Cannot logon after CSS V7 install

Message

dkunkle · #1 Post by **dkunkle** » Sun Jun 11, 2006 4:36 pm

I recently picked up CSS V7 while running Software Installer. I previously had V6 installed. Now I cannot logon except in safe mode.

After the install of V7, the next time I rebooted I got the expected:
+----------
| Please Wait ....
| Checking the status of the embedded security chip.
+----------

Then the UNEXPECTED:
+----------
| Client Security Solution Logon
| There was a problem connecting to a critical service. It is possible that the anti-virus or firewall software is blocking the connection. Please refer to the readme for more details.
|
| OK
+----------

When I click OK on the above, both windows are replaced with the window below

+----------
| Welcome
| (Client Security Solution icon)
| Press Ctrl-Alt-Del to log on.
+----------

Ctrl-Alt-Del results in the above window reappearing. I cannot logon.

So I can boot in safe mode and logon. I have attempted to remove CSS through control panel/add-remove programs, but it fails because windows disallows add-remove in safe mode. I tried to remove CSS with ThinkVantage Software Installer but in safe mode it says “This program is only for IBM/Lenovo” system.”

I’d dearly like to remove or cripple this evil spawn. Any ideas?

Thanks,

David Kunkle
T42-2378-FVU

#2 Post by **GomJabbar** » Sun Jun 11, 2006 7:16 pm

Evil spawn indeed!

The only thing that I can think of is to try Windows System Restore, to restore to an earlier configuration. On the other hand, you always have the restore factory contents option...................................

Tony's X60s · #3 Post by **Tony's X60s** » Sun Jun 11, 2006 7:39 pm

Among all the other fun

I am having with CSS7 since I installed it, this has occurred once to me - a chilling experience. I thought it may have been a hardware fault and booted up in Rescue and Recovery and ran the quick hardware scan in PC Doctor. Lo and behold, when I rebooted, everything was back to normal.

My next step if that had not worked would be something I learned from the IBM help desk - shut down, remove battery and AC power and press the start-up button for 30 seconds. Apparently this resets some residual memory on the motherboard and can clear some lock up conditions.

Good luck.

dkunkle · #4 Post by **dkunkle** » Sun Jun 11, 2006 11:18 pm

No real progress here.

Windows System Restore is out as it is not enabled. Seemed like everytime I did an update, it ate 1G, and besides I'd never seen a problem I could not uninstall my way out of ... until now. Lesson learned.

PC Doctor Quickscan had no effect. Same with the battery removal/30 second power on button pressing.

"Restore Factory Contents"... Is that part of the Blue Button?

I could handle reinstalling windows, but IBM seems not to have given me an install dvd.

Still looking for the right chicken foot to wave over this thing.

DK

#5 Post by **GomJabbar** » Sun Jun 11, 2006 11:39 pm

dkunkle wrote:"Restore Factory Contents"... Is that part of the Blue Button?

I could handle reinstalling windows, but IBM seems not to have given me an install dvd.

Tsk. Tsk. You can make your own! Go to Start > All Programs > Access IBM > Create Recovery Discs. If you have upgraded Rescue and Recovery it may be located instead in Start > All Programs > ThinkVantage > Create Recovery Media > Product Recovery. You can only make the set one time until you restore factory contents, then you are given the option again.

You can burn it all on CD/R's (about 7) or (1) CD and (1) DVD. You would use the CD first. When you boot up with this Product Recovery Disc set you can restore even a new hard drive with all the original factory software, including Windows. No activation and Product key needs to be entered. If you use these, they will erase all existing partitions and data on the hard drive.

You can also use the blue Access IBM button by pressing it at the beginning of the boot sequence to enter the Rescue and Recovery workspace. From here you can also restore factory contents on the C: drive. If the blue Access IBM button doesn't work, you can try booting up from a Rescue Media CD (which you can also make) into the Rescue and Recovery workspace.

Nick Y · #6 Post by **Nick Y** » Mon Jun 12, 2006 1:02 am

GomJabbar wrote:The only thing that I can think of is to try Windows System Restore, to restore to an earlier configuration. On the other hand, you always have the restore factory contents option...................................

