Beatrix

No, I just remembered something. I wrote my post incorrectly. I was not able to scan these folders with a right-click. I was surprised that I couldn't scan anything at all in the registry. That's why I sent them to the desktop, thinking that I could do so when they were not in the registry. This is when they activated somehow. Sorry. I had been scanning other stuff on my computer and got the situations confused. Thanks.

I was running Ccleaner the other day and decided to run the registry cleaner part. I've avoided because I read here that if you don't know what you're doing, you can harm your system. Well, it came up with a System Security program folder that had some kind of orphaned files. I then located the folder itself, right-clicked, and scanned with Avira, Malwarebytes, and SUPERAntispyware. They all found nothing malicious. I looked around some more and found what appear to be legitimate Windows files with the name "System.Security." (Note the period.) After scanning the odd System Security folder, I right-clicked and copied its two files to my desktop. Sometime later, I clicked on one. (Why? I don't know. Not very bright.) Malwarebytes instantly popped up and quarantined it as, something like, "a malicious process is trying to run on computer." The same thing happened with the other one. (Yes, I did this again.) I was wondering why these were not discovered when they were apparently orphans. It's not just Malwarebytes, but every legitimate virus, spyware, adware, rootkit scanner in existence that didn't catch this folder. These rogue files have been in my system since July 11, 2009. Are they too deep in the system (HKey something?) to be detected? Is there a scanner that actually roots out deeply hidden stuff like this? Also ... when I clicked them, why would that trigger Malwarebytes if they were no longer attached to any executable program? (It must be noted that MBAM was the only one to react, and it was lightning swift.) Finally, I can find no method in the MBAM program to send these files to MBAM's lab techs for inclusion in the database. Is there a way to do this? They remain in quarantine with the Reference numbers 17769, 20707, and 34687. Thanks. Charlotte

Just as a general update: I was able to talk to a real and helpful HP person by phone, and they e-mailed me yesterday that they are overnighting the recovery disks to me. They comped them, which was nice. They did specifically search for disks that matched my Workstation model number, so anybody who is running into similar issues might want to consider calling HP before trying a third-party vendor solution. The gentleman I spoke with at HP thought it was okay to try repair first, but of course, he is recommending I back up first. (He also thinks it is possible, based on my issues, that I'll need a complete reinstall.) I've been doing some piecemeal backups. Anything that I can easily redownload I am excluding; vendors for paid software will help if there are registration issues. I can't back up the entire system through HP's backup program because of "not enough space" in the recovery system. I don't get it, really, but I will just move on to an alternative suggested by the HP guy. I have a Maxtor external backup drive that I used to use with my old Dell with (I think) 1 GB space. It might be better for me to upgrade, as that might not be sufficient. Is there a good alternative for someone like me with no real technical savvy? I'm good with concepts, but poor at execution and depth of understanding, especially if I am being presented with choices that I don't understand if they are loaded with technical terms. I'm looking for something that will allow me to pick and choose what I do restore/copy over to my new system rather than dumping it all. Easy to follow instructions are also important. Any ideas? Noknojon, I actually do have a post in the HijackThis forum that goes back to Jan. 24. I haven't bumped my thread, alerted anybody, or contacted paid support because I'm not sure my issues are as compelling or immediate as some others and feel that I can wait for someone to be available. I will most likely try to wait on doing a repair on my system until I do get some feedback over there just to see if there are hidden problems that might be discovered through the process. Thanks. :-) Charlotte

Thanks, mountaintree. But.... instead of wrapping it in code, I clicked "url" or quote or something totally wrong. And to make matters worse, these were links to really really bad stuff. (What??? ) Don't get me wrong here. I think I'm a pretty decent/okay person and all that, so I don't have an inferiority complex or anything. But let's face the facts here. Clearly, I'm a danger to the community!!! lol Let's just say I think I need to curtail my posting. I love this forum, so I'm not going anywhere. I'll be kind of busy, anyway, starting next week. I don't mean to brag, but though I'm not so hot at posting, I'm really an awesome lurker. Charlotte

I agree with you. This was a particularly bad error on my part. It's probably safer for me to lurk around instead of blundering around posting. Thanks. Charlotte

Thanks, Mountaintree. I tried to alert, but I think I didn't got the link to this thread sent to the person correctly. It looks like something went wrong. If you google for tech support forum dot com, then click on the "more results from... " link, it shows a lot of pages from Tech Support Forum marked as "This site may harm your computer" by Google. It is usually the ones asking for help with infected systems. That's a good site that helps a lot of people. (Even though I put it in code, I was afraid to actually put an address in there.) Thanks to the moderator who edited my post. I appreciate it.

