I'm puzzled

Two or three months ago I got a call from an elderly friend of my wife. Her husband's PC was playing up and they were getting calls from friends who'd received odd emails.

I popped over and it looked to be virus ridden. XP Home system, couldn't load anything, kept being told the program was infected and the system wouldn't allow it to be run. In the end I brought it back and rebuilt it from the recovery partition. All OK.

Two weeks ago I got a call saying it had 'gone again'. Popped over and had a look. The wallpaper had been changed to various bits of text about being infected with viruses, malware, etc.Couldn't run applications, e.g. MalwareBytes, being told the file was infected. Messages appear to be coming from something, I think, was called, Tool Kit. As I hadn't the time then to sort it I suggested he switch off and leave it and I'll get back to him.

I rang him this afternoon to arrange to sort it out. He told me that he'd left it for a week or so then last week decided to switch it on. Lo and behold it was working just fine, no strange wallpaper, no strange messages, email working fine.

It appears to have fixed itself. He did ask me if I had sorted it 'from my end', clearly I hadn't.

I've no idea what was wrong with it two weeks ago then given that a week or so later it 'fixed itself'

Any thoughts?

Any thoughts?

I think your friend needs training in IT security and/or more security software (preferably set by you to restrict his Internet usage).

Where on earth is he browsing to get all that? Or is he the type to open every dodgy e-mail?

I doubt any virus 'fixes itself'. Disappears into the hard drive perhaps.

In reply to a post by cheshire_man:

I rang him this afternoon to arrange to sort it out. He told me that he'd left it for a week or so then last week decided to switch it on. Lo and behold it was working just fine, no strange wallpaper, no strange messages, email working fine.

Any thoughts?

They went somewhere else to fix it, you've lost a customer.

Windows update fixed it.

The server the virus was communicating with has gone.

He had someone else fix it.

I'd installed all the normal AV & security stuff, MSE & Zone Alarm, also MalwareBytes, SuperAntispyware. If the opportunity arises I'll try to look in the history and the cache to see if there's any 'odd' ones around. To the best of my knowledge and after discussing it with him the only sites that some might seem odd are those relating to his passion for railways both full size and model.

I agree that viruses don't fix themselves, unless of course in some way it only activates on certain days and de-activates afterwards pending another activation. Not heard of any like that though.

No one else involved. And he's not a customer, if you define a customer as someone who pays for goods or services, as I refuse any payment.

No one else has fixed it - not that I'd be unduly worried if they had. Good point about the server, though he uses dial up broadband so when I looked he wasn't actually connected to the internet.

To be honest I expect to get another call in the future about it having come back - ah well.

Urgh, why do people put so much faith in MSE? It score abysmally in tests, it takes up 100meg of ram even on small systems, and in never manages to update itself properly.

It's been running on my PCs for 12 months or more with no problems, the occasional alert which it's dealt with, and consistently reliable updating. A quick check shows it to be taking around 80Meg of memory, but so what.

I'd try 'hijackthis' and see if the log file throws up anything interesting.