I spent Thursday night remotely working on a computer belonging to a friend of my wife’s, riddled with spyware, trojans and viruses. The first problem seen was that Internet Explorer would not work at all. When starting it, it would simply display a page saying that the page request could not be found. Classic behaviour of spyware.
My first step was to send her a copy of Mozilla Firefox, my favorite reliable browser from the Mozilla foundation. With this, I was then able to access the internet again. I then went on to download Ad-Aware SE, a good spyware killer. I started running a scan using it. A few second after starting the scan, a dialog showed up, saying that the computer would be shutting in 60 seconds, as requested through an RPC call from a service on the system. I was not sure what to do at first and the machine rebooted.
After some research on the web (and two or three reboots trying different things out), I found that the shutdown command probably came from the pest I was trying to remove, which might be the MS Blaster worm or other known worms. I also found that it was possible to stop the shutdown of the computer during the countdown by running the command:
shutdown.exe -a
You can run this command from the Start | Run menu or by creating a simple batch file. Once the shutdown was aborted, I was able to run Ad-Aware and remove most of the problems. I then ran a scan with Spybot Search & Destroy and got rid of the rest of the problems. Finally, a good scan from AVG Anti-Virus caught some last remaining problems and the machine was clean and ready to go.
I learned something with this darn shutdown command that I won’t forget.