Message box with "crap" after pressing Ctrl-Alt-Del

[news]

Hi.

I have a customer with a Win2k-server and some Win xp prof
workstations. AD which the workstations are connected to.

On one singel workstation, after pressing Ctrl-Alt-Del to loggon the
normal login screen there you can put username/password does not
appear. Instead I get a message box which are almost empty but with a
few crap letters, something like i$g/ appears.
The message box contains an OK-button so after pressing that I get the
normal user/pass-screen.

The computer is scanned with F-Secure Antivirus and also checked by
several spyware-scanners but without result. Any idea of this? Someone
with similar experience?

Thanks in advance
Martin Rådbo
Teknologia

 

[Kerry Brown]

Hi.

I have a customer with a Win2k-server and some Win xp prof
workstations. AD which the workstations are connected to.

On one singel workstation, after pressing Ctrl-Alt-Del to loggon the
normal login screen there you can put username/password does not
appear. Instead I get a message box which are almost empty but with a
few crap letters, something like i$g/ appears.
The message box contains an OK-button so after pressing that I get the
normal user/pass-screen.

The computer is scanned with F-Secure Antivirus and also checked by
several spyware-scanners but without result. Any idea of this? Someone
with similar experience?

Thanks in advance
Martin Rådbo
Teknologia

Check what group policies are applied to that computer. There are some
policies to set a custom logon message.

 

[Rig.the.King]

Hey there Martin,

There's a registry key for that somewhere, let me see if I can dig it
up...

Here we go, in:

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon

There should be a key called LegalNoticeText (and possibly
LegalNoticeCaption). Deleting the key removes the text box after
ctrl+alt+del. Note that it may be called something different, as I
don't have another machine to check on just now. You could just search
the registry for that text string that it's displaying and delete any
keys in which it appears. Still don't know how it got there to begin
with, but that should get rid of it.

 

[Rig.the.King]

Martin-

I've had some time to look into this a bit more, just wanted to let you
know that I can verify that it's those two keys you need to look for.
Also, you don't need to delete the keys, just edit the values.

 

[Tim Judd]

Hey there Martin,

There's a registry key for that somewhere, let me see if I can dig it
up...

Here we go, in:

HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon

There should be a key called LegalNoticeText (and possibly
LegalNoticeCaption). Deleting the key removes the text box after
ctrl+alt+del. Note that it may be called something different, as I
don't have another machine to check on just now. You could just search
the registry for that text string that it's displaying and delete any
keys in which it appears. Still don't know how it got there to begin
with, but that should get rid of it.

Good suggestion!

what I thought it might be is an application that launches at startup;
is trying to tell you about a problem (in whatever language) -- becomes
garbled to the en-us charset, and provides your error box.

Uninstall any unknown product in Add/Remove that is there --
spyware/adware, general badstuffs!

good luck

 

[news]

Thanks for theese suggestions. The two keys are there but they are
emtpy, I'm not sure if it is such a good idea to delete them???

The other suggestion about some spyware was my first thought when the
problem appeared but the computer is quite clean and I'm not able to
find any unwanted spyware for the moment.

// Martin

Tim Judd skrev:

 

[MattPWalker]

I'm a computer technician in Australia and have noticed the same
problem on a few computers that have come into our workshop. On a few
occasions the computers in question have lost their file associations
and display this legalnotice window prior to login. The window doesn't
actually contain any text though. Usually just ASCII boxes..

There is usually traces of various types of spyware on these computers
but after searching through the registry for all traces of
legalnotifcetext and deleting or setting the key values to empty I
still get the garbled messages displayed before login. If I set text
into the appropriet keys I do in fact get that text displayed in the
window (but it often takes a few reboots to display properly). When
the keys are deleted or blank I have also noticed the windows title or
the caption part is displaying a random garbled system directory.

Oh and the computers usually have XP Home on them so there doesn't seem
to be a way get to the Local Security Policy Settings to see if there
is a "Message text for users attempting to log on" as described here
http://www.windowsnetworking.com/kb...ous/LogonBanner-DisplayingWarningMessage.html

Can anyone shed some light on these problems and/or suggest any methods
to get rid of them.

Many Thanks

Matt

 

[MattPWalker]

I figured it out.

The whole premise of the box is to alert users to something before they
use the pc. Its a set of keys in the registry called legalnoticetext
and legalnoticecaption and we'd tried deleting them and putting values
in them but it just seemed to stick around ... after some hunting I
figured out the following though

Its not so much about any one particular key but it may be about a
combination of keys. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon needs to have LegalNoticeCaption and
LegalNoticeText strings configured to be empty as does
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\system.
This combination of empty keys seems to make the dialog not appear
when loading windows loads.

hope that helps someone out there