PC that erases freshly installed program, prepared docs everytime itshuts down

[Roy]

Hello group
A friend of mine asks how come his PC bought from second hand is
weird .have anything that was made by him( documents, saved downloaded
files, and programs installed recently by him was erased everytime the
PC is shut down . He can't even instal an antivirus in it for the
same reason

The OS is WinXP SP2
Can anybody provide me some tips to sort it out so I can relay it to
him.
He is keen to instal programs that he needs including antivirus and
want his pc to behave normally .
TIA
Roy

 

[R. McCarty]

Advise him that a 2nd-hand PC should always be restored to it's factory
state. Depending on the age of the PC this process is either a "Hidden"
partition that holds the image or a disk ( or set of disks ) to restore the
PC.
He can visit the manufacturer's website and ether the PC's unique S/N
or service tag to find information on how to restore the unit.

Using a 2nd-hand PC with the original owner's profile & data is risky.

 

[Elmo]

Hello group
A friend of mine asks how come his PC bought from second hand is
weird, have anything that was made by him (documents, saved downloaded
files, and programs installed recently by him was erased every time the
PC is shut down). He can't even install an antivirus in it for the
same reason.

The OS is WinXP SP2
Can anybody provide me some tips to sort it out so I can relay it to
him?
He is keen to install programs that he needs including antivirus and
wants his pc to behave normally .
TIA
Roy

Here are two things to try:

1. http://www.kellys-korner-xp.com/xp_tweaks.htm
Line 30. Windows XP Doesn't Save User Settings

2. Download this Avira Antivir Rescue System program which will burn a
CD image to a blank CD. It's updated a few times per day. Insert the
CD into the damaged machine and let it do a scan of your system. Before
starting the scan, select "Configuration" and set to repair or rename
the infected files. Sometimes your machine won't restart after such a
repair process, so you might want to save needed files to another system
before using this. If you can't, then you can move the hard drive to
another machine to copy needed files. You can do that before, or after
this scan.

http://www.free-av.com/en/tools/12/avira_antivir_rescue_system.html

Then run these:

Malwarebytes© Corporation
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

SuperAntispyware
http://www.superantispyware.com/superantispywarefreevspro.html

You can try of the CD's mentioned at the following site. BitDefender
was my favorite, but if the infected machine can't connect to the
internet to get updates, Avira comes with current virus definitions.
Also, some of these just won't run on some systems, perhaps because
there's no drivers available for some system devices, motherboard,
graphics card, etc. So try a few of these till you find one that works:

Burn BitDefender, or another program listed at the link below, to a CD
(using a working machine) and test the infected machine with it.
BitDefender also has a Rootkit checker on the Linux Desktop; run it if
you think that's the problem:

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

Download the executable rather than the .iso image, if one is available,
(though no .exe is available for BitDefender).

After the scan is run, if you elect to quarantine files, they're
quarantined to RAM and lost after you reboot. You'll need to copy any
quarantined files to the hard drive, a thumb drive or elsewhere before
exiting.

 

[Shenan Stanley]

A friend of mine asks how come his PC bought from second hand is
weird .have anything that was made by him( documents, saved
downloaded files, and programs installed recently by him was erased
everytime the PC is shut down . He can't even instal an antivirus
in it for the same reason

The OS is WinXP SP2
Can anybody provide me some tips to sort it out so I can relay it
to him.
He is keen to instal programs that he needs including antivirus and
want his pc to behave normally .

Then have him format the system and install everything from scratch.

Second-hand machine - it isn't really *his* until he wipes it clean and
installs everything himself.

