Posted 29 October 2008 - 12:10 PM
Currently trying to diagnose and repair an HP Pavillion (running XP Home, SP2) for a coworker. Computer came in with complaints of being slow and unable to boot. I could not replicate the inability to boot - I was prompted to boot from last known good configuration, which I did.
Before anti-virals were put into place, browser hijack attempts have been confirmed. Multiple IE toolbars (that are not google) indicate the potential for a dearth of spyware. Processor often runs at 100% and the page file is obscenely large. I disabled Windows Defender, as that was regularly causing 80-90% of my process usage, to little effect.
I cleared all internet activity (cookies, history, etc) followed by defragment and scandisk, which reported nothing out of the ordinary. Processor usage still runs between 70-100% on a continuing basis.
After that, I downloaded and installed my three most common and rapidly-deployed solutions: AVG, Ad-Aware and Spybot. I usually post HiJack This logs to forums after initial cleanings.
Ad-Aware locked up and went into "not responding" halfway through a full scan, and 77 items recorded as infected. Spybot won't update, from any of the server - it downloads hald the updates before entering a "not responding" state. AVG, despite having a "scan running" icon in the taskbar is not shown as a running process.
Booting into safe mode gives me the opportunity to run AVG's command line scanner (which I'm doing right now), but Spybot isn't even available - I just can't find it. Ad-Aware gives me an error screen and will not run. Even safe mode doesn't seem to be working.
The computer is obviously infected. I have been unable to use my standard tools to correct the problems. What are my options now, to properly escalate my response and clean out this computer?
Wiping the HDD is not an option. The user has neither restore discs nor drivers available for that. I'm stuck doing it the long, hard way.
I've got to be honest: I'm stumped. What does one do, when you can't get your anti-virals up and running properly?