defeated and demoralised

jonnyb

An old friend has asked me to look at his pc which has stopped functioning after his grandkids were using it (on internet I think, but he's not sure.)

I'm self taught and usually OK at fixing simple faults, but this has me confused. Just wondered if any of you have seen similar symptoms in the past.
This is not critical, coz I'm giving up anyway and telling him to take it to a real expert and pay to get it fixed, but if there is an answer to this I would like to know.

Windows XP home, boots up OK. Get a pop-up every time about running a program called licence manager.
Can access program menu, and things like control panel, but no application works. No errors, just no results. Simple things like wordpad won't work.

He uses black ice firewall.

I connected his hard disk to my own pc and scanned for viruses using Norton Internet Security - nothing found except two (harmless?) adware programs.

Cannot install spybot or similar to his hard drive, so cannot scan for other spyware.

Ran a simple scandisk and found no errors.

He did have a very large pagefile, which I thought might be corrupt, so deleted, but no improvement.

superscaper

Can you install anything while in safe mode? Take a look at the malware removal guide sticky. If you still can't install, may be worth considering a windows repair.

jonnyb

could not get it to offer safe mode boot up.
can you remind what key might do that ? I thought it was F5 or F8 to bring up a selection, but no success.

superscaper

Should be F8 http://www.pchell.com/support/safemode.shtml

robnye

get into safe mode then try a system restore

Little_John

system restore? simple solution to everything? !!!!!!

The PC has spyware/malware installed unless you know when it was installed whats the point you have no idea when to go back to. regedit is a great tool but alot of spyware stops you using it so the only way is in safemode normally stop the thing running by removing the command is the run folders, empty temp internet files and the temp folders also check the startup folder group for any unusual icons.

hijack this is useful as you can easily list everything and remove the rogue stuff.

and its is the F8 key to get the windows startup menu just keep hitting it before you see the loading windows screens

skiddy2k

Little_John wrote: »

system restore? simple solution to everything? !!!!!!
The PC has spyware/malware installed unless you know when it was installed whats the point you have no idea when to go back to.

Worth a try dont you think? Can estimate the date the issue roughly started.
May not work, but whats to loose?

witterquick

Hi,

Sounds like something loading at startup...

Does it let your run taskmgr or msconfig?

Try downloading a small program called "Hijackthis" - it's a registry scanner which shows you all of your registry entries - run this, and save the logfile - post it up here and I or a few other users can go through the log and tell you what to delete from it.

-Witts

superscaper

witterquick wrote: »

Hi,

Sounds like something loading at startup...

Does it let your run taskmgr or msconfig?

Try downloading a small program called "Hijackthis" - it's a registry scanner which shows you all of your registry entries - run this, and save the logfile - post it up here and I or a few other users can go through the log and tell you what to delete from it.

-Witts

That's already in the malware removal sticky that I posted about.

robnye

Little_John wrote: »

system restore? simple solution to everything? !!!!!!

not a bad place to start though.......!

sometimes it works others it requires days of going down the hijack this way....

trust me i have had to do both

Little_John

skiddy2k wrote: »

May not work, but whats to loose?

How about anything that has been done since the restore point?There are lots of ways to solve spyware problems, some simple like downloading and installing adaware then running the scan. It sorts a lot of problems out.The other way for people with more knowledge is to edit the registry and remove anything that shouldnt be in the run groups.Then its go with hijack this and post the report for people to have a look at. But a system restore should be the last thing to think of.