helping you stay protected in the digital age

As I posted last year, I’m running Lojack for Laptops on my Dell Inspiron 1525. I’ve been pleased with its performance until recently. For the past three weeks I’ve been troubleshooting a connectivity problem that has plagued the LoJack reporting program. With the help, or lack thereof, of LoJack Tier I tech support (yes, I know how to restart my computer, thank you) I eventually was able to speak with two Tier II support techs that did provide guidance and suggestions. Though I solved the problem on my own, I do appreciate their efforts.

Well the problem came when I upgraded Stardock’s WindowsBlinds GUI skinning program to version 6.4. Apparently version 6.4 and beta version 7.x don’t play nice with LoJack’s reporting program. In order to understand the problem you first have to understand a little about LoJack’s reporting software.

When the end-user (most likey you) install’s LoJack using the installer, certain files are dropped into the System32 and default user’s directories (granted you’re running Windows XP, I’d assume Vista 32bit is similar). You’ll notice a few of these files listed below:
C:\Documents and Settings\<local user>\ctmweb.exe
C:\Documents and Settings\<local user>\ctmweb.xls
C:\Documents and Settings\<local user>\javahelper.exe
C:\Documents and Settings\<local user>\ntagent.exe
C:\Windows\system32\ctmweb.exe
C:\Windows\system32\ctmweb.xls
C:\Windows\system32\ntagent.web
C:\Windows\system32\testoc.ocx
C:\Windows\system32\rpcnet.exe

When you install LoJack, the “rpcnet.exe” program begins running in the background on the client machine. Rpcnet.exe is the reporting program that contacts LoJack’s monitoring service every 24.5 hours to report the client computer’s location.

If you visit the LoJack page and initiate a test call, “ctmweb.exe” is started. Ctmweb.exe runs as a local server on the client machine (I believe as port 9871). Ctmweb.exe is used to test the LoJack reporting function.

WindowsBlinds skins the Windows GUI and programs to user definable themes. For some odd reason, WindowsBlinds attempts to change the appearance of rpcnet.exe (which has no GUI) and ctmweb.exe (which has a GUI but only runs for a few seconds during a test call). Both executables will fail if WindowsBlinds is running without an exception. When I would run a test call, the LoJack test page would display “TestCallPasswordNotMatched” and give me an error message stating that the subscription to which I was subscribed for this particular computer did not match the subscription for which I was running the test call… absolutely nothing to do with the executable crashing.

For whatever reason, rpcnet.exe and/or ctmweb.exe didn’t crash, wblind.dll crashes with svchost. This is what puzzled me for weeks as I kept thinking WindowsBlinds was crashing and never thought that LoJack and WindowsBlinds were conflicting. Not only did wblind.dll crash during test calls, as soon as I booted into the Windows GUI wblind.dll would crash and with no mention of LoJack. The “technical data” section didn’t mention anything LoJack related either.

At some point I disabled WindowsBlinds and booted into Windows. wblind.dll didn’t crash and rpcnet.exe was running without issues. I was able to successfully complete a test call into LoJack’s monitoring center with no problems as well. Realizing that WindowsBlinds could be causing the problem, I added two exceptions in the WindowsBlinds program to prevent any skinning of the rpcnet.exe and ctmweb.exe executables.

Once I added rpcnet.exe and ctmweb.exe to the WindowsBlinds exception list, both programs began reporting the machine’s presence to the monitor center and I was able to sucessfully complete test calls.

I should also mention, Tier I techs kept telling me that my hardware firewall at my house and my ZoneAlarm Pro software firewall running on my laptop were the culprits behind the program’s failures. It should be noted that neither the hardware firewall or software firewall were preventing the programs from accessing the monitoring servers even with no exception in either firewall, both programs are able to access the Internet without issue.

~ by johndball on July 21, 2009.