Excuse me mad jock, total tosh. When you convert a volume to NTFS, you get exactly the same file system as you would with a fresh format - the only difference is, it's a populated, converted volume rather than a fresh MFT and boot record. What "extras" do you refer to?
- ACLS? Nope, present on both converted and formatted drives.
- Sym links? Nope, present on both converted and formatted drives.
- ADS? Nope, present on both converted and formatted drives.
- File journaling, mount points, dynamic volumes or checkpoints? Nope, present on both converted and formatted drives.
The whole point of the "extras" is that it's secure. Indeed, as secure as Samba - demonstrably. I'm not aware, nor can I find a reference to, a single documented security hole in NTFS since NT4. NTFS is exactly as secure in either scenario - standalone or a member of a networked domain, the local ACLs ensure this. Lose the password to an NTFS volume and the only thing which will get your data off is low level physical access unless the data is also encypted - exactly the same as Samba, EFS - even MVS.
Also tosh about "the way Microsoft want you to use it".
Every PC is a domain member. If you are using NT, 2000, XP, Vista or Windows 7, it is a member of at least one domain - itself. A standalone PC has a domain SID generated during Windows installation.
By "removing the ownership problems" you are removing security - inviting trouble usually followed by some crass comment about Microsoft rather than admission of shooting oneself in the foot. By perpetuating this kind of misinformation, you do everyone a disservice.
Keef, Microsoft didn't make anybody take something out. As I said in my last post, the only reason Knoppix (or anyone else) could not write to NTFS was because MS didn't publish the interfaces. Even that info is out of date though as there are several *nix drivers which will happily write NTFS including on Knoppix. I use NTFS-3G on Ubuntu to write to my Windows 7 box and it works a treat. I believe that it also supports Knoppix but if not, there are plenty of distros out there that do.
Back to the point though, I agree with others that without deep technical knowledge, a rebuild is probably the safest way to go. If you are experienced with Hijackthis, rootkit revealers, Sysinternals and Jsware Stream Viewer, then you will probably recover the machine. If any of these things mean nothing to you, then you risk leaving enough badness behind to compromise the machine again.
PS. Did I mention that you should wean your friend of the admin habit?
It isn't difficult, Linux and Mac folks do it without thinking about it.
Good luck....