A user called in and requested one of our technicians to assist in removing some annoying autorun applications. Upon opening the Control Panel and going to Add or Remove Programs in Windows XP, the rundll32.exe process was crashing. The same applied for any process that required a CPL to run:
I was asked to assist and started by going to C:\Documents and Settings\username\Application Data\Microsoft\ Dr Watson. I opened the drwtsn32.log and scrolled to the bottom, confirming that some error in rundll32.exe was being encountered: Read the rest of this entry »
Archive for the ‘Troubleshooting’ Category
More Process Crash Troubleshooting
Posted by William Diaz on March 2, 2012
Posted in Troubleshooting | Tagged: Crash, Dr Watson, Malware | Leave a Comment »
Unraveling and Resolving An Outlook Crash with Process Monitor
Posted by William Diaz on March 2, 2012
While trying to import documents into our document management system via Outlook, Outlook would just abruptly close on the user. I started the initial troubleshooting by disabling a couple 3rd party add-ins in HKLM and HKCU\Software\Microsoft\Office\Outlook\Addins that were not part of the normal image. This can be done by modifying the load behavior of the add-in (see this MSDN article for details), but this had no effect on correcting the behavior. I thought about capturing a crash dump of Outlook but decided to not waste any time there because, at this point, with the add-ins disabled, I likely was not going to see anything but the document management modules in the dump.
Instead, I turned to Process Monitor; perhaps it might reveal what Outlook was doing just before it crashed and give me some important clues. I set a filter to monitor only outlook.exe, dragged an item into the document management space in Outlook and waited for it to crash after clicking Save. Afterwards, I scrolled to end of the log, working my way up. I also added a filter to only include registry activity and then process and thread activity so I could quickly see where Outlook was crashing: Read the rest of this entry »
Posted in Office, Troubleshooting | Tagged: Crash, Outlook, Process Monitor | Leave a Comment »
The Case of the Missing Visio Menu Bar
Posted by William Diaz on March 1, 2012
When opening Visio, the user didn’t see the common Menu Bar one normally see in Microsoft Office products before 2007. The menu bar contains the literal menu options like File, Edit, View, Insert, so on. There was also the presence of a 3rd party toolbar that didn’t look like it was properly functioning:
Perhaps the Menu bar was disabled. This can be checked by right-clicking in the menu bar area and selecting Customize, then Toolbars.
Read the rest of this entry »
Posted in Office, Troubleshooting, Troubleshooting Tools | Tagged: Process Monitor | 1 Comment »
The Case of the IE Web Page Redirects
Posted by William Diaz on February 28, 2012
One of our techs reported that when trying to go to the home page of a specific website in IE 7-8, they were instead being routed to a slightly different URL. She did some minor troubleshooting by trying the same site from another workstation with no problems. We also tried the same URL and were not able to recreate the problem. We took a few different approaches and after an hour we gave up.
Still curious, I connected after hours to the workstation exhibiting the problem. I started by logging on as a local admin account, which would ensure that domain account policies would not interfere and could be eliminated as a cause, and I was able to reproduce the problem. This was telling because it meant that we were likely dealing with an issue that was workstation specific, not user, otherwise when the tech logged into the other workstation when she tested earlier, her roaming profile would have included the user specific settings, i.e. the suspect setting was not residing in HKCU but instead likely present in HKLM. Earlier tests also further isolated the issue specifically to IE since other browsers were not being redirected.
The breakthrough came when I decided to stop ignoring the site content. The site in question was wageworks.com. Here is the site you should be directed to when you type this into your browser:
Posted in Troubleshooting | Tagged: Internet Explorer | 1 Comment »
Dealing With An Un-Killable Process
Posted by William Diaz on February 9, 2012
The other day while trying to remove some add-ons from Internet Explorer, Windows DEP was kicking in and closing the IE Setting control panel box (rundll32.exe process) for whatever reason:
Or at least it was trying to. Read the rest of this entry »
Posted in Troubleshooting, Troubleshooting Tools | Tagged: Crash, Dr Watson, Hang | Leave a Comment »
Getting the 32 Bit Stacks in a 64 Bit Dump
Posted by William Diaz on February 8, 2012
After loading up Word today, I noticed it would become hung each time I went to the Insert tab. I was able to reproduce the behavior after killing the process and starting it up again. To troubleshoot, I started by going to the Windows 7 Task Manager, right-clicking, and selecting Create Dump File from the context menu:
Read the rest of this entry »
Posted in Troubleshooting, Troubleshooting Tools | Tagged: Dump, Hang, WinDbg, Word | 1 Comment »
Where’s My Email Attachment?
Posted by William Diaz on February 7, 2012
One of my co-workers forwarded me an email from a user that should have contained an attachment, specifically a PDF. However, the attachment and the even the paperclip icon in Outlook was missing. Surely, then, the message didn’t contain the attachment, right?. Actually, it did. I could see by the size of the message there should be something else to the message:
Besides a few lines of formatted text and a couple hyperlinks, there was nothing else to indicate that the message body was causing the message to appear this large, and looking under the hood, I didn’t see any odd html tags like I had seen in an earlier post. If you’re in doubt, you can also look at the Internet Headers of the message to see if contains attachment. Attachments are indicated by the presence of “winmail.dat” in the Content-Type field:
Read the rest of this entry »
Posted in Troubleshooting | Tagged: Outlook | Leave a Comment »
When A GUI Goes Missing (and Worse, It Has No Presence in the Taskbar)
Posted by William Diaz on February 3, 2012
…you might find yourself scratching your head as to why some application seems to not be responding. Normally, when a GUI or an application opens off the screen and cannot be seen, you can just right-click (Shift + Right-Click in Windows 7) the task in the Taskbar and Select Move and drag it back into focus. This area off the screen can be thought of as the virtual desktop area. But what if the GUI does not have a presence in the Taskbar?
For example, we have an in-house developed GUI that connects Word, Excel, and PowerPoint to our document management system for opening or saving documents to it. Unfortunately, the GUI doesn’t have a presence in the Windows Taskbar. Because of this, every once-in-a-while when someone opens the GUI via Save or Open, it fails to appear and the application that it was opened from acts as if it has become unresponsive. Looking in the Task Manager, though, reveals the application is, in fact, running:
Read the rest of this entry »
Posted in Inside Windows, Troubleshooting | 1 Comment »
The Case of the Failed Chkdsk
Posted by William Diaz on February 1, 2012
After logon, a user was being notified by Windows that the master file table was bad. The error presented was: “The file or directory C:\$Mft is corrupt and unreadable. Please run the Chkdsk utility.”
Read the rest of this entry »
Posted in Troubleshooting | Leave a Comment »
Manually Defeating Win 7 2012 “Scareware”
Posted by William Diaz on January 17, 2012
Leave it to the kids to finally infect my Windows 7 home system. This wasn’t a big deal; this system has since been hijacked by them to serve their Internet gaming addiction, and I had since moved my workload to my laptop. Anyway, I look forward to getting the occasional malware infection, it gives me a chance to explorer different methods for removing them. In this case, I was hit by what is known as Win 7 Security 2012. This may also go by the name of XP Home Security 2012, Vista Security 2012, or Windows XP Internet Security 2012 (and then some). It is part of the Braviax suite, a (somewhat non-malicious) form of “scareware” that attempts to convince you that your system has several malware infections. At the time it hit me, there was no definition for it so it creped past the Microsoft Security Essentials.
Here are some screenshots of some of the windows it presents the infected user with (click to enlarge):
Posted in Troubleshooting | Tagged: Malware | Leave a Comment »
Windows Explored 