Unexplained code is running!

[Tom Ellison]

Dear John:

I hear what you're saying. The client's language is not English, and their
character set is not the Latin set. That may be a factor here.

The result is not consistent with corruption. It is highly consistent with
a deliberate (and apparently successful) attempt to exclude others from
being able to run the application without some form of permission from those
that created it. The fact is that their company name appears in the caption
and in the text of the text box that appears. This company name is not
found in a search of all the VBA code in the application! But there it is
on my screen.

I believe it appears not as a Message Box, but as a "hijacked" error
message. I say that because the imported version omits their company name,
but displays the exact error message. I have more and more ideas on how to
attack this, but haven't a handle on it yet.

Can you import this text and see how it runs? This is the "imported"
version, without their company name. I'm not currently permitted to divulge
anything "secret" about the app.

I'm guessing that there has been an edit of the text version of the form
that causes this from to error. They have captured that somehow, cancelling
the error if some "permissive" situation is detected, and putting their name
into the error message otherwise. Still quite mysterious.

I believe that if I rebuild the form (just 6 controls) I may be able to get
around this. There are some complexities in replicating all the properties
of those objects, but it should be a modest project. If so, I'm clear to
proceed with this project from that point. I'm already proceeding with
that, along with other aspects. But the mystery remains.

Thanks for your interest and all your suggestions.

Tom Ellison

I don't pretend to know what all this means, though most of it looks
vaguely familiar. But I'd be suspicious of any objects with properties
like these:

Caption ="17/10/2005 4:57:50 µµ 17/10/2005 4:57:55 µµ"

Name ="?ept?µ??e?a"

Could they indicate corruption somewhere?

But the next thing I'd try is to create a new empty database and use
Application.LoadFromText (not LoadAsText, as I said in my first message)
to import the form, and see if it still behaves strangely.

Doing this should also leave behind any hidden stuff you may not have
spotted.

Version =20
VersionRequired =20
Checksum =-1545696752
Begin Form
AutoResize = NotDefault
RecordSelectors = NotDefault
AutoCenter = NotDefault
NavigationButtons = NotDefault
DividingLines = NotDefault
AllowDesignChanges = NotDefault
DefaultView =0
ScrollBars =0
ViewsAllowed =1
TabularCharSet =161
TabularFamily =255
PictureAlignment =2
DatasheetGridlinesBehavior =3
GridY =10
Width =11479
DatasheetFontHeight =10
ItemSuffix =17
Left =5655
Top =3105
Right =13050
Bottom =6675
DatasheetGridlinesColor =12632256
RecSrcDt = Begin
0x77f3549fafbce240
End
GUID = Begin
0xa2e60b098033d34a851c5e2bf67f0336
End
NameMap = Begin
0x0acc0e55
End
Caption ="17/10/2005 4:57:50 µµ 17/10/2005 4:57:55 µµ"
DatasheetFontName ="Arial"
OnActivate ="[Event Procedure]"
Begin
Begin Label
BackStyle =0
TextFontCharSet =161
FontName ="Tahoma"
End
Begin CommandButton
TextFontCharSet =161
Width =1701
Height =283
FontSize =8
FontWeight =400
ForeColor =-2147483630
FontName ="Tahoma"
End
Begin TextBox
FELineBreak = NotDefault
SpecialEffect =2
OldBorderStyle =0
TextFontCharSet =161
Width =1701
LabelX =-1701
FontName ="Tahoma"
AsianLineBreak =255
End
Begin ListBox
SpecialEffect =2
TextFontCharSet =161
Width =1701
Height =1417
LabelX =-1701
FontName ="Tahoma"
End
Begin Subform
SpecialEffect =2
Width =1701
Height =1701
End
Begin Section
CanGrow = NotDefault
Height =6236
BackColor =10079487
Name ="?ept?µ??e?a"
GUID = Begin
0xeb07f3597002594684c8e46c16388915
End
End
End
End
CodeBehindForm
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = True
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Option Compare Database

Private Sub Form_Activate()

End Sub

Do you see anything odd in that. I'm not accustomed to studying this
myself.

Tom Ellison

Dear John:

OK, maybe I'm not doing what you said.

Files/Export then Save as type: Text files. Click Export and that's
it, right?

I don't think that's what John had in mind. In the Immediate window,
enter

Application.SaveAsText acForm, "TheFormName",
"C:\Temp\TheFormName.txt"

Don't expect to see an intellisense item for SaveAsText when you type
the "dot", because you won't -- this is an undocumented method.

Could there be some other executable module that is made part of the
install, loaded with Access, that is watching the windows?

