XP logon screen message

[Neil]

I have a PC running XP home with several users, some of which are password
protected, but all are admins.

PC has recently had a virus / spyware problem, which appears to have been
resolved.

When the PC boots and goes to logon screen, then everything looks OK.
If I log off to change user or PC goes back to logon screen, there is a
message at the bottom left of the screen.
Where it says Turn off, it also says 'This thing betta start working
properly' is this linked to a virus, or can it be edited manually?

Thank you

 

[R. McCarty]

Definitely sounds malicious. Without knowing what security apps
you have, I'd recommend a few additional scans. First download
Update & run Malwarebytes ( on a weekly schedule ). Second I'd
run an alternate AV vendor's online scan of your PC. There are
several to choose from:
NOD32: http://www.eset.com/onlinescan/
BitDefender: http://www.bitdefender.com/scan8/ie.html
*Based on Active-X add-ons, follow on screen prompts to install
and perform scans.

Download link for Malwarebytes 1.44:
http://www.malwarebytes.org/mbam-download.php

 

[Jose]

I have a PC running XP home with several users, some of which are password
protected, but all are admins.

PC has recently had a virus / spyware problem, which appears to have been
resolved.

When the PC boots and goes to logon screen, then everything looks OK.
If I log off to change user or PC goes back to logon screen, there is a
message at the bottom left of the screen.
Where it says Turn off, it also says 'This thing betta start working
properly' is this linked to a virus, or can it be edited manually?

Thank you

Are you able to logon anyway?

You need to be sure your virus / spyware problems are resolved.

Perform some scans for malicious software, then fix any remaining
issues:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

They can be uninstalled later if desired.

 

[Neil]

Thanks for the comments guys.
Chcked for the message in the registry and it shows up under 'Lanmanserver'
as 'srvcomment' and refers to the computer description.

Maybe the user has changed it/

Thanks