Ask & Record Toolbar deletes boot.ini

[cb56]

I've installed Ask & Record Toolbar on XP sp3.

When system boot it delete:

boot.ini
AUTOEXEC.BAT
CONFIG.SYS
all folders that start with "@" in its name in the boot drive "C".

After removing Ask & Record Toolbar then problem has been fixed!

I'm sure of what i write.

Please, any answer?

cb56

[Tasha Heinlein]

It is not possible that the toolbar is responsible for this.

[cb56]

It is not possible that the toolbar is responsible for this.

May be...but I'm not sure...

I have installed the tollbar and go to bed; next morning i've found 30GB of mp3 deleted on my hd and boot.ini disappeared.

I have create by myself boot.ini and reboot tree times, the boot.ini was deleted tree times (autoexec.bat and config.sys too).

After I have the toolbar disinstalled the problem was immediatly resolved.

I don't know what to think.

My antivirus (McaFee VirusScan Enterprise + AntiSpyware 8.7) is always update.

Bye

[nkkiegem123]

maybe the virus came from other source..and not from the toolbar..and also kindly check your sp3 if its compatible with applian products..http://storeyourpicture.com/images/signature_videoStreaming.jpg

[Tasha Heinlein]

Did you try reinstalling the toolbar to see if it caused this same issue? This would help in pinpointing the cause.

[cb56]

Did you try reinstalling the toolbar to see if it caused this same issue? This would help in pinpointing the cause.

I've reinstalled flvplayer with toolbar that i get from here: http://applian.com/flvplayer/

The file name is: FLVPlayerSetup.exe
The size is: 2,45 MB (2.576.480 bytes)

Now i'm sure: boot.ini, autoexec.bat and config.sys was deleted after a reboot!

I have a folder named "@Temp" in the root of disk C: deleted too.

Disinstalled the toolbar and the problem was fixed.

You can try to make a directory in the root of disk C and name it "@Temp" and see what happen...

Look at your boot.ini too! :-)

Bye

[Tasha Heinlein]

Thank you for the info. I am unable to duplicate this, but we are taking this very seriously and I will let you know what our testing comes up with.

[Clearheart]

I had exactly same experience as member cb56. I'm a computer tech with 22 years experience (think DOS, WordPerfect 4.2 and VisiCalc). The system in question is a new Dell Vostro 420 tower. I post loaded the system for a client with a few minor programs, and he took it away to configure to taste. After a day he called saying he couldn't boot, "Hal.dll" problem. I started the system from the CD and from the recovery console I looked at the drive. Boot.ini was missing, as was Autoexec.bat and Config.sys. I recreated boot.ini using the bootcfg /rebuild command and was able to load Windows normally. When I got there, boot.ini was gone. I put a new copy in the root folder and experimented a bit with a few reboots. As cb56 complained, anything starting with the @ sign in the root was deleted. Also, any file with the strings "boot", "autoexec" or "config" are deleted. Once I removed Ask & Record, Applian FLV and the Ask toolbar, the problem disappeared. Several reboots, some of them cold ones, have confirmed the resolution.

You've got a serious problem here folks that requires prompt action. If there was a recent release of your software, we may be the first wave. Tasha said she couldn't recreate the effect so it may be affected by the other installed software. But those are some serious side effects and I wonder what's really at the root of this. It's hard to imagine code that isn't intentionally malicious by nature having these results. As I mentioned, this is a new Dell, running Norton Internet Security 2009. I ran MalwareBytes Anti-malware, Super AntiSpyware and HiJack This! and I found no indications of any bad players.

You have my email address if you want to contact me directly. I'll check back here in a couple to see what's brewing.

Clearheart

[Tasha Heinlein]

We haven't been able to confirm that the toolbar is the cause of this as nobody on our end has been able to duplicate this. We are still taking this seriously and the folks at Ask have been testing and are still looking into this.

[cb56]

Thanks Clearheart, now I'm not alone! :-)

I'm a computer tech with over 20 years experience too and, as you say, "It's hard to imagine code that isn't intentionally malicious by nature having these results"...

Bye

[aptuscomputers]

I have spent the last three days working on a customers computer that was showing the same symptoms. I had to create a log using Process Monitor to detect the culprit.

The file responsible for all the damage was 'ASKUpgrade.exe' in 'C:\Program Files\AskBarDis\bar\bin' with a size of 230KB. After removing that file and the entire 'AskBarDis' directory structure the problem went away. Of course the damage it caused is not easily repairable.

No malware detection software detected the mechanism of the file deletion. I have retained the suspect files if anyone would like to analyze them.

Matt Boughton
Aptus Computers
http://www.aptuscomputers.com/

[cloche]

I am a bit concerned that nothing has been posted on this since june

[HeatherChandler]

I have experienced the same problem for the past week or so and am happy to say I think that uninstalling the Ask & Record toolbar fixed my problem.

