Windows Legacy OS forum

General discussion

Gibberish text after spyware removal.

by Stan Chambers / July 16, 2005 2:14 AM PDT

The machine: Compaq Pressario SR1103
Window XP Home, 256 MB PC2700, ASUS CDRW, NAV.

I ran Microsoft Antispyware Beta 1. Found and removed
eZula.WebOffer, eZula.TodText, Target Saver Trojan Downloader, SearchForIt.Adshooter, and Hotbar Shopping Reports.
After rebooting, all the text in Windows is gibberish, (Symbols).

My questions: Will a system recovery, using the recovery disk fix the problem?
Are there other possible fixes?
The system has a D:\ partition, which apparently contains the Recovery Console. It's an option at the boot screen.
Is it possible to repair this particular problem from the Recovery Console, or is the Repair install my only option?
I had this happen on a Dell laptop before, and somehow was able to run System Restore to fix it, but it appears that System Restore is disabled on this machine.
Any advice is greatly appreciated.

Discussion is locked
You are posting a reply to: Gibberish text after spyware removal.
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Gibberish text after spyware removal.
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Just wondering.
by R. Proffitt Forum moderator / July 16, 2005 2:26 AM PDT

Why did you disable System Restore?

-> Do try IEFIX which will set IE back up to defaults. Sometimes I find the user or malware changed the encoding, font or other. IEFIX and WINSOCKXPFIX helps you automate the repairs.

Have the XP CDs handy.


Collapse -
by Stan Chambers / July 16, 2005 4:25 AM PDT
In reply to: Just wondering.

Thanks Bob, I ran IEFIX, but no joy.
I posted this in the virus & security forum yesterday, but didn't get a response until today.
Edward O'Daniel suggested a possible Marlett font problem. MKKB article,
The displayed fonts on my screen, indeed appear to be the Marlett font.
I'll check out the article and post back.
Thanks again

p.s.: This isn't my machine, so I'm not sure why System Restore was disabled. When I open the program, I can't read the text, but the little green check mark is there indicating that it is disabled.

Collapse -
by Stan Chambers / July 16, 2005 5:03 AM PDT
In reply to: Just wondering.

After reviewing the MKKB article, it appears that the Marlett font file is not corrupt. The fonts appear to typical Marlett.

Next question, has the spyware changed the font settings in Windows?

If so, can they be changed back to the default font setting?
All advice is appreciated.


Collapse -
Ahh, system font setting.
by R. Proffitt Forum moderator / July 16, 2005 7:19 AM PDT
In reply to: Update

In Control Panel, appearances is where one can select another font for the system. One could pick an oddball like linedraw or another language and may cause panic.

-> About spyware and malware. I can't answer why the pests do such as that is more psychology and less about computing.


Collapse -
Ahh, system font setting.
by Stan Chambers / July 16, 2005 8:22 AM PDT

Hi Bob. Appreciate your response.
I've been to Display properties, Appearance.
I've been able to change the fonts for Icons, Message Box, Menu, and and a few other items in that dropdown menu.

Although they now appear normal, everything else is in Marlett font style.
I can't find an option to change sytem fonts or any similar setting.
Is there such an option or registry setting to change the default fonts for the entire system?

What I've tried, other than above.
I've booted Last know good configuration. No change.
I've reset BIOS to Default. No change.
Surely there is some method of reseting.
Thanks for your advice.

Collapse -
by R. Proffitt Forum moderator / July 16, 2005 8:38 AM PDT

It's an oversight of this OS. There has never been a big reset button.

-> Think over all those KB articles that have us run REGEDIT and do edits, deletes and additions. Not all settings are in the control panels (oops, another oversight.) Why isn't every item in some control panel is a very good question.

--> Open REGEDIT and search for MARLETT for clues what setting is off. But I usually find what I need in the appearances control panel. You may have to discover what that panel can do. For instead I surprised someone when I was clicking in the little display area of the appearance applet. No where do you find that area documented as being active.


Collapse -
Thanks for the tips
by Stan Chambers / July 16, 2005 10:07 AM PDT
In reply to: Nope.

I see what you're saying about the supposedly inactive window. Clicking there certainly speeds up the process of changing settings.

I didn't find any reference to Marlett in regedit.

Another clue that I had forgotten.
On the display properties card, Appearances tab, I cannot select the fonts that I want to use. There are only two options available. System, or Fixedsys.
If I select system, the text will appear normally for that item.

Finding this, I went to Control Panel/Fonts.
To my surprise, the folder is empty.
It seems that the pests have deleted all the fonts.

So, how to get them back.
I went to another XP machine and tried to copy the files to a floppy or cd, but no luck there.
What, if any, other options are there?