--
Dirk Goldgar, MS Access MVP
www.datagnostics.com

(please reply to the newsgroup)

 

[Tom Ellison]

Dear John:

Another indication of this is that I have received 2 copies of the front end
that have the same behavior. Both of these run on the client's computer
without the symptoms I see. I'm thinking that his computer has "permission"
to run the application, and I do not. I think it is a copy protection
scheme of some sort. Expecially as it give the name of the company that
created the software in the message box. Rather clever, I think.

Tom Ellison

I don't pretend to know what all this means, though most of it looks
vaguely familiar. But I'd be suspicious of any objects with properties
like these:

Caption ="17/10/2005 4:57:50 µµ 17/10/2005 4:57:55 µµ"

Name ="?ept?µ??e?a"

Could they indicate corruption somewhere?

But the next thing I'd try is to create a new empty database and use
Application.LoadFromText (not LoadAsText, as I said in my first message)
to import the form, and see if it still behaves strangely.

Doing this should also leave behind any hidden stuff you may not have
spotted.

Version =20
VersionRequired =20
Checksum =-1545696752
Begin Form
AutoResize = NotDefault
RecordSelectors = NotDefault
AutoCenter = NotDefault
NavigationButtons = NotDefault
DividingLines = NotDefault
AllowDesignChanges = NotDefault
DefaultView =0
ScrollBars =0
ViewsAllowed =1
TabularCharSet =161
TabularFamily =255
PictureAlignment =2
DatasheetGridlinesBehavior =3
GridY =10
Width =11479
DatasheetFontHeight =10
ItemSuffix =17
Left =5655
Top =3105
Right =13050
Bottom =6675
DatasheetGridlinesColor =12632256
RecSrcDt = Begin
0x77f3549fafbce240
End
GUID = Begin
0xa2e60b098033d34a851c5e2bf67f0336
End
NameMap = Begin
0x0acc0e55
End
Caption ="17/10/2005 4:57:50 µµ 17/10/2005 4:57:55 µµ"
DatasheetFontName ="Arial"
OnActivate ="[Event Procedure]"
Begin
Begin Label
BackStyle =0
TextFontCharSet =161
FontName ="Tahoma"
End
Begin CommandButton
TextFontCharSet =161
Width =1701
Height =283
FontSize =8
FontWeight =400
ForeColor =-2147483630
FontName ="Tahoma"
End
Begin TextBox
FELineBreak = NotDefault
SpecialEffect =2
OldBorderStyle =0
TextFontCharSet =161
Width =1701
LabelX =-1701
FontName ="Tahoma"
AsianLineBreak =255
End
Begin ListBox
SpecialEffect =2
TextFontCharSet =161
Width =1701
Height =1417
LabelX =-1701
FontName ="Tahoma"
End
Begin Subform
SpecialEffect =2
Width =1701
Height =1701
End
Begin Section
CanGrow = NotDefault
Height =6236
BackColor =10079487
Name ="?ept?µ??e?a"
GUID = Begin
0xeb07f3597002594684c8e46c16388915
End
End
End
End
CodeBehindForm
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = True
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Option Compare Database

Private Sub Form_Activate()

End Sub

Do you see anything odd in that. I'm not accustomed to studying this
myself.

Tom Ellison

Dear John:

OK, maybe I'm not doing what you said.

Files/Export then Save as type: Text files. Click Export and that's
it, right?

I don't think that's what John had in mind. In the Immediate window,
enter

Application.SaveAsText acForm, "TheFormName",
"C:\Temp\TheFormName.txt"

Don't expect to see an intellisense item for SaveAsText when you type
the "dot", because you won't -- this is an undocumented method.

Could there be some other executable module that is made part of the
install, loaded with Access, that is watching the windows?

--
Dirk Goldgar, MS Access MVP
www.datagnostics.com

(please reply to the newsgroup)

 

[John Nurick]

Hi Tom,

I copied the text from your post, pasted it into a text editor, saved,
and tried to LoadAsText into a new Access 2003 database. Result:

Run-time error '2285': Microsoft Office Access can't create the output
file.

Clearly it's a nonsensical message. I get the same error if I SaveAsText
a form from one of my own databases, modify the text file, and try to
LoadFromText the result: so maybe it's a checksum error. What happened
when you tried?

Dear John:

I hear what you're saying. The client's language is not English, and their
character set is not the Latin set. That may be a factor here.

The result is not consistent with corruption. It is highly consistent with
a deliberate (and apparently successful) attempt to exclude others from
being able to run the application without some form of permission from those
that created it. The fact is that their company name appears in the caption
and in the text of the text box that appears. This company name is not
found in a search of all the VBA code in the application! But there it is
on my screen.

I believe it appears not as a Message Box, but as a "hijacked" error
message. I say that because the imported version omits their company name,
but displays the exact error message. I have more and more ideas on how to
attack this, but haven't a handle on it yet.

Can you import this text and see how it runs? This is the "imported"
version, without their company name. I'm not currently permitted to divulge
anything "secret" about the app.