 

[Bruce Chambers]

Hello group
A friend of mine asks how come his PC bought from second hand is
weird .have anything that was made by him( documents, saved downloaded
files, and programs installed recently by him was erased everytime the
PC is shut down . He can't even instal an antivirus in it for the
same reason

The OS is WinXP SP2
Can anybody provide me some tips to sort it out so I can relay it to
him.
He is keen to instal programs that he needs including antivirus and
want his pc to behave normally .
TIA
Roy

From where did your friend acquire this computer? It sounds, from your
brief description, that it has a utility/feature such as SteadyState (a
program designed to return the computer to its original state after each
use, and commonly used in Internet cafes, schools, hotels, etc.)
installed on it.

Regardless, with second-hand computers, especially if acquired from
strangers but perhaps even if acquired from a family member or friend,
your friend's wisest course of action would definitely be to format the
hard drives and start fresh. He don't want to get in trouble because
the original owner may have filled the hard drive with kiddie porn, or
have problems because the original owner downloaded/installed viruses or
other malware.


--

Bruce Chambers

Help us help you:


http://support.microsoft.com/default.aspx/kb/555375

They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. ~Benjamin Franklin

Many people would rather die than think; in fact, most do. ~Bertrand Russell

The philosopher has never killed any priests, whereas the priest has
killed a great many philosophers.
~ Denis Diderot

 

[PA Bear [MS MVP]]

+1

Advise him that a 2nd-hand PC should always be restored to it's factory
state. Depending on the age of the PC this process is either a "Hidden"
partition that holds the image or a disk ( or set of disks ) to restore
the
PC.
He can visit the manufacturer's website and ether the PC's unique S/N
or service tag to find information on how to restore the unit.

Using a 2nd-hand PC with the original owner's profile & data is risky.

 

[Roy]

Al

Thanks for all the comments...

I have asked him (by email) recently where did he buy it and indeed
it was from the lot of computers in the internet cafe that closed
down as the owner relocated and changed business and it was bought
at a bargain knowing that the PC is a high performance type already
core2 duo extreme with 1 gig of dedicated graphics card.
When he started using it after bringing it to his home
He tried to instal antivirus in it( avira 9 free edition) made a
thorough scan and found a few minor malware that was then removed so
he think it was clean.
Therefore he was pleased with it and did not format it anymore as it
too much work for him going from the scratch and he has no time to
spare for it now.
He was thinking that there might be is something to do with the
administrative settings , or registry that makes the PC run that
way so it will prevent any malware that might have infected the PC
from taking a firm hold.
I think this is the way he want it sorted, minimum effort from his
part ......
Any ideas....?
Roy

 

[PA Bear [MS MVP]]

The security of the computer (and his data, including online banking
usernames & passwords) cannot be guaranteed unless he formats the HDD and
does a clean install of Windows.

 

[Roy]

The security of the computer (and his data, including online banking
usernames & passwords) cannot be guaranteed unless he formats the HDD and
does a clean install of Windows.


- Show quoted text -

Hmm I relayed it to him, and acording to him at the moment that
was not his real concern as he conduct internet banking with his
favorite laptop. BTW He is aware of the perils you mentioned.
This desktop is just for gaming, video encoding and general internet
surfing, etc
He insisted there is nothing wrong with that PC (except for that fault
enumerated above ) that it needs formating and something like that...
Just want a simple solution with minimal effort..from his side . if
that can be possible.

Roy

 

[PA Bear [MS MVP]]

Also tell him that the computer's a thread to the entire online community
and to run a Google search on the word 'botnet.'

 

[Roy]

Also tell him that the computer's a thread to the entire online community
and to run a Google search on the word 'botnet.'






- Show quoted text -

Hmm so it implies that there is no simple solution to this problem?

 

[Shenan Stanley]

<this is one thread of the conversation only>
<for all the threads of this conversation...>

<entire conversation archived indefinitely>
http://groups.google.com/group/micr...p.general/browse_frm/thread/53e73f0faca047a6/
</entire conversation archived indefinitely>

A friend of mine asks how come his PC bought from second hand is
weird .have anything that was made by him( documents, saved
downloaded files, and programs installed recently by him was erased
everytime the PC is shut down . He can't even instal an antivirus
in it for the same reason

The OS is WinXP SP2
Can anybody provide me some tips to sort it out so I can relay it
to him.
He is keen to instal programs that he needs including antivirus and
want his pc to behave normally .

