I need to know where/how to start cleaning a computer.

[godawgs]

Hello,
I'm not sure if this is the forum I should start in, but here goes.
I want to try to get my sister's computer up and going again. It hasn't worked since approx. Nov. 2008. I just found this out.
The computer is a Dell Dimension 4600 desktop. Pentium 4 2.0Ghz processor. 512MB Ram.The OS is Windows XP Professional SP2. (I know it needs to be updated to SP3, but I need to get to that point first).
The computer boots up. When it gets to the user's log on screen, a Viewpoint Services.exe break point exception screen comes up.Code (0x0000003). When you get that screen cleared, and log on, sometimes it will load the settings and get to the desktop, with the Viewpoint Services.exe error coming back and a new Viewmgr encountered a problem and needs to close box also.
I found thru a web search that this is a foistware/malware program that should be removed, and I will do that.
Anyway, a SpywareGuard program(I think) comes up and starts running a scan.(I got into Add/Remove programs and uninstalled it.)
And sometime, when you log on the settings load and you get to the desktop and the little hour glass just sits there and spins and goes no farther.
The immediate problem is that all users had Admin. rights. Between her husband, son, and granddaughter half of the ENTIRE internet has been downloaded to the computer. I looked at the StartUp tab in msconfig and there must be 100 items listed. I looked in the Add/Remove Programs and there are so many toolbars and other crap there, it just boggles my mind. I can't find an anti-virus program at all so I's sure the system is loaded with viruses, malware, adware, you name it. I have disconnected the computer from the internet (I don't even know if it will connect to the internet) until I can find out what's on it. So I will be downloading whatever needs to be downloaded on my computer, then taking it to hers to install/run. Then I will have to come back to mine to post. My sister's son told me he tried to "Restore to last known good configuration point." back in 2008 when the problem started, but the hour glass spun all night until he turned the computer off the next morning.
Also, I looked at Device Manager. To my astonishment, there isn't a single red x or yellow ! on any device.
I would like to get this fixed so I can get SP3 on before support ends for SP2 in July 2010 (I think).
Any help and advice on telling me where/how to get started is greatly appreciated.

[shelf life]

hi,

Before you start transferring files from one machine to another you should know that some malware can be transported via flash drives/memory sticks from a infected machine to another machine. Not saying this is the case with you. One idea is to use a reinstallation disk. do you have a reinstall disk?

[godawgs]

Thanks for the reply shelf life,

The re-installation disc is the only disc that came with the system that I can't find. Her son says that they had one, but nobody knows where it is. I had read about the chance of infection when using flash drives/memory sticks, so I burned the downloaded files to a cd and then copied them to the computer. I tried to run Malwarebytes, but evidently one of the infections targeted the Malwarebytes program and would not let it install. So I had to trick what ever it was into installing and running the program by renaming the Malwrebytes installation program and the main program's .exe file. After that, the program ran. It found over 2200 infected objects in the 4 user accounts on the system. I was able to run the DDS.scr program and generate the two .txt files. I plan on running the GMER program, if the system will let me, and after getting those results, post the .txt/.log files for review to see if there's anything else that needs to be addressed before moving on to installing an anti-virus program.
Installing an A/V program:
I know the the computer has Norton PC Check Up on it now. I know that there is a folder in C:\ProgramFiles for McAffee. But, since McAfee is not in the Control Panel Add/Remove programs, it must have been uninstalled. I also found in the Windows\Temp folder a folder named avast4. I have read that Anti-Virus programs can be a bear to install if all the older A/V programs that were installed aren't completely uninstalled and removed. I also know that some A/v web sites have specific uninstall tools for different A/v programs, but they are version specific, and since I'm not sure which versions were installed, I'm not exactly sure what I should do. Any thoughts or advice on that?
Is there anything else you would recommend that I do t this point?
Thanks

[shelf life]

For now I would look in the add/remove programs panel and uninstall any AV you find listed there. For McAffee if you havent take a look inside the folder you saw for a uninstall.exe that might be present in the folder.
You can also uninstall using the add/remove programs panel:
Viewpoint or
Viewpoint Manager or
Viewpoint Media Player
and any Toolbars you might recognize in the list.
Sounds like you are making progress. Another good tool for clean up is Dr Web, you could burn it to cd and transfer it over to run on the machine. Link and directions:


Download Dr.Web CureIt to the desktop:

ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

* Doubleclick the drweb-cureit icon to start the program.
* press start
* Allow the program to run the initial express scan
* This will scan the files currently running in memory. If something is found, click the YES button when it asks you if you want to cure it. This is only a short scan.
Note: A pop up may appear during this phase suggesting you purchase their program - click the X at the top right corner of this pop-up to close it.
* Once the short scan has finished, check the Complete scan box on the left side, even if nothing was found on the initial scan.
* Then click the small green arrow button on the right under the Dr.Web Antivirus picture to start the complete scan. (This scan may take several hours)
* During this complete scan - if Dr.Web finds an infection a window will pop up requesting your attention. Select the Cure button.
Note:(If the file cannot be cured, Dr.Web will automatically delete the file)
* Once the scan is complete, on the menu bar, click file and choose report list.
* Save the report to your desktop. The report will be called DrWeb.csv
* Note:this report will need to be renamed to Dr.Web.txt in order to post it on the forum.
* Close Dr.Web Cureit.
* Please post the Dr.Web.txt report in your next reply

[godawgs]

Thanks, will give it a try.