XP logon screen message

I have a PC running XP home with several users, some of which are password
protected, but all are admins.

PC has recently had a virus / spyware problem, which appears to have been
resolved.

When the PC boots and goes to logon screen, then everything looks OK.
If I log off to change user or PC goes back to logon screen, there is a
message at the bottom left of the screen.
Where it says Turn off, it also says 'This thing betta start working
properly' is this linked to a virus, or can it be edited manually?

Thank you

Definitely sounds malicious. Without knowing what security apps
you have, I'd recommend a few additional scans. First download
Update & run Malwarebytes ( on a weekly schedule ). Second I'd
run an alternate AV vendor's online scan of your PC. There are
several to choose from:
NOD32: http://www.eset.com/onlinescan/
BitDefender: http://www.bitdefender.com/scan8/ie.html
*Based on Active-X add-ons, follow on screen prompts to install
and perform scans.

Download link for Malwarebytes 1.44:
http://www.malwarebytes.org/mbam-download.php

"Neil" wrote in message
news
I have a PC running XP home with several users, some of which are password
protected, but all are admins.

PC has recently had a virus / spyware problem, which appears to have been
resolved.

When the PC boots and goes to logon screen, then everything looks OK.
If I log off to change user or PC goes back to logon screen, there is a
message at the bottom left of the screen.
Where it says Turn off, it also says 'This thing betta start working
properly' is this linked to a virus, or can it be edited manually?

Thank you

On Jan 13, 5:47*am, Neil wrote:
I have a PC running XP home with several users, some of which are password
protected, but all are admins.

PC has recently had a virus / spyware problem, which appears to have been
resolved.

When the PC boots and goes to logon screen, then everything looks OK.
If I log off to change user or PC goes back to logon screen, there is a
message at the bottom left of the screen.
Where it says Turn off, it also says 'This thing betta start working
properly' is this linked to a virus, or can it be edited manually?

Thank you

Are you able to logon anyway?

You need to be sure your virus / spyware problems are resolved.

Perform some scans for malicious software, then fix any remaining
issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpywa (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.

In news Neil typed:

I have a PC running XP home with several users, some of which are
password protected, but all are admins.

PC has recently had a virus / spyware problem, which appears to have
been resolved.

When the PC boots and goes to logon screen, then everything looks OK.
If I log off to change user or PC goes back to logon screen, there is
a message at the bottom left of the screen.
Where it says Turn off, it also says 'This thing betta start working
properly' is this linked to a virus, or can it be edited manually?

Thank you



Assuming it's a virus leftover and that the virus has been removed, here's ways to take care of the message. I've used an HTML format here so if you're reading in Plain Text, press ALT-SHIFT-H to see it in HTML. Assuming the newsgroup doesn't botch it, that is.
These come from the MS site but I've lost the location of them; otherwise I'd just give you the URL.


HTH,

Twayne




LegalNoticeCaption

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Data type
Range
Default value

REG_SZ
String
(Blank)


Description

Specifies the caption (title bar text) for the message box that appears after a user presses CTRL+ALT+DEL to log on.

If the value of this entry is not blank, a message box with this caption and the message specified in the value of the LegalNoticeText entry appears before the Log On to Windows dialog box appears. The user must click OK in the message box to continue logging on.

For example, in the figure below, the value of this entry is "Legal Notice".



Note

The message does not appear when the value of disablecad is 1.

Related Entries





LogonPrompt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Data type
Range
Default value

REG_SZ
String
(Blank)


Description

Specifies a message for the Log On to Windows dialog box. By default, there is no logon prompt message.

Note

Windows 2000 does not add this entry to the registry. You can add it by editing the registry or by using a program that edits the registry.





Welcome

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Data type
Range
Default value

REG_SZ
String
(Blank)


Description

Specifies the text that appears in the caption bar beside the title of the Log On to Windows,Windows Security,Computer Locked, and Unlock Computer dialog boxes.

Note

Windows 2000 does not add this entry to the registry. You can add it by editing the registry or by using a program that edits the registry.

Tip

The system adds only one space between the dialog box title and your message. To further separate the title from your message, begin your message with leading spaces.

Related Entries



LegalNoticeCaption

Thanks for the comments guys.
Chcked for the message in the registry and it shows up under 'Lanmanserver'
as 'srvcomment' and refers to the computer description.

Maybe the user has changed it/

Thanks

"Twayne" wrote:

In news Neil typed:
I have a PC running XP home with several users, some of which are
password protected, but all are admins.

PC has recently had a virus / spyware problem, which appears to have
been resolved.

When the PC boots and goes to logon screen, then everything looks OK.
If I log off to change user or PC goes back to logon screen, there is
a message at the bottom left of the screen.
Where it says Turn off, it also says 'This thing betta start working
properly' is this linked to a virus, or can it be edited manually?

Thank you


Assuming it's a virus leftover and that the virus has been removed, here's ways to take care of the message. I've used an HTML format here so if you're reading in Plain Text, press ALT-SHIFT-H to see it in HTML. Assuming the newsgroup doesn't botch it, that is.
These come from the MS site but I've lost the location of them; otherwise I'd just give you the URL.


HTH,

Twayne




LegalNoticeCaption

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Data type
Range
Default value

REG_SZ
String
(Blank)


Description

Specifies the caption (title bar text) for the message box that appears after a user presses CTRL+ALT+DEL to log on.

If the value of this entry is not blank, a message box with this caption and the message specified in the value of the LegalNoticeText entry appears before the Log On to Windows dialog box appears. The user must click OK in the message box to continue logging on.

For example, in the figure below, the value of this entry is "Legal Notice".



Note

The message does not appear when the value of disablecad is 1.

Related Entries





LogonPrompt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Data type
Range
Default value

REG_SZ
String
(Blank)


Description

Specifies a message for the Log On to Windows dialog box. By default, there is no logon prompt message.

Note

Windows 2000 does not add this entry to the registry. You can add it by editing the registry or by using a program that edits the registry.





Welcome

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Data type
Range
Default value

REG_SZ
String
(Blank)


Description

Specifies the text that appears in the caption bar beside the title of the Log On to Windows,Windows Security,Computer Locked, and Unlock Computer dialog boxes.

Note

Windows 2000 does not add this entry to the registry. You can add it by editing the registry or by using a program that edits the registry.

Tip

The system adds only one space between the dialog box title and your message. To further separate the title from your message, begin your message with leading spaces.

Related Entries



LegalNoticeCaption