Advise him that a 2nd-hand PC should always be restored to it's
factory state. Depending on the age of the PC this process is
either a "Hidden" partition that holds the image or a disk ( or set
of disks ) to restore the PC.
He can visit the manufacturer's website and ether the PC's unique
S/N
or service tag to find information on how to restore the unit.

Using a 2nd-hand PC with the original owner's profile & data is
risky.

+1

Thanks for all the comments...

I have asked him (by email) recently where did he buy it and indeed
it was from the lot of computers in the internet cafe that closed
down as the owner relocated and changed business and it was bought
at a bargain knowing that the PC is a high performance type already
core2 duo extreme with 1 gig of dedicated graphics card.
When he started using it after bringing it to his home
He tried to instal antivirus in it( avira 9 free edition) made a
thorough scan and found a few minor malware that was then removed so
he think it was clean.
Therefore he was pleased with it and did not format it anymore as it
too much work for him going from the scratch and he has no time to
spare for it now.
He was thinking that there might be is something to do with the
administrative settings , or registry that makes the PC run that
way so it will prevent any malware that might have infected the PC
from taking a firm hold.
I think this is the way he want it sorted, minimum effort from his
part ......
Any ideas....?

The security of the computer (and his data, including online
banking usernames & passwords) cannot be guaranteed unless he
formats the HDD and does a clean install of Windows.

Hmm I relayed it to him, and acording to him at the moment that
was not his real concern as he conduct internet banking with his
favorite laptop. BTW He is aware of the perils you mentioned.
This desktop is just for gaming, video encoding and general
internet surfing, etc
He insisted there is nothing wrong with that PC (except for that
fault enumerated above ) that it needs formating and something
like that... Just want a simple solution with minimal
effort..from his side . if that can be possible.

Also tell him that the computer's a thread to the entire online
community and to run a Google search on the word 'botnet.'

Hmm so it implies that there is no simple solution to this problem?

If that PC/the stuff currently on it is not all that important to them - is
just to be used for gaming, viodeo encoding, etc - then the *simple*
solution is the *best* solution as well. Format and install Windows XP
fresh and clean. Update the drivers so the gaming and video encoding
performance is the *best* it can be for that system (no unknown/strange
overhead - just the bare minimal to do what they want on said system.)

It has been setup to do this. Undoubtedly the Internet Cafe set it up to
revert back all changes (either for the user profile or for the entire
computer) using something - there are many ways of doing this.

The best fix is to set it up to do what the new owner wants. That is a
format/install thing. Since there is no data to recover, no loss of
anything possible - this is a no-brainer in my mind. Start the installation
process, walk away. Come back and download the latest hardware drivers for
the system and install them and then - it's a matter of installing the
things the new owner wants - and ONLY the things the new owner wants.

It doesn't get much more simple or straight-forward.

 

[Roy]

<this is one thread of the conversation only>

It has been setup to do this.  .

Shenan Stanley
     MS-MVP
--

I have shown him the threads of his post and he called me and
underlined this the paragraph that he wants more
information as this is the remedy he wants it done.


'>Undoubtedly the Internet Cafe set it up to

revert back all changes (either for the user profile or for the entire
computer) using something - there are many ways of doing this

What are the many ways of doing such? Can't he not reverse the
process?

He is still reluctant to do that formatting job.....

 

[Shenan Stanley]

I have shown him the threads of his post and he called me and
underlined this the paragraph that he wants more
information as this is the remedy he wants it done.

What are the many ways of doing such? Can't he not reverse the
process?

He is still reluctant to do that formatting job.....

All the time is being wasted asking questions when a format/installation
would have been over with days ago.

Does he just not have the original media - is that the problem?