From experience, once CSS7 is installed, you cannot go back to an earlier version. (I have tried restoring to pre-CSS7 install, several times) My solution, so far, is to remove the CSS folder from programs/lenovo once I have gone through the Windows uninstall. (Using software installer to uninstall brings up a message saying that software installer must be shut down in order to uninstall CSS7. Brings back memories of starting DOS; Keyboard not connected, please press C)

dkunkle · #7 Post by **dkunkle** » Thu Jun 15, 2006 12:24 pm

After nearly 50 minutes waiting on the phone, I talked to IBM Support and was able to get logged on again. Here is what we went through (as best I recall from my notes).

1) we cleared the security chip..
- power on with the escape key down, also pressing PF1 at the right moment (to enter setup).
- once in setup, navigate to the security chip bit. In there, there should be an option to reset the chip. I'm not sure if it was always there. I suspect it was enabled by the escape key at power on.
- We saved the settings and did a normal boot.
- the problem remained (as described earlier)

2) We neutered CSS (I believe)
- go back into the bios and now disable the security chip.
- boot (pressing PF8) and then select Last Known Good
- Eventually I received the "welcome to windows" window and was able to logon
- I also received:
"cssauth.exe - Unable to Locate Component"
This application has failed to start because tvt_banner.dll was not found. Re-installing the application may fix this problem.
- I was assured that this is 'normal' for the state we are in.
- He then said that I should 1) uninstall css7, 2) enable the security chip, 3) reinstall c77.

I have not done the uninstall/etc. nor rebooted since all this. I will be hibernating for a while before the dramatic event.

Thanks to all who responded and offered help.

DK

davidspalding · #8 Post by **davidspalding** » Sat Jun 17, 2006 1:34 pm

Wow. That's freakin' amazing. You had to clear and disable the security chip, then login with errors. And (eventually) uninstall CSS7 to fix it.

I will NOT be upgrading to this new version, under threat of torture and losing ice cream privileges for the rest of my natural life.

[soapbox] If the "service not found" is a result of a CSS Windows service not working right ... or the app trying to access the Internet (prevented by Windows or third party firewall, or the network connection not established by Access Connections) ... then Lenovo has got a ton of mud on their face. This is an app which has to be trusted and reliable and fully QA'ed for its intended audience. If complaints like this multiple, it could spell very real credibility loss for the new manufacturer of Thinkpads. I'll be watching this with extreme interest. [/soapbox]

chazas · #9 Post by **chazas** » Sat Jun 17, 2006 5:04 pm

God, I'm glad I found this thread. This is EXACTLY what happened to me. I'll follow these instructions tomorrow and see what happens - worst comes to worst, all I'd have to do is reinstall from factory condition, and reinstall everything I have, which is what I'll have to do anyway if this doesn't work. Last time I did this it took 2 days to get everything working the way I wanted it again. Grrrr.

Nick Y · #10 Post by **Nick Y** » Sun Jun 18, 2006 1:21 am

davidspalding wrote:[soapbox]....This is an app which has to be trusted and reliable and fully QA'ed for its intended audience. If complaints like this multiple, it could spell very real credibility loss for the new manufacturer of Thinkpads....[/soapbox]

What surprises me is that CSS7 (v7.00.0017.00) is still available as a download and has not been withdrawn.

davidspalding · #11 Post by **davidspalding** » Sun Jun 18, 2006 8:31 am

Yep. File under "lost credibility."

"Gee, boss, lotta people calling in this month about CSS7. Think we oughta pull it from the download?"

"Naw, we would lose face by rolling back. Leave it up until we develop and post a patched version."

"When will that be?"

"When the PMs feel there are enough bugs to warrant a patch."

labman · #12 Post by **labman** » Tue Jun 20, 2006 12:58 am

I've had a machine (R51-1836) in today with the same issue: Problem connecting to a critical service etc after the machine had been upgraded to CSS7. The CSS upgrade apparently was part of an upgrade of the repair and recovery software that had removed the prior version of CSS.

I thought it would be useful to report what was tried in this case. The unit actually booted right through despite the error - so I had access to the files and got everything off the machine. Just in case. Except for once, right at the beginning, where it got stuck at the Ctrl-Alt-Del screen. Rebooting solved that one. Scary!

