Restoring the normal Startup/Shutdown screens 1

[crisc]

A former employee modified one of our users PCs so that instead of the normal Windows screens that show when the OS is loading or when its shutting down, it shows, let's just say "something else".
The easiest way to do this is to replace the logow.sys and the logo.sys files with a renamed .bmp of your choice, and I've already confirmed that has not been done. The logo files are actually the right ones.
I had thought another way to do this might be to edit the line in the registry that identifies the path to these files, so Windows will load the other file instead, but I can't find anything in the reg that tells Windows where to load these files.
There is no 3rd party utilities or anything loaded on here that this person might have used. Anyone have any ideas on this?

 

[wolluf]

Is it all the screens? Win98 only has logos.sys and logow.sys in \windows by default (the 2 closedown screens), but if you place a logo.sys of the right size in the root of C: it will be used as startup screen.

If this doesn't cover the problem, you could try Desktop Architect (

http://www.lpacomputers.telinco.co.uk/da211.zip)

- its got a feature to return screens to default.

 

[crisc]

Thanks Wolluf. The screens that have been comprimised are the Windows 98 "splash" screen and the "Please wait while windows shuts down" screen. There are no logo* files in the C:\ root.
I tried your link to Desktop Architect, but the zip file produces an error saying it's missing 1085 bytes of data. I tried Googling around for a copy somewere else, got lots of hits, but all the download sites have yanked it.

 

[BuckeyeComputers]

check you system.ini file to see what background is set there, this usually happens when someone loads a desktop theme that overrights these and gets stuck. also try to find the file names for these pictures and see if you can delete them from the harddrive or maybe even find a new theme that might overright them and then restore to normal

 

[wolluf]

crisc - try

http://homepage.ntlworld.com/stephen.dunn4/da211.exe

 

[crisc]

I get "page cannot be found", is it working for you?!

I went one level up at that site, and it had a list of six utilities, none of which are named Desktop Architect, nor link to the /da211.exe path you provided. In fact, about 3 of the ones that are there point to non-existant pages.

 

[wolluf]

Sorry Crisc - wrong site (old one I can't update any more) -

http://homepage.ntlworld.com/steve-dunn/da211.exe

 

[crisc]

Thx Wolluf, that address worked and I was able to install it. It looks like this will do what I want, I'll post back in this thread once I've tested it on the affected PC.

 

[crisc]

Unfortunately, the problem remains. Oddly, Desktop Architect shows the correct screens as already in place, which takes me back to my theory that a registry entry has been hacked to direct Windows to a different path/file to use.
I guess I'll just reinstall. Thx for suggestions.

 

[tazzed]

Have you tried run system file checker, if not have your Win98 cd Ready.
Goto RUN Type "SFC" Click OK
go it to settings check "Check for changed files" Click Apply then OK
Then Hit START
Watch for Logos.sys, Logow.sys, and Logo.sys change them back to orignal
They on the cd "cd drive:\WIN98"
or Just copy the first two files from another Win98 Mach.
They Are in C:\windows\system
And look for logo.sys in the root drive (c and delete or rename it. Either way will work

 

[crisc]

Thx cjmaki, but in my first port I tried to make it clear that the 3 logo*.sys files are all normal. They haven't been replaced, altered, renamed, etc. It's as if the PATH Windows uses to determine which image to show during bootup, shutdown, etc has been modified. I haven't been able to find anyplace in the registry that determines this, but it's got to be there...

 

[wolluf]

crisc,

what happens if you remove the logo.sys file in the root of C:? Windows 98 doesn't use this file by default (ie, there is no logo.sys file when you first install 98), so if its not there you should get default.

Have you tried searching the drive for .sys files - see if you can spot where the offenders are? Or for files of the right size (c. 126kb)?