Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Losing cut copy & paste functionality in XP Pro


  • Please log in to reply
8 replies to this topic

#1 mybuddyeric

mybuddyeric

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia
  • Local time:12:05 AM

Posted 15 January 2010 - 03:45 PM

Hello:

I've been racking my brain for the past few weeks over an issue one of my users has. She will (seemingly at random) lose all cut, copy and paste functionality on her laptop. Here's what I've done so far:

* Checked other programs - she definitely cannot cut or paste anything in ANY program (notepad, IE, etc).
* There are no viral infections on her machine (Symantec Anti-Virus).
* Opened her Clipboard viewer and received a message that the Clipbook service wasn't started, hence no Clipboard support.
* Checked her services console; no abnormalities but I did set ClipBook to automatically start (no change).
* Re-installed her Office 2k3 software (laughable, I know)
* Repaired Windows SP3 via installation disk (no change there either).

I know I'm missing something here; I tend to overlook the obvious. Any help would be greatly appreciated guys. Thank you!

Edited by mybuddyeric, 15 January 2010 - 04:07 PM.

fueled by coffee™

BC AdBot (Login to Remove)

 


#2 thisnameissoclever

thisnameissoclever

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:10:05 PM

Posted 15 January 2010 - 05:12 PM

check eventvwr for any "failed to start service" or permissions issues? would be error code.... 70xx? (7000/7013?)
error codes from memory, may be wrong.

If the music is loud enough, we won't hear the world falling apart.


#3 mybuddyeric

mybuddyeric
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia
  • Local time:12:05 AM

Posted 15 January 2010 - 05:18 PM

I can tell you now that there is a ton of "failed to start service" event logs, but I do not know how to decipher. What would I be looking for to give me a clue where to look?

p.s. Is this an indication of a corrupt profile?

Edited by mybuddyeric, 15 January 2010 - 05:20 PM.

fueled by coffee™

#4 thisnameissoclever

thisnameissoclever

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:10:05 PM

Posted 15 January 2010 - 06:32 PM

corrupt? probably not. Some kind of permissions issue. I've hit a brick wall with it 3 times. I could dig into gpedit and see if I can find the problem, maybe check windows updates, check for threats, but I personally haven't devoted the time to this issue yet (which, by the way, I've seen 3 times between today and yesterday)

If the music is loud enough, we won't hear the world falling apart.


#5 mybuddyeric

mybuddyeric
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia
  • Local time:12:05 AM

Posted 15 January 2010 - 07:57 PM

Losing access to a service like Clipboard reminds me of an article I read not so long ago. It mentioned token kidnapping and how the theory is that a malicious process/thread can impersonate a service with higher-than-normal privileges. Basically after authentication, a thread can impersonate a client using the "SeImpersonatePrivilege" call and it will also have a 'token' so to speak (information regarding the security context of a process/thread).

If I haven't lost you yet, could exploring this possibility be productive? Or is something else at stake here?
fueled by coffee™

#6 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,706 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:07:05 AM

Posted 15 January 2010 - 09:07 PM

You may try this:

We are going to set this service to its default to start automatically.
Go to Start => Run, copy and paste the following and click OK:

sc config RpcSs start= auto

Reboot the computer and see if the issue still remains.

#7 mybuddyeric

mybuddyeric
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia
  • Local time:12:05 AM

Posted 15 January 2010 - 09:26 PM

Thank you farbar. Am I running this from within cmd or just the 'Run' dialog box itself?
I will try this and post back on Tuesday - the user is gone until then.
Thanks again!
fueled by coffee™

#8 Farbar

Farbar

    Just Curious


  • Security Developer
  • 21,706 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Netherlands
  • Local time:07:05 AM

Posted 15 January 2010 - 09:44 PM

Both will do. I proposed to run it from the run box, but remembering the user can't copy and paste it is better to type it into the command prompt to make sure it is applied exactly as it is otherwise it will not work. So when you run the command from the command prompt you see the result. If the command is typed correctly after pressing Enter it will return:

[SC] ChangeServiceConfig SUCCESS

Don't forget to reboot.

Good luck mybuddyeric!

#9 mybuddyeric

mybuddyeric
  • Topic Starter

  • Members
  • 51 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia
  • Local time:12:05 AM

Posted 15 January 2010 - 09:46 PM

Thanks farbar!

I just got security to unlock her office and I'm going to do it now, because I am anxious to resolve this. =)
I tested the command on my computer first and I understand what's entailed now.

Wish me luck!! =D
fueled by coffee™




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users