Windows Explored

Everyday Windows Desktop Support, Advanced Troubleshooting & Other OS Tidbits

Do You Want to GPF Today?

Posted by William Diaz on October 12, 2010

She called me one day. I had no idea who she was. She was in one of our local offices and someone told her I was the crack desktop support tech to speak to cause “he knows a lot.” This is true, no doubt, and I’m honored some people think this highly of me. Since then, she has called me over many an issue, and in particular turned me on to what has become a known bug between Internet Explorer, a 3rd party toolbar application we use for tracking time (LexisNexis for the benefit of search queries for this in my SharePoint blog), and shipper’s tracking website. This would happen while trying to print shipping labels via Internet Explorer. Yes or No would crash IE. The error would often present itself as the following:Runtime error. Corrupt block/Unknown block type freed. This is probably caused by freeing a static variable or bad pointer. Do you want to GPF?

I am not going to pretend this makes any sense to me other than GPF is a general protection fault and some protection mechanism has been violated (yes, I am intentionally being vague). Aside from that, I really do enjoy seeing things crash. If you are running in Windows XP, there is a special place you can look that I mention every now and then contains info on application crashes: C:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson. I opened the drwtson32.log, went to the end of the log, verified the iexplore.exe was the crashing process, searched for the FAULT and the likely culprit revealed itself without a fight:

If you have not caught on by now from previous blogs, you should know that I always start by looking for the 3rd party component. Also notice our error message in the raw stack dump. I also happen find the same error message in an error log file in the application folder for the program:

Just to be sure, I opened another log on a different workstation with the same issue and saw LNToolbar in the stack, too. The stacks don’t always look identical, but they always reveal the same components:

LNToolbar is the name of problem add-in. Earlier versions of this toolbar were known to crash IE in particular situations. Since then, the developer had released a new version to correct this issues so I needed to make sure the most current version was installed. A quick check revealed it was. It looks like a new bug has been discovered that we needed to escalate to the developer. In the meantime, I need to set the user up with a workaround so she can get her work done. Doing this should be rather simple–just disable the LNToolBar in Internet Explorer from the Programs tab. However, non technical staff does not have this ability due to group policy restrictions, it will be grayed out, it it doesn’t matter if you are a local administrator:

Additionally, this setting is enforced via group policy as well, so turning it off once for the user did not mean it would remain turned off. And, who knows, she might have a need to use it at some point. To overcome this, I decided to create a little program she could run to turn it off at will instead of directing her to go into the registry and modify this. I would first need to find out which keys were involved in the registry that disabled the ability to disable this add-on in IE.  Since IE enforces these settings based on the class identifier of the add-on, I would need to obtain this first. To do this, I simply searched the registry for LNToolbar and found the key in the first hit in HKEY_CLASSES_ROOT\CLSID\{E92748B4-AFCC-4533-8876-DB99FD857949}.

The portion of the registry that controls what add-ons in IE are enabled or disabled is controlled from HKCU\Software\Microsoft\Windows\CurrentVersions\Policies\EXT\CLSID. To disable the toolbar, I changed the value of the string from 1 to 0:

Knowing this, I could then write a small vb script that changes the value of {E92748B4-AFCC-4533-8876-DB99FD857949} to 0. Alternatively, you could wrap this up in a little executable. I was playing around with Visual Studio and .Net when I came across this so I decided to write it there.

Advanced desktop support should be a jack of all trades and I encourage any advanced or intermediate troubleshooter to dabble a bit into programming to learn some important computer programming concepts, it will improve your troubleshooting prowess. To start, you can get Visual Studio Express from Microsoft for free. Active students can also get the pro version for free as well. Visit Microsoft Spark.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: