JRT/notepad clash in Creators Update.

[nukecad]

As part of my usual Sunday maintenance tasks I just ran JRT 8.1.2 for the first time since installing the Windows Creators update last week.
(Win 10 Home, v1703, build 15063.13).

Please note that this is not an insider preview, it is the full RTM version which will be automatically rolled out in a few days.

JRT seemed to run normaly but when it completed the opened report was blank.
Even more notepad itself was not displaying any text at all, even the menu fields and closing dialogue were devoid of text.

After closing the JRT log and re-opening notepad the problem of missing text persisted and I was also unable to type anything into it.

A computer restart did bring notepad back to it normal appearance and functionality.

As double check I deleted JRT from my computer and downloaded a new copy.
Running this gave exactly the same problems with notepad.

As the Creators Upate is set to roll out as an Automatic Update in a few days time (April 11) you may want to take a look at this issue.

Edited April 9, 2017 by nukecad

[thisisu]

Hi,

Thanks for the heads up. We will take a look as soon as possible.

Regards

[nukecad]

This is much more serious that I first thought.

I have just been doing a bit more 'playing about' and it is not just notepad that is having the display corrupted after running JRT.

Every programme that I have tried has a scrambled display and/or no text visible after JRT has been run.

(Sorry I forgot to try a browser window but don't see why they should be any different from the rest).

It seems that somehow JRT is scrambling a display setting when it is run on the Creators Update.

(or at least it does on my PC).

A computer restart/reboot puts things right again.

PS. the JRT run report is being created, it's just not visible until after a computer restart because of the corrupted notepad display.
Once a the computer is reset you can read it again, although it shows no changes. See empty report attached.

JRT.txt

I'm wondering if this may be something to do with the fact that JRT runs from the command prompt?
With the Win 10 Creators Update the command window has been given a backseat and the PowerShell has become the default method of running commands.

Edited April 10, 2017 by nukecad

[nukecad]

I just tried it with a couple of browsers and the resuts were interesting may be of help in troubleshooting the problem.

 

Internet Explorer and Edge were both affected with text etc. missing, but Firefox was not. (I don't have Chrome so couldn't try with that).

Everything in Firefox looked and worked fine, even whan all other programmes/browsers had been affected.

 

Being an Idiot I had the idea of running JRT.exe manually from PowerShell. Brain was not in gear because of course the first thing JRT's internal commands did was open a command prompt to run in.

 

I'll leave it with you to see if you can replicate the issue.

[msherwood]

Hey @nukecad. We're still troubleshooting this one. We'll be in touch soon.

[msherwood]

We've figured this out. We're terminating "fontdrvhost" and that's causing the issues you're seeing.

How to fix: reboot your system.

We're working on an updated build and we'll publish that ASAP. Thanks again for the bug report!

[msherwood]

We've got the build updated and it's with QA now. We're targeting the deployment of this new build within 24 hours.

Again, if you're seeing this issue simply reboot your machine. 

[msherwood]

We just pushed a new version (8.1.3): https://forums.malwarebytes.com/topic/199226-junkware-removal-tool-jrt-813-released/

 

Direct: https://downloads.malwarebytes.com/file/jrt/

@nukecad - let us know how it's working for you!

[nukecad]

That seems to have cured the problem, all the programmes I tried yesterday that got corrupted are now displaying fine after a run of the new JRT version.

 

Strange, that terminating "fontdrvhost" is a problem with the Creators Upate if/when it wasn't previously.

(Presumably beforehand it restarted itself after being terminated?)

MS / Win 10 works in mysterious ways sometimes.

 

Nicely tracked down, and good that it was a relatively simple fix.