shortcuts to DVD.

Skip the installing part. When you go to the website to download and click on the download link do not select 'run,' select 'save.' This will put the installer file in your default downloads folder on your PC (Documents or Downloads or Desktop or whatever). You then need to browse to your default download folder and find the installer file(s). That's what you need to ImgBurn to DVD.

an1179

Toxteth_OGrady wrote: »

It sounds like you are downloading and then installing the programs on your PC, then copying the shortcuts to DVD.

Skip the installing part. When you go to the website to download and click on the download link do not select 'run,' select 'save.' This will put the installer file in your default downloads folder on your PC (Documents or Downloads or Desktop or whatever). You then need to browse to your default download folder and find the installer file(s). That's what you need to ImgBurn to DVD.

Thank you I think I am getting somewhere now. Have got Malwarebytes running scan and downloading pctools - watch this space

Separate issue
I think i have duplicated my programmes file I have got
programme files properties 655MB / 2515 files /475 folders
programme files (x86) properties 5.54GB / 17022 files/1820 folder
sbut I will deal with that later I think
both modified 22/02/2011

Thank you every one for helping me so far

an1179

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 5838
Windows 6.1.7600 (Safe Mode)
Internet Explorer 8.0.7600.16385
22/02/2011 11:01:22
mbam-log-2011-02-22 (11-01-13).txt
Scan type: Full scan (C:\|)
Objects scanned: 256943
Time elapsed: 21 minute(s), 30 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 3
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 7
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NVIDIA driver monitor (Worm.Rimecud) -> Value: NVIDIA driver monitor -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\MicrosoftWindows (Trojan.Agent) -> Value: MicrosoftWindows -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce\MicrosoftWindows (Trojan.Agent) -> Value: MicrosoftWindows -> No action taken.
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (http://redirecturls.info/) Good: (http://www.google.com) -> No action taken.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\Windows\nvsvc32.exe (Worm.Rimecud) -> No action taken.
c:\Users\nashlaptop\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\2ZVAG8ED\facebook-pic0009206951100-jpeg[1].exe (Worm.Rimecud) -> No action taken.
c:\Users\nashlaptop\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\XO721CP2\gus[1].exe (Worm.Rimecud) -> No action taken.
c:\Users\nashlaptop\AppData\Local\microsoft\Windows\temporary internet files\Content.IE5\XO721CP2\gux[1].exe (Worm.Rimecud) -> No action taken.
c:\Windows\temp31233724419.exe (Worm.Rimecud) -> No action taken.
c:\Windows\temp3123376123.exe (Worm.Rimecud) -> No action taken.
c:\Windows\temp31233764419.exe (Worm.Rimecud) -> No action taken.

dogmaryxx

You need to select and remove/delete above in Malwarebytes else pointless running it.