Virus? Key Logger? Wingdings as system font? WTH?

Mobius · Post by **Mobius** » Tue Oct 26, 2004 3:32 pm

Dad rings me last night says he can't start the PC. I go over there and boot the thing. The standard XP Pro loading screen begins (The one with the moving blue bar - so far so good)...

And then a login screen comes up - BUT it's not the normal login screen - there are two icons shown, neither of which are my Dad's logins - and the system fonts are all webdings or wingdings (no idea which)!

Clicking either login icon simply flashes the screen and displays the login screen again. Clicking the "shutdown" button brings up the usual 3-option window, (in english) but this window is squashed horizontally!

Additionally, the login screen is the wrong resolution.

OK, so I'm flummoxed by this - so I take the HDD out and take it home, plug it into a spare IDE channel, update NAv 2002 and do a full scan of that drive. 129,000 files - NO VIRUSES reported.

This seems curiouser and curiouser! There's something awfully dodgy about the windows boot - it "feels" wrong to me - almost like it's a fake windows logon. The res is wrong, and the squashed shutdown dialog is weird. Plus - it's in english - where all the text on the login screen is wingings/webdings.

I tried booting to Safe Mode - and the results are the same - so I'm not sure how to proceed.

Is there someway I can invoke the system restore?

Will I have to install XP Pro over the top? I'd prefer not to wipe out all the old man's installed programs if possible.

And yes, when I get it going again - I will switch the old man over to Firefox!

This began when he went and did a manual update of Norton AV 2002 and LU etc. After updating, Norton reported he had a virus in his inbox, and the system required restarting. That was the last time he saw a desktop.

Any ideas on how to proceed?

CDN_Merlin · Post by **CDN_Merlin** » Tue Oct 26, 2004 4:28 pm

You can use the XP CD and rerun the setup and do a REPAIR. I also think you can do a restore from command line but you'd have to check MS's web site for the info.

If he has a keylogger etc you may be better off reformating.

JMEaT · Post by **JMEaT** » Tue Oct 26, 2004 7:50 pm

Mobius wrote:This seems curiouser and curiouser!

I'm sorry Mobi, I'm not usually a grammar nazi, but dang dude. Is that really a word Down Under?

rijruna · Post by **rijruna** » Wed Oct 27, 2004 12:03 am

sorry, but i couldnt help myself Jmeat. seems you have never read 'alice in wonderland'[not written downunder so it must be one of them northern hemisphere types who did].
mobi, go with the repair off the cd, worked for me
cheers
rij

Defender · Post by **Defender** » Wed Oct 27, 2004 10:01 am

rijruna wrote:sorry, but i couldnt help myself Jmeat. seems you have never read 'alice in wonderland'[not written downunder so it must be one of them northern hemisphere types who did].
mobi, go with the repair off the cd, worked for me
cheers
rij

Actually the correct grammar for that would be "This seems more and more curious!".

JMEaT · Post by **JMEaT** » Wed Oct 27, 2004 12:13 pm

Yay! I successfully derailed a topic!

Carry on.

Mobius · Post by **Mobius** » Wed Oct 27, 2004 12:45 pm

Alice in Wonderland. Yes.

OFF WITH JMEAT'S HEAD!!

MD-2389 · Post by **MD-2389** » Wed Oct 27, 2004 1:47 pm

I don't suppose you tried repairing the font folder...

Canuck · Post by **Canuck** » Wed Oct 27, 2004 7:57 pm

phpbb/viewtopic.php?t=4357

Canuck · Post by **Canuck** » Wed Oct 27, 2004 7:58 pm

See Tyranny's post about System Restore.

phpbb/viewtopic.php?t=4357

DCrazy · Post by **DCrazy** » Wed Oct 27, 2004 8:06 pm

You linked to this very thread twice. Why?

Mobius · Post by **Mobius** » Wed Oct 27, 2004 8:48 pm

HEH!!!

Recursive links! I like it.

Doesn't fix the problem though.

However, the old man doesn't mind reinstalling everything - so it hardly matters now!

woodchip · Post by **woodchip** » Wed Oct 27, 2004 9:16 pm

Did your pa have a firewall?

JMEaT · Post by **JMEaT** » Wed Oct 27, 2004 10:13 pm

Mobius wrote:OFF WITH JMEAT'S HEAD!!

NevAr!

Canuck · Post by **Canuck** » Thu Oct 28, 2004 9:46 am

No idear why I ended up wit two posts...

Note my bad speeling, someone post a correction post.

Tyranny · Post by **Tyranny** » Thu Oct 28, 2004 11:14 am

I think you meant...

phpbb/viewtopic.php?t=4159

Not sure if that would fix this problem though. If he can't get into Windows to begin with theres no way to follow the steps I posted. Sounds like it has a much deeper solution. Running the repair from the XP cd sounds like a start but...*shrug*

Sounds like you'll have to reformat in the long run though just to be sure.

Arbitar · Post by **Arbitar** » Thu Oct 28, 2004 5:41 pm

Mobius wrote:This seems curiouser and curiouser!

Uhh Mobius?

Iceman · Post by **Iceman** » Thu Oct 28, 2004 5:53 pm

Defender wrote: Actually the correct grammar for that would be "This seems more and more curious!".

Where I come from that would be "This done be curioser and curiouser"

WarAdvocat · Post by **WarAdvocat** » Fri Oct 29, 2004 7:18 am

It's a literary allusion....let it go :p

MD-2389 · Post by **MD-2389** » Fri Oct 29, 2004 2:19 pm

MD-2389 wrote:I don't suppose you tried repairing the font folder...

Mobi?