Neighbor's computer seriously infected.

I recently tried to work on a neighbor’s computer and it is messed up.
(I think he opens a lot of E-Mails no matter who the sender is.)
The computer runs Windows XP.
The problem mainly consists of the computer running for about 5 minutes and then completely locks up. (Mouse arrow stops, CTL/ALT/DEL won’t work, etc).

The best I could do was getting to a DOS prompt. At least it did not crash in DOS no matter how much time went by. So, I did a “chkdsk” test and then it said that using the /F would automatically fix the disk errors. When I did that it said it couldn’t work because some other application was running. I have no idea what other application may have been running unless a virus or worm is really screwing things up. The only other thing I thought I could do at the DOS prompt was to use “recover” but I have heard that “recover” can seriously mess things up too.

Any suggestions are welcome.
Thank you.

CHKDSK is a DOS utility. I’m not on an XP box at the moment, but IIRC there’s a scandisk of sorts that you can run when XP boots that I think would accomplish what you are trying to do. The DOS prompt on XP isn’t really a DOS prompt. It’s just a DOS emulator of sorts that runs under XP. XP, and all other NT operating systems (win2k, NT 4.0), don’t have a DOS mode. You probably get some bonus points for remembering how to do a CHKDSK, but you generally don’t want to do DOS things on XP. You want to do it the way XP wants you to do it instead.

You can boot from the XP CD and do a re-install, and select “repair.” You might not need to do something this drastic, though. If your neighbor doesn’t have a virus checker, get one IMMEDIATELY. If they don’t want to pay for one, AVG (http://www.grisoft.com/us/us_index.php) got good ratings from the guys on tech TV.

After a virus checker, download ADAWARE and SPYBOT. You should be able to find both from a simple google search. If you get enough spyware on your system it can cause weird things to happen, including locking up your computer.

Actually, he has PcCillin and Spybot on his computer. (I recommended these the last time his computer got messed up - about 6 months ago). However, I do not think he uses these at all.
So, maybe your suggestion about doing a re-install might be the only way to go even if it is drastic.

If you get it running, then check out http://www.microsoft.com/security/ for suggestions on firewalls and other steps to take to a least make it harder in the future for your friend to get back into trouble.

If you have to reformat and start over, put a partition on the drive so that in the future data can be saved in the partition, which probably won’t be infected, and won’t be lost.

Before you break out the virus checkers the problem you are describing sounds like what can happen when a system gets swamped by layers of spyware, crapware and malware piling up on top of each other. I’ve seen some systems simply stopped in their tracks by this.

Downloading adaware and spybot (both are free) will tell you if you are infested. Be aware, however, that people who allow this to happen usually have no clue re PC and net use precautions and are likely to become infested all over again in short order.

Absolutely. I did a clean-up job on a friend’s computer, and between Ad-aware and Spybot found nearly 1800 pieces of spyware/malware/etc. Her teenage son (primary user) must have clicked on every link in creation to download all this crap. I cleaned it all out, and then told her I would have to come back another day to fix a few remaining things. I also left a note for her son to stop downloading things certain things, because he was fouling up the computer, and wrote instructions for running Ad-aware and Spybot weekly.

As it happened, it was a couple of weeks before I was able to go back to “finish” tweaking things. Just for grins, I decided to run Ad-aware and Spybot first. Another 250 pieces of spyware! :smack: And some of the same junk I removed the first time. I predict that that computer will be completely fubar again by the end of the summer.

a pc general clean up might help too, after you run the virus scan and remove spyware.
search for and delete all *.tmp files, even 100 can make a difference to the performance of the pc

Another common cause of the problems you are having is too many programs that launch automatically at windows startup. Go to Start/Run, type msconfig and hit OK. Select the Startup tab, and close unnecessary programs. Thjis would be almost everything except Explorer, and perhaps a virus program and firewall. To find out if programs are necessary, try looking them up on this site.

The important points I want to stress are

  1. Working at the DOS prompt allows me unlimited time.
  2. Working in Windows usually gives me 5 to 10 minutes until the computer locks up and has to be restarted.

As engineer said, it might be unwise to do anything through the DOS prompt since XP isn’t truly a DOS based program.

As far as running Spybot, etc it is impossible to let it run all the way through. I was able to let it run about a minute and then delete the dozen or so crapware files it found. But I was able to do this only once. As you can see, this computer is really fouled up.

What happens when you boot into Safe Mode?

Maybe an idiot’s question here, but when you run Ad-aware and Spybot, which are you running first? The reason I ask is that when I was dealing with my aforementioned friend’s PC, I ran Ad-aware first and it hung on me every time I tried to get rid of stuff. When I switched around to running Spybot first and then Ad-aware, I was able to successfully delete all the junk.

It seems with the particular infestation I was facing, Ad-aware was freezing on processes that were still running. In using Spybot first, I was given the option of running Spybot on re-boot to get rid of said processes before they launched. One that was done, Ad-aware did its thing without further trouble.

I followed these instructions and it helped a lot. Also download and run CWShredder.

I sorted out a computer yesterday that was a mess with viruses and spyware (including the sasser worm, which made it difficult even to download any fixes; I did this:

-(On another machine) Download the sasser removal tool from here (I printed out that page and also this one. - running this tool on the infected machine found and fixed 8 instances of the worm; this made it possible again to get online using the machine.

-Installed AVG antivirus from here - Updated the definitions and ran a full scan which found and removed 10 viruses and trojans.

-Visited Windows Update and applied everything available (takes several visits and restarts and I always keep going back until there are no updates offered, because sometimes you install what appears to be the last of the updates (say an IE or Media update), only to find that the new version has security holes that need additional patches).

-Downloaded Spybot from here - running this detected and removed a couple of dozen items of scumware, some of them benign, others obnoxious.

-Downloaded and installed Sygate Personal Firewall from here.

It was like a new computer afterward (OK, some of the programs that the user had installed (such as file-sharing utilities) didn’t work after their spyware components were removed).

Fear Itself Interesting suggestion. I never thought of running in Safe Mode.

Sunfish I ran Spybot first, but thatnks for the suggestion.

Mangetout - Your approach might be the the best one because it assumes the computer is really messed up. (worms, viruses, spyware, etc). I’ll try your suggestions.

If the computer is running NTFS, then you should set up a non-privileged user account for day to day use. Only when something needs installing should they log in as an administrator.