Programs won't open, lost our antivirus somewhere, ghost files

Hello

I was refered here by the Malware Tech NoodleTech who helped us clean up our system Thank you again NoodleTech.

We are Vista users. Our system was originally hit with the fake spyware virus, got that all cleaned up with help from NoodleTech in Malware forum.
fake anti virus: slow sluggish system and things are wrong, tried to self fix now all programs need to run as admin

Now our problems lie somewhere else. In note form it is the following:

- Some of our programs don't open on a simple click, you have to right click and run as Administrator.
- When opening some programs system prompts to choose which program to open it with and all the normal programs are no longer there. Programs include Backup and Restore Center and Windows Alerts that cannot be opened.
- All these problems were originally on a user account but are now appearing on the administrators account.
- While browsing C: drive I noticed my Recovery D: was nearly full so now I would like to know what happened to my original backup so I can reset everything to factory settings?
- On the desktop there are "faint" outlines of files there that weren't there before, when I checked the properties of these files it stated they were "configuration settings (ini)" and I have no idea what they are or how they got there. There are 2 of them.
- We usually ran with AVAST, took off what it found, uninstalled it, installed AVG, ran that and took off what it told us to and then left AVG on the system. Now we can't find it anywhere and no one uninstalled it.
- Windows Security alert red shield is on in bottom right corner of taskbar, cannot access it but when I went to control panel, apparently Defender and Firewall are up and running. So what gives there?

The system is running and starting up a lot faster now after all the garbage was taken off, there's a plus

If someone can please advise me on how to proceed I would greatly appreciate it. I am not an idiot with computers and I'm not an adept either…. just so you know.

If you need more information please don't hesitate to ask and I will do my best to help you help me.

Miura.

Reason for edit: Add link to malware topic

I just tried to check out all the updates again for my system. Went to Help and Support - software, drivers and bios update…. Windows update when clicks does nothing. HP update when clicked gives troubleshooting tools window stating the "Software program is not found."

HI Miura.

Give this file association fix by Brink a try: Vista - Default File Type Associations - Restore, see if that helps with some/most of the problems.

Post back with results and any additional problems please.

Hi ZTruker Thank you for your help I've been working and haven't been able to get back before now. I downloaded an exe file from the restore and it seemed to work for some of our programs. I also downloaded fixcleaner and it logged us as having over 8000 errors all over the system. We fixed those, ran the fixcleaner again and came up with no errors. The system is fast to open up to the desktop but the programs we have in our start up are very slow to load. We are still being asked what program we wish to open firefox, adobe, etc with and our list to choose from is still very short. We found all our bookmarks that were lost somewhere in all this transitioning so that's a plus. As far as I can see there are no other issues outstanding. We haven't use the computer to run games or anything yet so we don't know how that will turn out until the kids start playing again. I am still perplexed as to why my D: drive is nearly full when last I looked at it, it hardly had anything on it. Someone told me that backups might have been placed on this drive (I haven't done a back up since I started the computer on my first day.) and now I'm worried that I won't be able to recover any factory settings. Approx 6,15 GB has been placed on there and I don't know what to do about that. I have 715M left……. Any suggestions? Miura

Hi,

Approx 6,15 GB has been placed on there and I don't know what to do about that. I have 715M left……. Any suggestions?

Almost certainly that partition (D:) is the special "Factory Restore" partition that allows you to put your machine back to its "out of the box" state.
It is for use when you need to format and reinstall your operating system, Please note that using it clears everything on your machine, so it should not be used casually…its for when you cannot get your machine working correctly in a timely and cost effective way by the normal means, and then its invaluable in enabling you to return your machine to its out of the box or factory condition.and in a very short space of time.

Its always a good idea to make sure your back up is up to date and with an extra copy kept safe on removable media, offsite, and you should certainly ensure that is done before using the "factory restore" via your d drive.

You should not try and access the Recovery Partition, add anything at all to it or remove anything from it, just leave it be…so its ready to get you out of trouble should serious problems arise that cannot be fixed in the usual way.
Post back if you need clarification on any of this
Regards
paws

That is most likely data written there by System Restore or Shadow Copy.

Turn it off for the D: drive and those files will be removed.

Control Panel, System.
Click on System Protection at left.
Select the D: drive and click Configure.
Select Turn off System Protection.
Click Apply then OK.
Click Apply then OK.
Close System window.

