The machine is an el-cheapo Win8 with 4gb ram from HP.
While I have seen this machine in popup hell all I've managed to do is get logged back out before the desktop became useable.
I figured it was malware and since the machine refused to boot a disinfection disk (thank you secure boot!) I pulled the drive and scanned it. No malware but it does contain a windows.old which strongly suggests someone did a reset on it once before.
Any plan of attack??
Edit: Solved. I sat there reading a book while playing with the trackball for 10 minutes to keep the system from locking and I finally was able to actually get it to listen to me. The lock turned out to be set for 1 minute and it triggered enough garbage that it took more than a minute before you could do anything. Not only is it full of manufacturer-supplied bloatware but it appears the user is one of these guys who falls for all the install-this stuff one sees on the web. The last toolbar was installed 2 days before I became involved.