Yahoo toolbar causing Internet Explorer 8.0 to crash

I had one of my users come and grab me saying that their Internet wasn't working. Anyone who has worked long enough with computers knows this can mean anything but since I was just using the Internet to pull up some information, so I knew it wasn't building wide.

 I followed her to her desk and she launched Internet Explorer 8. It opened and then instantly closed itself. Odd, I opened my self and it did the same thing but stayed open a little longer. I popped open task manger to ensure nothing funny was happening. Didn't see anything funny. I jumped into "Internet Options" and changed the home page to http://www.google.com/ since it is really basic and I thought maybe a page was causing the problem.

Opened IE again and this time it would stay open but the one tab kept crashing and the recovering the tab over and over again. I went ahead and went the through the same process as above and changed it to  a blank page then reopened IE. Same behavior.

I thought maybe it was possibly malware behavior but wasn't really sure. Fired up Process Explorer and Process Monitor by Sysinternals. Process Monitor didn't seem to show anything odd. I then went to Process Explorer thinking that now it was probably a dll loaded with IE with causing a problem. Went to properties, and then Threads for iexplorer. I noticed one of the dlls that was pretty active was yt.dll. I looked at the top of IE and noticed a toolbar, after searching to confirm my thoughts the dll belonged to the yahoo toolbar. I uninstalled the tool bar and reopened IE. It was working fine.

Not sure what changed that caused the sudden problem, no updates happened in that time frame but if you start to have the same problem hope this helps.

UPDATE - I am seeing alot of traffic on this post and from the comments we can tell it's happening to multiple people and it started today. I only had one user with the problem. I saw a yahoo question about this apparently with vista it will tell you that yahoo toolbar is the problem, which would have made the proble easier. My user had xp and it told me nothing other than crashing. I will be contacting yahoo, if they don't already know. Curious if it's a certain toolbar version.

UPDATE 2 - I did see that the following update got installed yesterday on the computer: KB2079403. You can read the following link by microsoft http://support.microsoft.com/kb/2079403 and it seems to apply to all versions of windows. Dark stated his had a similar issue but that he had no such updated, and the last update was 11/19. So furhter proof it's most likely not microsoft update.

Update 3 - It looks like probably the problem had to do with an older version of the toolbar. Most people don't update theirs. What caused it to break today is still a mystery.

FOR THOSE WANTING JUST THE FIX AND NOT THE STORY
-Just uninstall the Yahoo toolbar.
-Install the latest version of the toolbar if you still want it. (Latest version seems to be working)

Using Sysinternals Desktops to assist in removing a virus

Sysinternals Desktops

I was asked to look at a computer that was acting funny by a friend; they thought that it had a virus. After working on the computer for a little while I didn’t notice anything that really popped out. But I went to install Microsoft Security Essentials and it would never complete. It wouldn’t lock up the computer and the scroll bar kept rotating. I also noticed that shutting down and starting up was taking longer than it should.

After realizing something was up I opened task manger and didn’t notice anything odd. Winlogon was being more active than it should be though; something I only noticed because I was trying to see what would maybe be conflicting with the MSE install.

So I decided to start diagnosing and pulled over the Sysinternals suite to look around. Weirdly though anytime I started to try and open Process Monitor, Process Explorer or Rootkit Revelear they would open for about a second than close again.

I was confident at this time that their existed a virus on the computer. For testing I named a text document “Process Explorer” and opened it. It also was force closed shortly after that. I knew this was a pretty sure sign that I had something to wrestle with. Also I noticed a weird rar.exe file sitting hidden on my jump drive I used to move files over. I would delete it and it would return while being plugged into the computer. So I had a pretty good guess that the program would propagate itself using jump drives. I was after a reboot able to get MSE to install but left it alone so I could figure out the virus.

So I set out to find out a way to start process monitor or Process Explorer, since I knew if the virus didn’t want me opening these tools, then I would be able to use them to find my solution. So in trying to figure out how to trick the program I tried renaming the programs which still didn’t work. After a little bit I saw the Sysinternals desktops application in their suite and wondered how it went about creating multiple desktops on the background. I thought maybe (or had a small hope) that maybe the virus wasn’t smart enough to notice apps running inside a different desktops. After running desktops and opening a second desktop I was able to open, in that second desktop, process monitor and process explorer.