I'm guessing that there has been an edit of the text version of the form
that causes this from to error. They have captured that somehow, cancelling
the error if some "permissive" situation is detected, and putting their name
into the error message otherwise. Still quite mysterious.

I believe that if I rebuild the form (just 6 controls) I may be able to get
around this. There are some complexities in replicating all the properties
of those objects, but it should be a modest project. If so, I'm clear to
proceed with this project from that point. I'm already proceeding with
that, along with other aspects. But the mystery remains.

Thanks for your interest and all your suggestions.

Tom Ellison

I don't pretend to know what all this means, though most of it looks
vaguely familiar. But I'd be suspicious of any objects with properties
like these:

Caption ="17/10/2005 4:57:50 µµ 17/10/2005 4:57:55 µµ"

Name ="?ept?µ??e?a"

Could they indicate corruption somewhere?

But the next thing I'd try is to create a new empty database and use
Application.LoadFromText (not LoadAsText, as I said in my first message)
to import the form, and see if it still behaves strangely.

Doing this should also leave behind any hidden stuff you may not have
spotted.

Version =20
VersionRequired =20
Checksum =-1545696752
Begin Form
AutoResize = NotDefault
RecordSelectors = NotDefault
AutoCenter = NotDefault
NavigationButtons = NotDefault
DividingLines = NotDefault
AllowDesignChanges = NotDefault
DefaultView =0
ScrollBars =0
ViewsAllowed =1
TabularCharSet =161
TabularFamily =255
PictureAlignment =2
DatasheetGridlinesBehavior =3
GridY =10
Width =11479
DatasheetFontHeight =10
ItemSuffix =17
Left =5655
Top =3105
Right =13050
Bottom =6675
DatasheetGridlinesColor =12632256
RecSrcDt = Begin
0x77f3549fafbce240
End
GUID = Begin
0xa2e60b098033d34a851c5e2bf67f0336
End
NameMap = Begin
0x0acc0e55
End
Caption ="17/10/2005 4:57:50 µµ 17/10/2005 4:57:55 µµ"
DatasheetFontName ="Arial"
OnActivate ="[Event Procedure]"
Begin
Begin Label
BackStyle =0
TextFontCharSet =161
FontName ="Tahoma"
End
Begin CommandButton
TextFontCharSet =161
Width =1701
Height =283
FontSize =8
FontWeight =400
ForeColor =-2147483630
FontName ="Tahoma"
End
Begin TextBox
FELineBreak = NotDefault
SpecialEffect =2
OldBorderStyle =0
TextFontCharSet =161
Width =1701
LabelX =-1701
FontName ="Tahoma"
AsianLineBreak =255
End
Begin ListBox
SpecialEffect =2
TextFontCharSet =161
Width =1701
Height =1417
LabelX =-1701
FontName ="Tahoma"
End
Begin Subform
SpecialEffect =2
Width =1701
Height =1701
End
Begin Section
CanGrow = NotDefault
Height =6236
BackColor =10079487
Name ="?ept?µ??e?a"
GUID = Begin
0xeb07f3597002594684c8e46c16388915
End
End
End
End
CodeBehindForm
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = True
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Option Compare Database

Private Sub Form_Activate()

End Sub

Do you see anything odd in that. I'm not accustomed to studying this
myself.

Tom Ellison


Dear John:

OK, maybe I'm not doing what you said.

Files/Export then Save as type: Text files. Click Export and that's
it, right?

I don't think that's what John had in mind. In the Immediate window,
enter

Application.SaveAsText acForm, "TheFormName",
"C:\Temp\TheFormName.txt"

Don't expect to see an intellisense item for SaveAsText when you type
the "dot", because you won't -- this is an undocumented method.

Could there be some other executable module that is made part of the
install, loaded with Access, that is watching the windows?

--
Dirk Goldgar, MS Access MVP
www.datagnostics.com

(please reply to the newsgroup)

 

[Tom Ellison]

Dear John:

Thanks, very much, for doing some of my legwork.

As a result of what you found, combined with much of what I've found, I
think there is something special going on here. "Can't create the output
file" on a text output? So, the form is impossible? It exists, but it's
impossible?

I hadn't done this test, though I wanted to. Don't think I'll bother now.
Your report is sufficient for me. This is a mess for me! I need to produce
a finished product, and soon. Other problems will occupy me for a while
now. I've go to find another newsgroup to post a problem I believe is
unrelated. I haven't posted questions in years, but today is my day for it!

Tom Ellison

Hi Tom,

I copied the text from your post, pasted it into a text editor, saved,
and tried to LoadAsText into a new Access 2003 database. Result:

Run-time error '2285': Microsoft Office Access can't create the output
file.