I did a search for fonts and found other files on the machine, but not the complete set that should be in the fonts folder.

Can these be extracted from another source?

Thanks for all your help. You seem to be the only person willing to jump in here.


Collapse -
Be sure you use 'other than Explorer.'
by R. Proffitt Forum moderator / July 16, 2005 10:15 AM PDT
In reply to: Thanks for the tips

Explorer may hide files from us. Open a command prompt and try....


The fonts are on the XP CD and MSCONFIG's expand file may help fetch .TTF files from the XP CD. Here's the stock fonts -> You should find these on your XP CD.


Collapse -
Fonts Folder
by Stan Chambers / July 16, 2005 12:22 PM PDT

Bob: I managed to copy the Fonts folder to a cdr.
When I attempted to copy to C:\Windows\Fonts, got a message box that the files are already there. Seems there some 39.2 MB of font files in the folder.

Any idea why they're not visible or accessible by the system?

I went to Folder Options and checked to show contents of System Folders, but no help.

Is it possible that the spyware changed the file attributes to make them unacesssible?

I'm beginning to run a little low on resources.

Any suggestions are appreciated.

Collapse -
That's ...
by R. Proffitt Forum moderator / July 16, 2005 12:59 PM PDT
In reply to: Fonts Folder

Why I noted to try the command line instead. Explorer, even when configured to show all files and extensions is still untrustworthy at times.

I'll read the other posts and comment if I have another idea.


Collapse -
Sorry Bob
by Stan Chambers / July 16, 2005 2:36 PM PDT
In reply to: That's ...

I should have noted the command line search revealed a total of 638 font files from Arial to Zeroes.
That shows that they're still in the system.

Collapse -
(NT) (NT) just curious...would SFC fix the problem?
by jonah jones / July 16, 2005 11:47 AM PDT
In reply to: Nope.
Collapse -
We think alike.
by Stan Chambers / July 16, 2005 12:05 PM PDT

Jonah: That's the first thing I tried, but it didn't do the job.
Thanks for the suggestion.

Collapse -
Stan, did you try this?
by jonah jones / July 16, 2005 1:00 PM PDT
In reply to: We think alike.

To change the look of Window elements
Open Display in Control Panel.
On the Appearance tab, click Advanced.
In the Item list, click the element you want to change, such as Window, Menu, or Scrollbar, and then adjust the appropriate settings, such as color, font, or font size.
Click OK or Apply to save your changes.

To open Display, click Start, point to Settings, click Control Panel, and then double-click Display.
Your changes are saved until you make further changes or choose a different theme.
Changing the look of individual items is only useful if you select Windows Classic in the Windows and buttons list on the Appearance tab. If you select a different option, the theme determines the appearance of your menus, fonts, icons, and other Window elements.
The Font area will be unavailable for elements in the Item list that do not display text.

fron start--> help and support



Collapse -
Stan, did you try this?
by Stan Chambers / July 16, 2005 1:25 PM PDT

Hi Jonah: Yes I've been there many times, but with little luck.

The Fonts options are not available there.
The spyware has evidently corrupted the fonts folder or changed some settings in the registry to create the havoc.

In C:\Windows\Fonts, there are no visible files.
However, if you hold the pointer over the folder, it indicates 39.2 MB of files in the folder.
It seems the files has become inaccessible to me or the system.

I checked in Folder Options to "Show Hidden System Files, but it had no effect.
I appreciate all advice.


Collapse -
Since you can't use Explorer, that's a clue.
by R. Proffitt Forum moderator / July 16, 2005 1:47 PM PDT
Collapse -
If it is a Permissions or Ownership issue
by MarkFlax Forum moderator / July 16, 2005 9:00 PM PDT

would using the systems hidden Admin account help?

Just a thought.


Collapse -
by R. Proffitt Forum moderator / July 17, 2005 12:41 AM PDT

I also install CACLS or such to examine the directory, file ownership and permissions for such oddities. It's not a hard tool to use, but the concepts are what's tough (at first.)

Now that I've had a few hours to think this over, it's either the registry entries noted in the other discussion or ownership/permission issues.

-> Don't you love spyware/malware damage? It's like a box of chocolates.