 

[Shenan Stanley]

I have shown him the threads of his post and he called me and
underlined this the paragraph that he wants more
information as this is the remedy he wants it done.

What are the many ways of doing such? Can't he not reverse the
process?

He is still reluctant to do that formatting job.....

I'll give a few popular examples...

http://www.faronics.com/html/deepfreeze.asp
http://www.microsoft.com/windows/products/winfamily/sharedaccess/whatis/default.mspx
http://www.returnilvirtualsystem.com/products

The fact is - even if the 'freeze' is undone/turned off - the *best* course
of action is and will remain being that the computer is actually formatted
and installed from scratch by your friend.

This is not a technical issue - this is one of getting something and not
knowing what you paid for and then being stubborn about what you should do
to know you have remedied any and all such problems that may arise from not
knowing what all was done to a machine via software in one fell swoop.

Just because the system gets unfrozen, there may be (probably is) other
protections in place that will make the computer difficult to use for what
you have mentioned it will be used for. It would only make sense that an
Internet Cafe would not only reset the computers configurations each
restart - but also lock down many other features - turning the machine into
a fancy kiosk to protect themselves and their customers.

 

[PA Bear [MS MVP]]

[TYPO CORRECTED]

 

[PA Bear [MS MVP]]

The solution is quite simple: Format the HDD & reinstall Windows.

Back-up any personal data (none of which should be considered 100%
trustworthy at this point) then format the HDD & do a clean install of
Windows. Please note that a Repair Install (AKA in-place upgrade) will NOT
fix this!

HOW TO do a clean install of WinXP: See
http://michaelstevenstech.com/cleanxpinstall.html#steps and/or Method 1 in
http://support.microsoft.com/kb/978307

After the clean install, you'll have the equivalent of a "new computer" so
take care of everything on the following page before otherwise connecting
the machine to the internet or a local network (i.e., other computers) and
before using a flash drive or SDCard that isn't brand-new or hasn't been
freshly formatted:

4 steps to help protect your new computer before you go online
http://www.microsoft.com/security/pypc.aspx

Other helpful references include:

HOW TO get a computer running WinXP Gold (no Service Packs) fully patched
(after a clean install)
http://groups.google.com/group/microsoft.public.windowsupdate/msg/3f5afa8ed33e121c

HOW TO get a computer running WinXP SP1(a) or SP2 fully patched (after a
clean install)
http://groups.google.com/group/microsoft.public.windowsxp.general/msg/a066ae41add7dd2b

Tip: After getting the computer fully-patched, download/install KB971029
manually: http://support.microsoft.com/kb/971029

NB: Any Norton or McAfee free-trial that came preinstalled on the computer
when you bought it will be reinstalled (but invalid) when Windows is
reinstalled. You MUST uninstall the free-trial and download/run the
appropriate removal tool before installing any updates, Windows Service
Packs or IE upgrades and before installing your new anti-virus application
(which will require WinXP SP3 to be installed).

Norton Removal Tool
ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

McAfee Consumer Products Removal Tool
http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

Also see:

Steps To Help Prevent Spyware
http://www.microsoft.com/security/spyware/prevent.aspx

Steps to Help Prevent Computer Worms
http://www.microsoft.com/security/worms/prevent.aspx

Avoid Rogue Security Software!
http://www.microsoft.com/security/antivirus/rogue.aspx

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA or Geek Squad) computer repair shop.

 

[Roy]

All the time is being wasted asking questions when a format/installation
would have been over with days ago.

Does he just not have the original media - is that the problem?

I think some of the original media is missing and that is the likely
reason that he does not want to exert effort in doing a fresh start.
He did not tell me about it but that is how I see it as he is
stubborn to say that if there is away of sorting this out without
doing alots of effort from his side then he would do it.
Now if he can't do it by himself I just sent him an email asking him
to bring that PC to a repair shop and have the dirty work done
there....

Roy