I have a Dell Precision T3400 running Windows XP Professional, and installed the Ask toolbar around two months ago. Things were fine until recently, and I suspect it might have been around the time that I installed Internet Explorer 8 that the trouble began. (I put off installing IE8 and am not certain of the date I finally caved.) Every time my computer started, my boot.ini file was deleted, so I'd get the boot.ini and hal.dll error the next time I restarted. It took me a long time to find a user who mentioned IE8 as the possible cause, but uninstalling IE8 was not enough. Eventually I found another user who suggested that the Ask & Record toolbar in conjunction with IE8 might be the issue, and after uninstalling the toolbar my system is working again.

I did like the Ask & Record toolbar, but it's a glorious thing to be able to reboot the system without having to run bootcfg /rebuild every time I start it up again. For now I'm leaving IE8 uninstalled too, just for good luck :)

[Dillman]

I've reinstalled flvplayer with toolbar that i get from here: http://applian.com/flvplayer/

The file name is: FLVPlayerSetup.exe
The size is: 2,45 MB (2.576.480 bytes)

Now i'm sure: boot.ini, autoexec.bat and config.sys was deleted after a reboot!

I have a folder named "@Temp" in the root of disk C: deleted too.

Disinstalled the toolbar and the problem was fixed.

You can try to make a directory in the root of disk C and name it "@Temp" and see what happen...

Look at your boot.ini too! :-)

Bye

Yes, This is happening here and is easily reproducable. The toolbar updater also damages files located in %appdata%\Application Data\Microsoft\Internet Explorer. The three machines I can duplicate this on are running CA antivirus 2007 which comes with Roadrunner. I can guarantee none of these machines have any virus or spyware and it is the toolbar updater service that causes this. You do not have to uninstall the toolbar to fix this, just disable the ask toolbar update service and nothing else. Search on any search engine for "ask toolbar boot.ini" and you will see many people with the same problem. Note: the problem machines are also running IE 8.

The one and only Dillman

[RETechGuy]

Did you try reinstalling the toolbar to see if it caused this same issue? This would help in pinpointing the cause.

I notice the last post from Applian was two months ago.

[Cheryl Wester]

If you are having an issue with this please contact tech support as Tasha will be able to give you more detailed information regarding this isolated issue.

[huttarl]

I had this problem too, in WinXP SP3. Every time I booted, boot.ini would disappear, so the next time I tried to reboot I couldn't. I had to boot from CD and restore the boot.ini via bootcfg (slow) or by copying from a backup. It took 2.5 days working with the experts (http://www.geekstogo.com/forum/regular-slowdown-malware-t247430.html) at geekstogo.com to find the cause of the problem. As soon as I disabled the ASKUpgrade service, the problem ceased. In my case, I believe the problem may have started when I disabled ASK toolbar's FLVSrvc item on the Startup tab in Msconfig. (But even after I disabled "selective startup", so that FLVSrvc was reenabled, boot.ini continued to disappear on each reboot.)

Once I learned that the ASK toolbar was the cause, I googled "boot.ini ASKUpgrade" and "boot.ini ASK toolbar" and found plenty of corroboration. I'm glad ASK is taking this seriously, but "if you figured out it was us, contact our tech support" is not enough, given that it takes 2.5 days even to figure out that the problem has anything to do with ASK. So then we contact tech support, wait for a response, and for what? The information is already out there on how to fix it: uninstall ASK or at least disable ASKUpgrade service.

You guys seriously need to publish a fix and push it to users, or if you can't come up with a fix, warn users about it so they can make an informed decision whether to uninstall. It's not an isolated problem and it costs users serious downtime. You might end up in court, or at least your reputation will be soured. I know I will not be installing Applian products any more if I can help it.

[huttarl]

If you are having an issue with this please contact tech support as Tasha will be able to give you more detailed information regarding this isolated issue.

For others who may be looking for a resolution to this issue: I contacted Applian's tech support, and Tasha's response was
I will pass this info on to Ask. We have not been able to duplicate this problem or pinpoint it.

So, please go ahead and contact tech support if you've experienced the problem -- it may provide more data and help raise the priority on this issue so that it will get fixed.

[Tasha Heinlein]

Ask tells me that this should have been fixed with the latest version of the toolbar. Can you tell me if you downloaded direct from our our site recently? Thank you.

[huttarl]

Ask tells me that this should have been fixed with the latest version of the toolbar. Can you tell me if you downloaded direct from our our site recently? Thank you.
Good to know that the bug has been acknowledged, if only retroactively. Ironic that the component that should have delivered the fix, AskUpgrade, was the very service that was deleting boot.ini!

I think I downloaded the toolbar in May, as part of the requirement for recording streamed media. I no longer have it installed, so I don't know how to check a version number.

[Tasha Heinlein]

Anyone that is still having this problem - I need to know when you downloaded the toolbar and where you downloaded it from. As I said, this should have been fixed with the latest version so I would like to know if it continues to be an issue. Thank you!