Collapse -
You have so many Crapware
by lilShortZaznXboi / July 16, 2005 2:25 PM PDT

You should always be protecting you computer

Collapse -
(NT) (NT) Not my computer.
by Stan Chambers / July 16, 2005 2:33 PM PDT
Collapse -
checkthis out
by gopinath_sastra / July 16, 2005 9:37 PM PDT

1. Run Regedit.
2. Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
3. Look for a key named Fonts. -- If this key is missing, create a new one
Right Click on CurrentVersion > New > Key. Rename the New Key to Fonts.
4. Go to Fonts in the Control Panel
5. Select File - Install New Fonts
6. Browse to C:\Windows\Fonts and double click on the Fonts folder
7. When the fonts display in the box above, click Select All then OK

Collapse -
Re: It's like a box of chocolates
by jonah jones / July 17, 2005 1:03 AM PDT

just one problem there Bob, it's all bitter almonds Sad no strawberry creams....



Collapse -
Beaten by the bug.
by Stan Chambers / July 17, 2005 7:20 AM PDT

Sorry guys, but I finally gave in to the urge to do a complete recovery on this system.

It's up and running fine now. I do hate to be outdone by these pests, but I was running low on time.
Maybe this discussion will be of some benefit to other in the future.

Bob, I did try your suggestion of changing the permissions of the font folder, but it seems to apply to sharing over a network. I'm not too clear on that.

Thanks to everyone who tried to help solve this mystery.
I've chalked this one up to experience.

"Right decisions are based on experience, while experience is ususally based on wrong decisions."


Collapse -
Ahh well
by MarkFlax Forum moderator / July 17, 2005 10:41 PM PDT
In reply to: Beaten by the bug.

At least you sorted it Stan. Well done.


Collapse -
I've got the exact same problem
by cush / August 8, 2005 1:37 PM PDT
In reply to: Beaten by the bug.

I have the exact same problem. It appears after a malware removal. The fonts folder is empty, copied them over from another computer to no avail. Can't even reinstall window since I can't even read what's on the screen! I guess I figure out how to boot from the cd and see if that solves my reinstall. The font that is currently showing up everywhere looks like that 'security' gibberish font that lotus notes and a few other applications use for the password masking. I've got TWO spyware programs running, McAFee AND the beta version of the microsoft.

Collapse -
Same Problem
by Stan Chambers / August 8, 2005 2:53 PM PDT

One thing that may correct the problem is System Restore.
You'll need access to another computer to memorize or diagram which buttons to click on, but if you can get to the calendar you should be able to decipher a date prior to the begining of the problem.

I couldn't do that because the owner had somehow turned off System Restore.

I have been successful doing that with a laptop that had a very similar problem.

Otherwise, you should be able to read the text in the BIOS, to set the cd drive first in the boot order. You can then boot from your Windows cd and reinstall the OS.

Best of Luck

Collapse -
System Volume Information
by phantazy / August 8, 2005 4:15 PM PDT
In reply to: Same Problem

Only as a matter of interest that if you disable system restore in control panel, the system volume information file is still there. Thus you can see a history of previous restore points, despite there being nothing noted in the calendar of system restore. I had a problem that Cnet review opened in full screen and could not be moved or minimised. I had disabled system restore to save resources. I used Resplendent Registrar> Edit to access my restore points, chose one with 'snapshot' and then merged it with the registry. This worked. I expect you can do this if you access system volume information from windows, but I haven't tried that, so cannot say if that option is available, bearing in mind it is a difficult folder to access. I think this should be advertised as it might save those with problems and system restore disabled, a lot of head scratching.

Collapse -
System Restore Worked
by cush / August 11, 2005 12:04 PM PDT
In reply to: Same Problem

Had to keep 'marching' back in time until it fixed itself. Strange, I had to go two days before the problem actually appeared. Seems I uninstalled some of the kids games and I'm guessing it took some of the fonts with it.

It was hard to figure out how to get into the system restore without being able to read the screen. Luckily I had another computer right next to the affected one, by looking at the icons and some good guessing at the back, next, cancel buttons it worked. Seems there is a way to use the system restore from the command prompt, but it seems that you have to set the restore, reboot to safe mode to run it, and the reboot again. The GUI version seems like it take care of all of this. I'm a techo-nerd at work but when it comes to home stuff... I just want it fixed.

Collapse -
(NT) (NT) Glad to hear you're up and running.
by Stan Chambers / August 11, 2005 2:22 PM PDT
In reply to: System Restore Worked
Popular Forums
Computer Newbies 10,686 discussions
Computer Help 54,365 discussions
Laptops 21,181 discussions
Networking & Wireless 16,313 discussions
Phones 17,137 discussions
Security 31,287 discussions
TVs & Home Theaters 22,101 discussions
Windows 7 8,164 discussions
Windows 10 2,657 discussions


Help, my PC with Windows 10 won't shut down properly

Since upgrading to Windows 10 my computer won't shut down properly. I use the menu button shutdown and the screen goes blank, but the system does not fully shut down. The only way to get it to shut down is to hold the physical power button down till it shuts down. Any suggestions?