RE: Unhappy face icon on NT 4 workstation

From: Tom-Rune.Berg@telenor.com
Date: 02/18/03

  • Next message: Steve: "Re: Ye Olde OWA Topic (Was RE: Website inside or outside domain)"
    Date: Tue, 18 Feb 2003 20:48:01 +0100
    From: <Tom-Rune.Berg@telenor.com>
    To: <focus-ms@lists.securityfocus.com>
    
    

    > That aside, it is also possible for the desktop to get "whacked" (yes I said
    > whacked cause I have no other name for it) and as a result, Icons in general
    > get shuffled over. In other words, where you might see a FOLDER icon, you
    > will see a NOTEPAD icon, etc. Where there any other problems with ICONS? If
    > not, I'd venture to say it was my first suggestions. None the less, the ICON
    > in of itself would not bother be, but that someone had admin level rights to
    > change this, would.
    >
    > I would suggest rebuilding that system, unless you can find how someone got
    > in, and ensure that nothing was planted (i.e. back-doored). Good Luck
    > -bill-

    Hi,

    If you can locate the wonderful "TweakUI" application for NT4, it has a feature that rebuilds icons when the desktop 'whacks out'

    I have successfully used this tool to repair Windows 98 and Windows XP Pro when they have 'whacked', although the XP rescue operation took 36 hours. The computer was partially unresponsive for that user while this went on, however I was successful in running background processes, server services and light usage of other simultanous user accounts.

    kind regards,
    Tom R. Berg

    -----Original Message-----
    From: Sopatyk, Donna [mailto:donna.sopatyk@eds.com]
    Sent: Thursday, February 13, 2003 1:24 PM
    To: 'focus-ms@lists.securityfocus.com'
    Subject: Unhappy face icon on NT 4 workstation

    Hi all,
    I've had some unexplained things happen on my NT 4.0 workstation. I was
    having some problems with blue screening before because my palm pilot cradle
    was not set up right with the baud rate. I also noticed that someone had
    mapped a drive to another server with the Administrator account. I know I
    don't know the password for that account, and that concerns me.
    When I was checking things out, I noticed that "my computer" icon was like a
    yellow unhappy face. I've never seen that before. When I placed my cursor
    over it, it changed to a different icon...but no the hardware drive that it
    usually looks like. After I rebooted, it went back to normal. Hasn't
    happened since. I've disconnected my PC anywhere, ran a virus scan on my
    machine and changed my password.
    Has anyone ever heard of a unhappyface icon on NT? Virus or otherwise?
    Thanks
    Donna

    Donna Sopatyk
    MCSE+I CNA
    Information Security Analyst
    EDS
    Phone: (403)205-2893
    Pager: (403)205-2136



    Relevant Pages

    • RE: Unhappy face icon on NT 4 workstation
      ... ICON either as a stand alone or to a area within a DLL. ... changed this to point to another DLL which contained the "unhappy face". ... ran a virus scan on my ...
      (Focus-Microsoft)
    • RE: Unhappy face icon on NT 4 workstation
      ... delete the c:\winnt\ShellIconCache file and reboot. ... Unhappy face icon on NT 4 workstation ... ICON either as a stand alone or to a area within a DLL. ...
      (Focus-Microsoft)
    • Re: Taskbar/ Notification bar icons
      ... Thanks for your interest Roy. ... This thread started off trying to identify an icon I had in the Notification area of the taskbar. ... In the course of the evaluation, I found a file which created some interest and the thought was that it could be a virus. ... effectively and extending battery power." ...
      (microsoft.public.windowsxp.general)
    • Re: Taskbar/ Notification bar icons
      ... it does (but no explanation of how it should be used)in the manual. ... an icon I had in the Notification area of the taskbar. ... In the course of the evaluation, I found a file which created some interest and the thought was that it could be a virus. ... drive and reinstall Windows using the recovery software. ...
      (microsoft.public.windowsxp.general)
    • Re: cannot delete file -- cannot read from source file or disk
      ... Restart in Safe Mode and log on with the computer's built-in Administrator account. ... Right-click on the icon and select the Security tab. ...
      (microsoft.public.windowsxp.perform_maintain)