Cleaning Up a Mess

Robert Moore, DCC Psychology

How do I know if my machine has problems ??

Symantec anti-virus reports a problem.
This is most likely to occur when you are reading mail or browsing on the web. If you are reading mail (or attachments) it means that the problem was not caught at the edge of the network where incoming mail is scanned. If you are browsing on the web, you may have encountered a malicious site. Be careful to note exactly what you were doing and where you were browsing. In either case you should contact your DCC or call the Help Desk at x3-HELP.
Your machine cannot connect to the network.
If you are using the wireless network, and your computer used to connect to the network, then you may not be in range. If you are connected to a physical ethernet connector that used to work, then there might be a problem with that network tap or cable. Try connecting a laptop using the same cable and tap. If that works, then the problem is with your computer. It is possible that your machine has been detected as compromised in some way and blocked from the network. Presently, such blocking occurs at a level of the ip address of the ethernet adapter in your computer. Eventually the block will occur at the level of the physical address of the adapter.(Your computer will be configured with an ip address such as 128.148.140.63 or configured to retrieve an ip address from the network. This should not be confused with the physical address, or mac address, of your computer which is a number like 00-30-BD-04-F1-E8) . . . Every effort will be made to reach the DCC or SysAdmin associated with the subnet on which the offending machine is found. This is why it is so important to be sure your DCC knows about, and assigns and records the ip and mac address of, every computer that is placed on the network.
Your machine has become very slow.
Everything you do now requires that you log into an Administrator account:
- - Turn off System Restore (2k, XP)
  - Start Symantec anti-virus (SAV) and run LiveUpdate
  - Start SpyBot and obtain any updates.
  - Start IE and go to Tools/Internet Options/Delete Files (including offline content)
  - Go to c:\windows\temp and delete all *.tmp files
  - Disconnect the computer from the network
  - Reboot into safe mode and run SAV and then SpyBot
- At least the system is cleaner than before.
  - Reconnect the computer to the network and reboot
  - Do a single Ctrl-Alt-Del and click on the Processes Tab (2k, XP)
  - Compare the running processes with the list you made long ago
  - Write down the processes you do not recognize
  - Look up any unrecognized processes at the following sites
  AnswersThatWork
  SysInfo
  Google
  which may tell you where these came from and offer hints about what to do.
- I've done everything I can think of. My computer is still slow.
  Perhaps your computer has been hijacked. At this point you should let your DCC or System Administrator know you are having problems.
- http://www.majorgeeks.com/ Search for HijackThis
- Windows XP Recovery, Repair or Rebuild?

Recover/Repair/Rebuild

CIS has developed some guidelines to help choose the best path when things have gone really wrong.