Pegasus1

[Coreygcven12]

Every time I try to restore my computer to factory using the windows 10 recovery USB provided by HP. While it is installing I notice it's installing "FBI debug". now from what I've gathered HP thought they were being clever and claimed it was just a "conspiracy joke". Well this may be true but there are defiantly some other inconsistencies with my operating system and computer itself. Just to name a few:

1.The pc is automatically connected to a home group and I don't have administrative privileges to open numerous files.

2.when I try to copy the files to a USB drive, a "task" has been written that, changes the driver, reformats the drive, adds a network partition to it, and copies over only a select few files.

3. iTunes is automatically installed during the clean install.

4. I'm still connected to a wireless network even when the network adapter has been pulled out and antanas removed. Which changes its host following every reinstall or windows.
**after performing a ping test I resolved the host to the following I.P. 127.0.0.1**

5. Settings are automatically placed on developer mode and permission for bootloaded apps is granted.

6. Files still remain on computer after I chose not to backup files.

7. Numberous drivers and apps that I've found little to no information about are in a repository and a lot of them are being ran on my computer.

8. Remote access... I cannot turn off remote access and if I cmd prompt the services being ran on a net user there are multiple workstations and servers running.

9. As soon as I start to investigate the computer wipes my user name and I have to start the process all over again.

10. A program Named Pegasus1._NN1KB2 is installed and I have the scrip for it if needed. But I've never heard of this file before.

11. Log files are created for locations I travel to even when the lap top is at home, as I found log files that had detailed information on my exact location, down to the business name and address.

Can someone please help me regain administrative access to my computer.

[mdklassen · Accepted solution]

> **after performing a ping test I resolved the host to the following I.P. 127.0.0.1**

This is the "loopback" IP-address.

When a program uses TCP/IP to send a packet to another computer, the packet is routed through several layers:

* the internal software-only TCP/IP software on your computer,

* the IP-address assigned to your network adapter (wired or wireless) hardware,

* wired/wireless transmission to the "internal" IP-address assigned to your router,

* inside the router, from the 'LAN' (Local Area Network) port to the 'WAN' (Wide Area Network) port that is connected to the cable-modem (or DSL-modem) provided by your ISP( Internet Service Provider),

* over the Internet.

TCP/IP uses a "client/server" model.  Your program, e.g., Microsoft Edge is the "client", and the remote web-server is the "server".

But, it is also possible for the "server" to be on your computer.

In that case, the TCP/IP packet needs only to be sent to the internal software-only layer, which delivers the packet to another process running on your computer -- the packet "loops" through the software, and "back" to your computer.

In this case, when there is no need for the packet to actually "touch" your networking hardware, the IP-address assign to this "loopback" interface always is 127.0.0.1

Some anti-virus software creates a "server" on your computer.  So, your E-mail program, when trying to download a message, "loops-back" to that server, which virus-scans the incoming message, before the message is sent to your E-mail program. 

Compare this "loopback" to having a police-officer standing at your front door.

If an intended visitor is verified by the police-officer, the visitor is allowed to enter your home.

The police-officer is acting as a "proxy" for you.

Now, I think that it's possible that the files on the USB memory-stick have become virus-infected,

or that a virus on your computer has infected the files on the USB memory-stick.

You may need to get a replacement memory-stick from HP.

You may want to virus-scan the memory-stick, after carefully connecting it to another computer.

You may want to boot a "disk-wipe" program from CD media, and have it "wipe" 100% of your disk-drive, by writing "zero" values onto every block of the disk-drive.

[Coreygcven12]

Thanks a lot! Your explanation was very helpful. I'll implement the boot "disk-wipe". I'm assuming to use a write only disk, just in case there is a virus so it's unable to alter the media, causing it to be currupt as well?

[mdklassen]

> I'm assuming to use a write only disk, just in case there is a virus so it's unable to alter the media, causing it to be corrupt as well? 

If you prepare the bootable "disk-wipe" software on a "trusted" computer, and burn the files to a CD-R ("write once, read many times"), and boot your computer from that CD-R, there is not way that any existing (malicious?) content on your computer can be launched.

How old is the current disk-drive?

If it is "old", or therwise "out-of-warranty", it will be proactively good to buy a brand-new disk-drive (faster? larger capacity?) and install Windows onto it. 

Put your current disk-drive aside, because it contains all your Personal Files.

Complete the installation of Windows, by repeatedly running Windows Update.

Make sure that its anti-virus software is up-to-date.

Then, connect your current disk-drive as a "secondary" disk-drive, and copy all your Personal Files from "old" to "new" -- your anti-virus software will intercept and block any attempt to copy a malicious file.