[March Hare]

I never understand why anyone installs tool bars for browsers, they are always a pain in the buttocks. :-)

[huttarl]

I never understand why anyone installs tool bars for browsers, they are always a pain in the buttocks. :-)
That's probably why they come as part of a package with features that users want.

[melanchete]

Why not scan your system with eset's online scanner. It is available at: http://www.eset.com/onlinescan/

[stream-recorder.com]

Why not scan your system with eset's online scanner.
oh, c'mon!

https://www.virustotal.com/analisis/7b5b516e76f45e189e23a0191c7b45ebb4454828cb8acbacdc 8d819379c32a21-1250757972

File ATBSetup.exe received on 2009.08.20 08:46:12 (UTC)
Current status: Finished

Result: 0/41 (0%)

Antivirus Version Last Update Result
a-squared 4.5.0.24 2009.08.20 -
AhnLab-V3 5.0.0.2 2009.08.20 -
AntiVir 7.9.1.3 2009.08.20 -
Antiy-AVL 2.0.3.7 2009.08.20 -
Authentium 5.1.2.4 2009.08.19 -
Avast 4.8.1335.0 2009.08.19 -
AVG 8.5.0.406 2009.08.19 -
BitDefender 7.2 2009.08.20 -
CAT-QuickHeal 10.00 2009.08.19 -
ClamAV 0.94.1 2009.08.20 -
Comodo 2013 2009.08.20 -
DrWeb 5.0.0.12182 2009.08.20 -
eSafe 7.0.17.0 2009.08.19 -
eTrust-Vet 31.6.6688 2009.08.19 -
F-Prot 4.4.4.56 2009.08.19 -
F-Secure 8.0.14470.0 2009.08.20 -
Fortinet 3.120.0.0 2009.08.20 -
GData 19 2009.08.20 -
Ikarus T3.1.1.68.0 2009.08.20 -
Jiangmin 11.0.800 2009.08.20 -
K7AntiVirus 7.10.822 2009.08.19 -
Kaspersky 7.0.0.125 2009.08.20 -
McAfee 5714 2009.08.19 -
McAfee+Artemis 5714 2009.08.19 -
McAfee-GW-Edition 6.8.5 2009.08.20 -
Microsoft 1.4903 2009.08.20 -
NOD32 4349 2009.08.19 -
Norman 2009.08.19 -
nProtect 2009.1.8.0 2009.08.20 -
Panda 10.0.0.14 2009.08.20 -
PCTools 4.4.2.0 2009.08.19 -
Prevx 3.0 2009.08.20 -
Rising 21.43.30.00 2009.08.20 -
Sophos 4.44.0 2009.08.20 -
Sunbelt 3.2.1858.2 2009.08.20 -
Symantec 1.4.4.12 2009.08.20 -
TheHacker 6.3.4.3.383 2009.08.13 -
TrendMicro 8.950.0.1094 2009.08.20 -
VBA32 3.12.10.9 2009.08.20 -
ViRobot 2009.8.20.1892 2009.08.20 -
VirusBuster 4.6.5.0 2009.08.19 -

Additional information
File size: 8801704 bytes
MD5...: 76f0ae4882f5691b2a4c283275d31000
SHA1..: f4896d5d0aab194b24fc83c79e2751c88e74a901
SHA256: 7b5b516e76f45e189e23a0191c7b45ebb4454828cb8acbacdc 8d819379c32a21
ssdeep: 196608:WnN6fmv7b5jz+4jRWJQKlJq4Q7sc2g1uI/oc:WwfmvJjq4jvKlc4c7X9

[lazydog]

:mad: Just spent the best part of two days with this issue until I found the posts here > http://forum.dll-files.com/boot.ini-missing-bootcfg-rebuildftopic-46006-days0-orderasc-15.html

Don't know yet what version of the toolbar was installed on my users machine or where from, however two days ago she did a Windows Update and installed I.E 8 and on reboot got the missing Hal.Dll problem.

Extremely annoying and wasted a huge ammount of time.

Really surprised that a toolbar install can have the rights to delete root system files!

[starship]

My problem with the Ask toolbar caused a network problem with my web browsers. I would type a url like www.google.ca into my browser and it would change to something like jar : program files blah blah I forgot

The same thing happened in Firefox, Internet Explorer and Google Chrome but my Person 2 Person program seemed to work just fine.

After I uninstalled Ask Toolbar and rebooted, everything was normal.

I accidentally installed Ask when I installed Frostwire 4.18.4

I use Windows 7 X64
List of possibly important programs;
Adobe Creative Suite 3
Visual Studio 08
VLC Media Player 1.0.0 rc1
Snagit 9.1.3
DirectX 10 Development March 09
JDownloader 0.8
Mozilla Firefox 3.0.6
Kaspersky Internet Security 10

I use my onboard Ethernet port for internet access and a Network Interface Card for my local area network. Everything ran groovy for awhile and then out of the blue I got hit with these problems but after I tried and failed with a system restore, I looked around the internet on another computer and heard someone mention uninstalling the Ask Toolbar, and so I did.