What is in the windows? If its tacky adverts(as opposed to ones from well known organisations), or more especialy if there are porn sites, then you have an infection I would say.

Have you run a HiJackThis scan?
 

Steve: N.M.N.F.
If something is popular, it must be wrong: Mark Twain

You could also try SuperAntiSpyware.

And is this friend running Windows XP, Vista, or what?  If not Vista, then you should also download Windows Defender.

Also, in my opinion, if you want a program that might stop some of that, regardless of the infection, try Online Armor

--

"If to err is human, then I must be some kind of human!" -Me

Sorry, more details.  Not opening up porn, just plain adverts.  Nothing speciial.  Running XP sp3.  Didn't try Defender, but have run Spybot S&D.  I've always had good luck with that.  Anybody have any idea what might be causing it?  Thanks.  (I'll try SuperAntiSpyware first, then WindowsDefender next, I'm getting desperate.)

http://www.linkedin.com/in/glenajohnson
http://www.johnsoncomputers.us

In my experience, Ad-Aware and Spybot S&D used to be great, but they've dwindled greatly.  I suppose different people can have different experiences.

And it might not hurt to give these two a run, as far as all-in-one scanners go, not as much on security, but they do scan for that as well:
IObitAdvanced System Care
and
Glary Utilities

Also, it doesn't hurt to give CCleaner a run, to clean out all the temp file locations.

If still having troubles, MWav also works.  You can scan with it for free, and then manually remove the files/registry entries yourself, or you can buy the paid version and it'll do the removals for you.  It generally is a pretty strong program.

SpywareBlaster would be of assistance AFTER cleaning the system, b/c it helps make sure system settings are set so that you are protected against such threats.

And then after all else is done, it wouldn't hurt to post a hijack this log here.

And don't forget the free online scanners, such as http://housecall.trendmicro.net

--

"If to err is human, then I must be some kind of human!" -Me

You didn't mention if you stopped System Restore. Always kill that before running any Anti-virus or Anti-spyware programs.

James P. Cottingham
^{I'm number 1,229!
I'm number 1,229!}

Quote:

You didn't mention if you stopped System Restore. Always kill that before running any Anti-virus or Anti-spyware programs.

  Dang, forgot all about that.  Thanks.

http://www.linkedin.com/in/glenajohnson
http://www.johnsoncomputers.us

Glen, just as a precaution, I would reset the winsocks as they could be hooked...

CLI: netsh winsock reset catalog

and flush the DNS cache with: ipconfig /flushdns

another thing to check, is the HOST file...


 

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

This should only be a temporary fix and you should never do this without guidance from a professional. With that disclaimer out of the way on with it...


If you have physical access to the infected pc and to another machine and a thumb drive, then disable internet explorer from running. You'll want to use Image File Execution options.

http://www.osix.net/modules/article/?id=781

you add a new key for iexplore.exe and set the Debugger value as a non-existant file like sdgdsgrew.exe. So when iexplore.exe is attempted to be run it trys and fails to run the non-existant sdgdsgrew.exe and it doesnt give errors when it cant find that file. it will keep internet explorer in check until you can get a real tool ran. Since you're running XP SP3 run combofix, put it on a flash drive and run it. If it wont run rename it as some things try to stop combofix as it works well. If you have to rename it pick a fairly random name like GeneralTsoChicken.exe or something of the like. After you've got more tools ran dont forget to delete the iexplore.exe option in Image File Execution Options.