Thursday 12 February 2015

Windows Black Screen of Death when you login on Administrator only account - no windows explorer shell visible until you kill the task and reopen in

A system was recently brought to me which had been badly infected with malware and other nasties. After much scanning and cleaning, the system was back in a usable state with one massive quirk:

Whenever an administrator logged onto the system the explorer shell wouldn't seem to launch - i'd just get a plain black screen. This was the case for all admin users, new or old.

On further investigation, there was an app running called "runonce", and when this was killed from the task manager the system booted correctly.

By checking the registry I found a left over key from all my cleaning work (HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce) which was launching a piece of software to take control of Chrome.

With this key removed, all of the admin profiles starting logging in correctly again

So I hope that helps someone; had I checked the key in the first place I wouldn't have experienced this problem the first place.

PS.
Massive shout out to Malware Bytes Anti-Rootkit (https://www.malwarebytes.org/antirootkit/) - best root kit removal software I've used to date and it's only beta.

Tuesday 10 February 2015

Virgin Media Superhub and VPNs

Following a migration to an upgraded speed package on a Virgin fibre connection a hardware VPN stopped working properly. The connection would connect, but only remain up for 40 seconds and during this time very little data would transfer across it properly

On further inspection, even though we had public IPs hitting the equipment behind the superhub, the superhub itself was still interfering with data. 

To resolve this issue, you need to turn off the super-hub firewall (only recommended if you have another firewall behind it like we do) and then also go to the security settings and enable the VPN pass-through options.

Once this was done, the data was free to move correctly and the VPN no longer disconnected.

Usually this sort if thing gets checked, but if I have a public IP assigned to equipment behind the superhub I wouldn't expect it to ever play with the data its passing through.


We live and learn.


-- Update --

The above seem was originally written for a Super Hub 1 but since writing this I've also had to use it to resolve issues with software VPNs and Superhub 2s. The below steps to sort this on a SH2 are:

  1. Log into the Superhub (default IP is 192.168.0.1)
  2. Enter your username and password (this is generally on the bottom of the router)
  3. Go to Advanced Settings (at the bottom of the page).
  4. Go to (Security) "Firewall".
  5. Uncheck all boxes except "PPTP Pass-Through" – if PPTP Pass through is not checked, please check it.
  6. Click Apply