All Windows text turns to Hieroglyphics ? 2

[smackedgeezer]

This has happened three times now. I boot up to find all my windows text has turned to some form of hieroglyphics. I run Windows XP SP1 with all updates loaded. McAfee Virus scan pro runs all the time and is updated daily and I run BPS Spy ware and Trojan remover on a regular basis. Popups are handled by popup cop. First time this happened I reformatted and installed a fresh XP install. The last couple of times I had windows repair itself, which it seems to do 100%.No programs have changed and no information is missing. Any ideas to what maybe causing this extremely frustrating problem? I have tried changing the language while the problem is occurring but this seems to do no good! Virus or Trojan scans find nothing.

 

[mrainey]

I've seen this problem with Win98. Try running the Command Prompt, full screen, then exiting back to Windows. That always cleared it up for me.

Never figured out what was causing it.

 

[linney]

This is a Font Troubleshooter

http://www.adobe.com/support/techdocs/2f232.htm

There may be a problem with the installed video driver. Check with the video adapter manufacturer for a possible video driver update.

When it next happens try Safe Mode and see if the problem is there too.

Similar story here.

This is a good one
thread779-750432

 

[benselect24]

This same thing happened to a windows XP home machine I was working with. One day I rebooted and all the text looked like garbage characters or extended ascii characters.

Here's why mine was broken: The registry key that contains all of the truetype font info was totally missing. I could install fonts and get the display readable again but when I rebooted the garbage characters returned.

To fix it, I added the registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Fonts

and THEN reinstalled the fonts in c:\windows\fonts

After that registry key existed, installed fonts would remain installed.

This was a lifesaver:

http://www.mydesktophelp.com/tips/win113.htm

 

[linney]

Thank you for posting that fix.

 

[bcastner]

Be aware of any file in your Font directory that if shown in Windows Explorer, View, All hidden files, appears to have an .hta or .HTA extension.

This is becoming very widespread as malware, and in some instances can rename all of your .exe files on your computer before you know what hit you.

Look first to the original font file. There should not be an .htt or .hta extension file there anywhere.

 

[linney]

Details View will show you the actual Font "file name" and extension. (Make sure all the options to show hidden and system files are set in Folder Options/ View, and that "Hide extensions for known file types" is not checked.

This HTA stop (free program) may be worth considering.

http://www.nsclean.com/htastop.html

 

[bcastner]

The .hta and .htt extensions have been co-opted by terrible guys on the internet.

If, viewing the property sheet, you see a reference to a .vba or other dependent program, please, remove them.

This has in the last three months or so become a serious, and a serious p.i.a. issue to resolve.

A good on-line virus scan from Trend or Panda should pick-up the "fake" entries: faq760-3862

There are several variants where if you remove with "traditional" anti-spyware/nagware/malware tools the registry entries, the underlying core module begins resetting all of your .exe files to zero length, with a corrupted copy renamed somethings else.

(No, not an earlier TD3 issue).

 

[linney]

"There are several variants where if you remove with "traditional" anti-spyware/nagware/malware tools the registry entries, the underlying core module begins resetting all of your .exe files to zero length, with a corrupted copy renamed somethings else."

Bill,

Do you have a link to an example of this (or a link to further information), especially concerning zero-byte exe? You know they're a pet hate of mine.

Thank you.

PS. It is TDS-3.

 

[bcastner]

Give me a little time, I have in my notes a malware that at best I can read is "in the Rondow genre that detects through a secondary launch whether the original resident program or registry entries have been modified, and if so begins damaging exe files with zero length entries." I know the reference is from broadbandreports.com and the security forum, and I need to ask the nice folks there to find the reference. Will report back.

 

[Rahosi]

Thank you for saving my life benselect24.

For reference I got the Hieroglyphics on rebooting during updating Zone Alarm Pro to the latest 4.5.538.001.

The HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Fonts
had completely disappeared from my registry.

Without another computer alongside to mirror my cursor selections I would have had to reinstall!
Thankfully fonts were visible running Regedit from Safe Mode > Command Prompt.

SFC/scannow kept freezing or would not run at all in Safe Mode.
At one point a BSOD > Bad Pool Caller was triggered as well.

 

[Rahosi]

It happened again! To a different computer! This time I couldn't read the fonts whilst running Regedit from Safe Mode > Command Prompt.

I copied the Reg Key above from an unaffected computer onto a floppy, and by mirroring key strokes from the unaffected computer, managed to import it into the affected computer.

What concerns me is the unlikelihood of just a solitary Reg Key disappearing. What other corruptions took place at the same time??

System Restore doesn't repair the problem!!

Both computers run McAfee v8, ZApro, Lavasoft & Spybot, fully up to date. Both use Matrox Millenium G550's and Abit/Highpoint Raid mirror disks. XPpro English only language installations.

The SFC/scannow problem above was an unconnected issue. (I was running a raid mirror on the IDE slave connectors in cable select mode, the 'primary' IBM DeskStar drives having failed AGAIN [4 out of 4!], and had been sent back to Hitachi for warrantee swap out again! This mode of operation caused various problems. The inability to run SFC. That Event Viewer > System reports about Highpoint and hard disk problems etc etc).

 

[linney]

This program I can highly recommend for backing up and restoring your registry in difficult situations.

Registry Backup and Restore for Windows NT/2000/XP

v1.1a, 10/03/2002, Freeware
Written by Lars Hederer


Look for the latest version here:

http://home.t-online.de/home/lars.hederer/erunt

 

[kaizer]

hey Linney
i just tried to download htastop from that site (it actually says the download is at simtel.net which is not available)
i'm trying to help out a colleague
do u have that file?
and if so, can u email it to me?
thanks much

 

[linney]

HTAstop can be downloaded here. Some SP2 Windows Updates downloads may be a problem with it as I believe Windows are starting to use some sort of HTA files in the process. It is not a program I use myself.

http://66.102.7.104/search?q=cache:...s.com/psc-products.htm+HTAstop+download&hl=en

A similar type program which I still use is Script Sentry, rather than blocking everything this produces a visual warning and lets you decide. It also covers more dangerous file types and is free.

http://www.jasons-toolbox.com/programs.asp?Program=Script Sentry