I restarted the computer wanting to ensure that it was desktops and not something I had done earlier allowing me this. After windows loaded I had the same problem of not being able to run Process Monitor and Process Explorer. I Fired up Desktops again and in the second desktop again I was able to get them running fine. Desktops will forever be in my antivirus removal box because of this.

I didn’t notice anything funny in process explorer and everything listed as Microsoft signed. The machine was actually very clean for a home user. So I ran Process Monitor for a minute and stopped it looking for any peculiar behavior. After looking through I noticed what I noticed earlier, winlogon was showing up way more than normal. After filtering to include only winlogon I noticed that about a little under every second it would check a key here:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acdcacaeaacbafbeaa



Process Monitor of Winlogon Activty - Part 1





Process Monitor of Winlogon Activty - Part 2

And then all the subkeys. The funny random name of the key was a bad sign. I popped up regedit and saw the it also had a dll with the same random key name, as it’s, file name located in the system32 folder of windows. I was pretty confident this was my problem. I exported the key just for sure and then deleted it. Right away the key was back.

I also noticed it would look at Pending File Rename Operations and then also a value called Blud under the Winlogon key. With all this info I then, went back to installing MSE and after it installed and manually installed the latest defenitions which I had downloaded earlier. I right-clicked the DLL acdcacaeaacbafbeaa.dll in the System32 folder and told MSE to scan it. It then said that it had found WORM:Win32/Swimnag.gen!A.dll I did a search and came up with this link from google. http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Worm%3aWin32%2fSwimnag.gen%21A

I checked the dll was gone, good job MSE on keeping it gone. I was then able to go into the registry and delete the blub key located at HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\

I also noticed the associated key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\acdcacaeaacbafbeaa" was no longer there. After reviewing the scan history on the computer I pulled up the log and noticed MSE had removed it too.

After watching taskmgr.exe and running a Process Monitor session I could see that winlogon was back to normal. I restarted the computer one more time to see if this time it would boot normally. It did. Also the computer stopped placing the hidden Autorun.inf and rar.exe on the jump drive. The computer was overall a lot more responsive. At this point I did a full scan with MSE and discovered no further problems.

CONCLUSION – I have tried to see if anyone else has used desktops to prevent a virus from closing applications and posted the story online but haven’t seen it. I don’t think this was an intended use of desktops but very interesting none the less. I would love to hear if this works for other viruses.

NOTE - Microsoft's stance is normally that after your system has been compromised you should reinstall the computer. I didn't do it here because I was feeling challenged at the time, and didn't have the disks for this persons computer. Normally I do reinstall since.

UPDATE - Shared this with Mark Russinovich and based on what I said the program was checking the Window titles, using window enumeration and that it only works for the current desktop. That is why I was able to use Sysinterlas Desktops to create another desktop to open Process Monitor and Process Explorer.

FREE Windows Timer Application to replace SteadyState Timer

So I have worked with a library that currently uses SteadyState. As we were getting ready to migrate to Windows 7 and new computers we found out that the compatability was non existant. So we couldn't use steadystate. Than just recently Microsoft came out to state that they were going to end support for steadystate eventually anyways.

You can still download SteadyState till the 31st of December after which no more. You can read that announcement here. Also they released some documents which help you to duplicate many of the features of SteadyState, which Keith Comb's covers in one of his blog posts here. I recommend reading the blog post and snagging all three documents.

One of the things you discover though is that the timed log-off/shutdown/restart functionality just isn't there. You could use a script to log them off but then the user never know's how much time they have before reboot or log off. So I went ahead and wrote a little program to duplicate this behavior.

It allows you to set whether you want when the time ends to restart,logoff, or shutdown. It will display a bubble in the bottom right corner counting down the time. You may have different times for different user. Also their is no installer just the exe, the readme, and a example registry value. I recommend putting a key in the registry under the run value for windows. Seems to work great. If you have any questions please contact me at mortythe2 @ gmail . com no spaces. Or leave comments here.

Download Here

Change IP Address of EBS Conflict with router

So I am one of the handfull of people that purchased EBS, no laughing. Normally it has been a good product. Recently though I had the need to move our management server to another location which involved another subnet.