Thanks, Mountaintree. Can somebody make them unclickable? They are not good links.

If you Google the IP, just the number, you get about three pages of links about people (web site owners) getting malicious code written into their websites that includes that IP number. The IP is said to have trojan backdoor, according to Norton. Threats found: 2 Here is a complete list: Threat Name: Trojan Horse Location: <a href=hxxp://91.201.28.6/spb.exe></a> Threat Name: Backdoor.Bifrose Location: <a href=hxxp://91.201.28.6/goods/l.php?i=16>/<a> I guess it could be just something on the page. MBAM will block certain smileys on forums I frequent, but leave everything else. But the "backdoor" thing makes me a little queasy. Norton wasn't the only one to designate it this way.

This is strange, but when I try to go to the Tech Support Link listed above, I get an alert from Avira and a malicious IP address block from MBAM. This also happened earlier with that site. I was trying to find out about HP computer issues earlier this evening and also clicked on a link to that site (91.201.28.6), and I got the same message. I'm puzzled. I think I've visited there before with no trouble. Am I being redirected to another place or something?

You're right, YoKenny. My problem with Avast ultimately isn't FPs anyway; it is the freezing up. The issues will be worked out, I'm sure. They do appear to be working hard on it. As to FPs, when you're not that savvy about technical stuff, it's hard to discern what is FP and what is real, especially when it comes to visiting websites. It is something that we all have to live with, though, with any security product. Thanks. Charlotte

Thanks for the link. I did not see that before. I thought I read all the great help files here, but I missed that one. I'm going to call HP and see if I can order recovery disks, as the support people online are strange or just don't show up. Thanks again. Charlotte

Support is 24/7 for a business customer. I have a Workstation, so I got shuffled into that area of support when I selected my system and computer. I left the chat anyway because I got the message that someone would be with me shortly but I think the connection got lost. I didn't know it was okay to borrow a disk of someone else. I'm trying to think if I even know anyone with XP Pro and even more so whether they do something different with Workstations so they hook up together. Hmmm... something to ponder.

I thought with the Pro version there was an option of repair without a total wipe of the system, but I got that from a friend who may not really know. There are just generally broken things in my system. Control Panel is hit or miss since Vundo (will it open or won't it?) and the other link from my Start Menu to set program access and defaults is dead. Uninstalling programs is worse than ever. I suddenly had trouble with the system recognizing CDs and it refused to acknowledge perfectly good DVDs. Just a whole bunch of goofy stuff that happens day to day. IE refuses to load pages sometimes. It's gotten worse since my failed attempts to install firewalls, but it's been bad for a while. Just lockouts. I'm online right now with HP support live (but there is no live person at the moment). First I went through a strange interlude with one support person who told me he/she was not experienced with Notebooks and was giving me a new link to a new support person. I don't have a notebook and said so, but the person kept insisting a Notebook expert would join me shortly. Mind you, they scanned my system before talking to me, so they have the information right in front of them. Now I'll probably be sent back to a desktop expert and get the same person I had.

Thanks so much for your instructions. I don't remember reading that I needed to put in a disk first. (I think my system is broken in this regard because it probably should have flashed a message like "insert disk.") It's an HP XP Pro SP3. The problem is, I was never given a disk. Some manufacturers ask you to make your own, and HP is one of them. But the backup disk system never worked properly and it gave me error messages from day one. Rather than call HP and get it straightened out, I promptly forgot the whole thing. I do copy important stuff onto DVDs and CDs, and I did just install a free program that takes some kind of image of your system. It's on several DVDs. But that doesn't help in terms of restoring the system to its original state. It just takes a picture of the faltering setup I have now. My laxity is an issue here. Maybe I should try to order a disk from HP. I think they still offer them.

I probably did not remember the heuristics settings from when I first installed Avira. (Actually I probably didn't know what it was, and I wouldn't doubt if I set it to "high" thinking more is better. ) I have to agree with you about Avira, though. I reinstalled it and I'm liking it again. This time I did see the expert mode you're talking about because of the settings issue brought up here. The FP on the HP printer software was Avast. Not that Avira isn't capable of doing something similar. It's just that I was aggravated with Avast not only because of the system freezes, but the printer software thing set me back. It was an easy fix. HP's download was smooth, but I'm supposed to get some contracts signed and scanned over for a new job I'm doing and I'm late with it. I have to get this computer in top shape for work next week, so it's been hectic. Thanks for the feedback. I'll start noticing things Avira flags and put in under exceptions.