Is someone sharing Windows 7 with me?

[cottonball]

A flash drive/pen drive, how many GB is it?

 

[nottaclue9]

16 GB. I have a lot of music which I have downloaded from subscription services. It will be lost, I am sure. Will the iTunes stuff be saved? I have many other "keepsakes" I cherish that will probably have to go, too. This is pretty drastic, right?

 

[cottonball]

Are all these things you mention in the flash drive, or is there stuff that you would like to keep, and is still located in the actual computer?

 

[nottaclue9]

The MOG music is probably temporary. I don't actually know what I'm talking about. I have saved emails (the ones from my dad I would hate to lose), pps, photographs, iTunes playlists, etc. The last time I had to change computers I lost all of the email stuff and MOG music files. There were other things, too, but I apologize that I can't remember them all right now.

Is there any other scan I can run besides mbar that would tell us if this computer is clean?

 

[cottonball]

Is there any other scan I can run besides mbar that would tell us if this computer is clean?

We did not make much progress, the info obtained showed a Rootkit, and intially having an FBI ransomware infection was not a good thing.

At this point there is no way to give the system a clean bill of health, and at this point, an HP System Recovery would be best.

Do you have a relative or friend who can assist you with a Recovery?
These matters, like malware removal, can get to be challenging at times.


The following websites from HP provide guidance on what to do:

Back Up Files Before Recovering your Computer (Windows 7) HP Pavilion p2-1120 Desktop PC | HP® Support

Performing an HP System Recovery (Windows 7) HP Pavilion p2-1120 Desktop PC | HP® Support

Also, please ask for guidance in doing the HP System Recovery to factory settings for an HP Pavilion p2-1120 Desktop PC at the following HP forum:
HP Support Forum - HP Support Forum

The HP advisors at the above forum are much better qualified to guide you through the process.

Good luck, nottaclue9!!

 

[nottaclue9]

You're a prince, cottonball. Thanks for sticking with me so long and for giving me an honest diagnosis as well as some helpful links. I know another computer guy who might be more knowledgeable than the last one I used, so I'll see if he can help with the recovery. You have been beyond patient, and I appreciate all you've done to guide me through this. I know it's been an ordeal.

May your next computer job be more rewarding than this one!

 

[cottonball]

I know another computer guy who might be more knowledgeable than the last one...

That's what you need!

 

[VistaKing]

nottaclue9

I would recommend doing a clean install rather then doing a factory recovery which will bring back all the bloatware that came with your PC from day one . Look at the link below on how to get a clean installation

:ar: http://www.sevenforums.com/tutorials/219487-clean-reinstall-factory-oem-windows-7-a.html

Take a close reading on Step 1 . It will have a link where you could download a legit Windows 7 ISO to install Windows without the bloatware .

 

[nottaclue9]

Good idea, VistaKing. Still, this is something I don't want to undertake by myself. You can tell that I don't know what I am doing! My situation is this: My dad is elderly & out of town. I have to go tomorrow to stay with him for about a week. I will just turn my computer off when I leave and then start figuring out what to do when I get back.

One more question? Last night I ran my free version of Malwarebytes because the computer was not acting right. I ran the full scan, and it found this: Trojan Agent C:\Users\Judy\conhost.exe. Is this what is in the rootkit?

 

[VistaKing]

Yes that has to go . That conhost.exe file doesn't belong in that folder . When you ran the MalwareBytes program and that was located did you place a check next to it and click on CleanUp then restart the PC and run another scan ?

Download the Farbar Recovery Tool once more

Click here :ar: FRST choose 64-Bit Version

Save it your desktop .

Right-click on the FRST64.exe and choose Run as administrator

When the tool opens click the Yes button

Press Scan button.

FRST will let you know when the scan is complete and has written the FRST.txt to file

Upload the FRST.txt file . To see where we are .

 

[nottaclue9]

Yes. I cleaned it up and restarted. I'll run Farbar before I leave today.

 

[nottaclue9]

I'm trying to do too many things at once (packing, etc.). Would you please tell me one more time how to get that huge file onto the message board? I remembered to copy, but how do I save it to upload it?

 

[VistaKing]

To upload files to the forum

Click on Go Advanced next to Post Quick Reply. Then click on Manage Attachments . Click Choose file locate the FRST log then click on Upload

 

[nottaclue9]

I can't figure out where the log is. It doesn't get save to my documents, and when I browse I can't find it. Sorry to be so dense. No sleep + no clue = headache for you!

 

[nottaclue9]

I tried selecting "Desktop" when I was browsing from the message board, and entering "FRST.txt-Notepad," which is how the Farbar document is saved in my tray. But it is unrecognized. Don't kinow how to get it located some place I can upload it.

 

[VistaKing]

The file should be created in the same location where you ran the FRST64.exe file from.

 

[nottaclue9]

I don't understand what that means. In the desktop FARBAR icon?

 

[VistaKing]

Did you save the FRST program to your desktop yesterday ? If so the FRST.TXT log should be on your desktop.

 

[nottaclue9]

The recovery tool is saved to my desktop. I see the document you want when I look at it by itself on my desktop, but I cannot upload it. A pop-up blocks it. I cannot upload anything from my desktop from "browse."

 

[VistaKing]

Can you open up the FRST.txt file . Go to Edit click on SELECT ALL . Click on Edit once more and choose Copy Ctrl+C . Then on the Sevenforums . Under the Message box right click and choose Paste . Hightlight the all of the text by right click on an empty spot inside the Message box and choose Select All. Then click on the Number symbol ( # ) . That should wrap the entire text between [CODE][/CODE]