One of the things you really want to remember is that you must change it's ip address first and then move it. The reason is because you are strongly recommended by microsoft to use their "Change IP Address Settings" wizard. This wizard checks connectivity with the other two servers and makes changes to them.This is fine but I ran into a little problem. Something I am not new. to

Sadly the setup of EBS was a royal pain. after it was setup it was fine but I have not been in any way impressed with their wizards, setup or other. Maybe for some they worked but I think it's just that updates broke them and the EBS team had given up the ghost, even before the announcement was made.

Anyways Back to the story. After firing up the wizard and having it do it's check it provides you a box to change the IP Address, Subnet Mask, and the Gateway. After changing the Gateway and IP address. It came up with the error you see in the picture above.The selected IP address is already in use by another system with physical address XX-XX-XX-XX-XX-XX. (In the picture above I changed the Hardware address.)

So I double checked to ensure the address I gave it wasn't already used. I then moved to an IP above. Got the same message with the same physical address. Tried 4 other IPs all same physical address. So I checked the arp table. That physical address was tied to my router. A tad odd. Any address from the other subnet I put in their gave me that error. I have never had any other product point to my router like this. So after doing no searching I tried my own solution that worked.

Right after you enter the IP address but right before you click on the "change" button it is going to do a check to see if that IP address is in use, which in my case was broken and stopped me from working. So right before clicking "Change" then unplug the server from the network and as soon as the "Progress of IP address change"(Next screen) screen comes up then quickly plug it back in. If you don't then you will get errors on this screen, and will have to close the wizard and try again.

After using the unplug method to skip the error check I was able to move the server. Problem was I had to change some of the security server firewall settings. For Example I had to change the IP address of my Mangement computer under these two computer sets:

• Remote Management Computer
• DNS Servers

Also had to update a few other custom policies, after that though it straightened all of that out. You will also need to upgrade some group policies. Follow the instructions at this technet link: http://technet.microsoft.com/en-us/library/dd996618(WS.10).aspx

You can also check all that it does or should change by going to this link: http://technet.microsoft.com/en-us/library/cc540075(WS.10).aspx . Hope this helps anybody else out that may run across this.

Symantec = Fail or windows cannot load the user's profile

So I recently started fixing personal computers again recently and remembered why I hate doing it. Anyways I was asked to look at a slow laptop. After taking it home I connected to the internet after noticing it appeared to be virus free. I ran a defrag and it ran some updates.

After doing this and rebooting I saw a screen I didn't like.I was getting aa 16bit 640x480 welcome screen. It gave me the error: windows cannot load the user's profile but has logged you on with the default profile system. Detail - Insufficient system resources exist to complete the requested service.Ugh and it was giving me an error about bcmwltry.exe. So I rebooted into safe and tried to do a restore. To earlier that day it succeeded but I was getting the same problem. So I tried to before I had touched it and it wouldn't restore. :( I then removed the Dell Wireless utility to at least get rid of the bcmwltry.exe error to see if I would get anymore.

I also created a new user just to check. After rebooting I then selected the new user and get the following error: userinit.exe the application failed to initialize properly 0xc000012d. After looking around I found two forums mentioning Symantec Antivirus as a possible culprit after it had gotten a update of some kind. I am sure while I had it connected to the internet it had done this.

So let me state first off. I have already had numerous problems with various versions of Symantec in the past, don't like it and if I have the choice I uninstall  it. I hadn't done this yet because the user had a up-to-date subscription and I hate to remove a product that someone has paid a subscription for.

Continuing on with the story, I went ahead and in safe mode ran msconfig killed all symantec related startup items. Also disabled all the Services. A reboot later and still no go. I took it a step further in Safe mode. I renamed  the following three folders:

• C:\Program Files\Common Files\Symantec Shared 
• C:\Program Files\Symantec
• C:\Program Files\Symantec Antivirus

I just added .old to the end of the folders. After a reboot I had the beautiful welcome screen I loved. And guess what, the system was speedy as all get up. That was a good enough excuse for me to remove Symantec. I renamed all three folders back to what they were and did an install of anything Symantec. 

After this I went about my normal computer cleanup steps and installed a free antivirus solution. I predict a very happy client.

MORAL OF THE STORY - Beware of Symantec - (aka If you start having problems with your computer check your Symantec Antivirus Software)