Clearly it's a nonsensical message. I get the same error if I SaveAsText
a form from one of my own databases, modify the text file, and try to
LoadFromText the result: so maybe it's a checksum error. What happened
when you tried?

Dear John:

I hear what you're saying. The client's language is not English, and
their
character set is not the Latin set. That may be a factor here.

The result is not consistent with corruption. It is highly consistent
with
a deliberate (and apparently successful) attempt to exclude others from
being able to run the application without some form of permission from
those
that created it. The fact is that their company name appears in the
caption
and in the text of the text box that appears. This company name is not
found in a search of all the VBA code in the application! But there it is
on my screen.

I believe it appears not as a Message Box, but as a "hijacked" error
message. I say that because the imported version omits their company
name,
but displays the exact error message. I have more and more ideas on how
to
attack this, but haven't a handle on it yet.

Can you import this text and see how it runs? This is the "imported"
version, without their company name. I'm not currently permitted to
divulge
anything "secret" about the app.

I'm guessing that there has been an edit of the text version of the form
that causes this from to error. They have captured that somehow,
cancelling
the error if some "permissive" situation is detected, and putting their
name
into the error message otherwise. Still quite mysterious.

I believe that if I rebuild the form (just 6 controls) I may be able to
get
around this. There are some complexities in replicating all the
properties
of those objects, but it should be a modest project. If so, I'm clear to
proceed with this project from that point. I'm already proceeding with
that, along with other aspects. But the mystery remains.

Thanks for your interest and all your suggestions.

Tom Ellison

I don't pretend to know what all this means, though most of it looks
vaguely familiar. But I'd be suspicious of any objects with properties
like these:

Caption ="17/10/2005 4:57:50 µµ 17/10/2005 4:57:55 µµ"

Name ="?ept?µ??e?a"

Could they indicate corruption somewhere?

But the next thing I'd try is to create a new empty database and use
Application.LoadFromText (not LoadAsText, as I said in my first message)
to import the form, and see if it still behaves strangely.

Doing this should also leave behind any hidden stuff you may not have
spotted.


Version =20
VersionRequired =20
Checksum =-1545696752
Begin Form
AutoResize = NotDefault
RecordSelectors = NotDefault
AutoCenter = NotDefault
NavigationButtons = NotDefault
DividingLines = NotDefault
AllowDesignChanges = NotDefault
DefaultView =0
ScrollBars =0
ViewsAllowed =1
TabularCharSet =161
TabularFamily =255
PictureAlignment =2
DatasheetGridlinesBehavior =3
GridY =10
Width =11479
DatasheetFontHeight =10
ItemSuffix =17
Left =5655
Top =3105
Right =13050
Bottom =6675
DatasheetGridlinesColor =12632256
RecSrcDt = Begin
0x77f3549fafbce240
End
GUID = Begin
0xa2e60b098033d34a851c5e2bf67f0336
End
NameMap = Begin
0x0acc0e55
End
Caption ="17/10/2005 4:57:50 µµ 17/10/2005 4:57:55 µµ"
DatasheetFontName ="Arial"
OnActivate ="[Event Procedure]"
Begin
Begin Label
BackStyle =0
TextFontCharSet =161
FontName ="Tahoma"
End
Begin CommandButton
TextFontCharSet =161
Width =1701
Height =283
FontSize =8
FontWeight =400
ForeColor =-2147483630
FontName ="Tahoma"
End
Begin TextBox
FELineBreak = NotDefault
SpecialEffect =2
OldBorderStyle =0
TextFontCharSet =161
Width =1701
LabelX =-1701
FontName ="Tahoma"
AsianLineBreak =255
End
Begin ListBox
SpecialEffect =2
TextFontCharSet =161
Width =1701
Height =1417
LabelX =-1701
FontName ="Tahoma"
End
Begin Subform
SpecialEffect =2
Width =1701
Height =1701
End
Begin Section
CanGrow = NotDefault
Height =6236
BackColor =10079487
Name ="?ept?µ??e?a"
GUID = Begin
0xeb07f3597002594684c8e46c16388915
End
End
End
End
CodeBehindForm
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = True
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Option Compare Database

Private Sub Form_Activate()

End Sub

Do you see anything odd in that. I'm not accustomed to studying this
myself.

Tom Ellison


Dear John:

OK, maybe I'm not doing what you said.

Files/Export then Save as type: Text files. Click Export and that's
it, right?

I don't think that's what John had in mind. In the Immediate window,
enter

Application.SaveAsText acForm, "TheFormName",
"C:\Temp\TheFormName.txt"

Don't expect to see an intellisense item for SaveAsText when you type
the "dot", because you won't -- this is an undocumented method.

Could there be some other executable module that is made part of the
install, loaded with Access, that is watching the windows?

--
Dirk Goldgar, MS Access MVP
www.datagnostics.com

(please reply to the newsgroup)