Thank you I did check it and the D drive wasn't even checked for System Restore. As far as I can see there are no backups or restore points being saved there…… anymore. Perhaps there were in the past. I was in the kids user…. went to control panel, system, system protection…. then received the following error: C:\Windows\system32\systempropertiesprotection.exe Application not found. I switched to the Admin User and it was fine. I have not had any problems before accessing anything as I have the administrators password. Would this be because it's a sacred part of the system and no one other than the Administrator can access it? Or are their files missing? I didn't have problems accessing from Admin user. Miura

Open Control Panel again and then Folder Options. Click on the View tab.

Select Show hidden files, folders and drives
Uncheck Hide empty drives in the Computer folder
Uncheck Hide extensions for known file types
Uncheck Hide protected operating system files [Recommended]

Download, install and run TreeSize Free. Select the D: drive. It will tell you exactly what is using drive space.

Once done with this problem, you can put Folder Options back where they werte originall if you like. Definitely check Hide protected operating system files [Recommended] or you will be seeing a lot of stray files you don't rtecognize.

Thanks Ztruker I got the program and ran it. there are various files too numerous to mention here and it will take me a while to go through them and figure out what they are. Some are really super old game files that came with the operating system when we bought it. when I finish going through the log I will ask whatever questions I need here and then….. One error that continues is a "rundll32.exe" error when we click on the security alert on the task bar. I'm not sure what program to open it with then I am prompted so I tried IE. Then it wanted me to run a file of the same name. I downloaded an exe fix from a previous posting so I'm going to go ahead and run it when it asks me to again. Am i heading in the right direction here? I am also going to reinstall a different antivirus. Miura

Ok. So Treesize didn't automatically scan the D: drive. Do I feel stupid. Here's a paraphrased version of what the log file said: PRELOAD is 67% of parent … last change was 2008 hp 28.8 % of parent… Last change was 2008 SOURCES 3.6% last change was 2006 boot 0.3% last change was 2007 RECOVERY 0.9 MB last change was 2006 when I bought it I'm not sure what I am looking at here. 84% of the of drive has been used here. Someone told me that once you've backed up a system onto the recovery drive of a Vista system then it's next to impossible to recover your system to it's beginning state. I don't want to do a recovery, I just want to know what my options are in this scenario. All of the advise and help I have received here as been exemplary and greatly appreciated. I still have the rundll32.exe thing happening Miura

Everything you report on the D: drive sounds like it's part of Recovery so don't mess with it. Have you created a set of Recovery Discs? I believe HP provides a way to do that. What is the model number of the computer? Another alternative would be to order the Recovery disc from HP then wipe the D: drive and merge it's space into your C: drive. If this was my computer, I would back up my data and use the built in Recovery option to restore it to it's factory new state, basically start over again. Some time removing malware causes more damage than can be fixed and the only way to fix it is to start over. I know after all the work you did in the malware forum this is not a very palatable idea but I think it would save you a lot of continued grief. How you get to it varies but often it's by pressing F11 during boot, or Ctrl+F11. Your users manual (online or a link off of a Start menu item) will tell you how. If you don't want to go this route, I understand and will continue to work with you to resolve what we can, but I wanted you to have ll the options.

Hi I cannot put my hands on the recovery discs I made from when I took this system out of the box. I have a few other places to look The model is Compaq Presario SR2177CL ??? What would be the purpose of wiping the D drive and merging it into C? Would Vista still run well with that done? Perhaps this would be a good time to install XP, which I liked better than Vista. There isn't anything that is stopping the basic usage of this system as we can get past the errors with not to many problems. I have a few other places to look first before I scrap this entire set up and start from scratch. I will look into HP options if I cannot find the recovery disc. Miura

What would be the purpose of wiping the D drive and merging it into C? Would Vista still run well with that done? Perhaps this would be a good time to install XP, which I liked better than Vista.

Once you have the Recovery Discs you don't "need" the D: Recovery Partition any more, though I personally prefer to restore from there as it's much quicker than from DVD. The only reason I suggested it was to make the space usable for you, but there is really no reason to do so.

You can order the Reovery Media here: Software & Driver Downloads - Compaq Presario SR2177CL Desktop PC, under Recovery Media.

Ztruker Ok I understand. I think I'm going to order the recovery discs as I have not been able to put my hands on my original. Once I perform the recovery from the discs will it clear out both my C & D drive and set it all up like I just bought it? I think it would be easier for me (non computer person) to keep the recovery drive set up in case I need to do this again in the future. I'm going to guess this is a pretty clear cut procedure (instructions come with the discs?) so………if you have advise for me I would greatly appreciate it. Thanks for the link you're so efficient. Miura