Things tried that did not work:
- As per Tony's post: Removed battery and power / press ON for 50 seconds: no effect
- Disabled antivirus and firewall (because of the reference to these in error message): no effect
- Removed BIOS and HDD passwords: no effect
- Waited several minutes before entering chip password in case the service CSS wanted to access was not up yet: no effect
- Disabled chip in BIOS: no effect when enabling it again after reboot cycle
- Upgraded BIOS to 3.21 (from 3.20): no effect
- Went through list of windows services to see if maybe something was not running that CSS might be looking for: nothing found
- As per item 2, dkunkle post: Disabled chip. Boot. De-install CSS7. Reboot. Delete CSS7 directory. Reboot (no prob: if it were my machine, I would probably run it like that). Shut-down. Enable chip. Boot. Install CSS7. Reboot. Problem is back.
- I also cleared the chip given there was nothing encrypted on the machine. Still the same error. Note that I did not need to hold the Esc to access the chip part in the BIOS, as per IBM conversation reported by dkunkle.

Summary: The error is still there - or there again. But it boots all the way through. For now? This is a lot better than what other people report here. The erratic behavior is scary: some machines boot, others don't, I had this one stuck once at Ctrl-Alt-Del, another post where a hardware scan solved the problem.

I will recommend for this machine that the chip be disabled and that CSS7 be removed (as I did in the tests) and that the machine be used that way until a reliable version of CSS is released. At least that long. Just secure BIOS and HDD passwords for now. Or perhaps much longer with these passwords only and no chip.

I never really liked the idea of a security hardware device embedded in the unit it's protecting because I felt that the user would be held at ransom by that device. I'm not about to change my opinion soon.

Roger

#13 Post by **GomJabbar** » Tue Jun 20, 2006 5:23 am

labman wrote:I never really liked the idea of a security hardware device embedded in the unit it's protecting because I felt that the user would be held at ransom by that device. I'm not about to change my opinion soon.

I am not a security expert, and I have little need for high security, but I agree with your statement above. I experimented with CSS for a couple of days after I received my T42. In the end, I came to the conclusion that the risk to my data from CSS was greater than my risk from a thief. But to reitterate, I have no sensitive company or personal information on my ThinkPad, so it wasn't a hard decision for me to make. In general, I don't believe users should be using CSS unless they really need it. IMO, it was wise on IBM's part, not to include the software preinstalled.

Here is an example of a user held ransom by an encryption faux pas, that I won't forget soon.
http://forum.thinkpads.com/viewtopic.php?t=14326

davidspalding · #14 Post by **davidspalding** » Tue Jun 20, 2006 6:54 am

Unless I'm forgetting something, CSS is required to use the Fingerprint Reader Software, and CSS does hte chore of remembering and regurgitating passwords for apps and web sites and such. I use that daily, almost hourly. Yeah, just like that silly ad with Lee Majors.

So in my case, doing WITHOUT CSS would be like removing a $150 feature from my otherwise fine laptop. Lenovo ought to be ashamed.

christopher_wolf · #15 Post by **christopher_wolf** » Tue Jun 20, 2006 2:53 pm

davidspalding wrote:Unless I'm forgetting something, CSS is required to use the Fingerprint Reader Software, and CSS does hte chore of remembering and regurgitating passwords for apps and web sites and such. I use that daily, almost hourly. Yeah, just like that silly ad with Lee Majors.

So in my case, doing WITHOUT CSS would be like removing a $150 feature from my otherwise fine laptop. Lenovo ought to be ashamed.

It isn't required for the basic functionality of the Fingerprint Reader; i.e logging back into Windows from a boot/resume or screensaver. What CSS *is* required for is the fancier features that you can use the Fingerprint Reader for; such as filling in web forms with a swipe of a finger or encrypting/decrypting files.

#16 Post by **GomJabbar** » Tue Jun 20, 2006 9:00 pm

christopher_wolf wrote:What CSS *is* required for is the fancier features that you can use the Fingerprint Reader for; such as filling in web forms with a swipe of a finger or encrypting/decrypting files.

Just curious. Is there other software that can be used with the fingerprint reader (as in filling in web forms) without having CSS installed?

EDIT: Forget it. In retrospect, it seems that I asked a question that was already answered.

tsfisher · #17 Post by **tsfisher** » Wed Jun 21, 2006 6:45 am

Thanks dkunkle, This worked perfectly and I am now up and running again.

super_i_man · #18 Post by **super_i_man** » Fri Jun 23, 2006 2:31 am

I was searching this forum for how to activate the security chip. Then I read these troubled experiences, now I dont want to install this chip s/w. Thanks for the warning!!!!
Best of luck to others

chazas · #19 Post by **chazas** » Wed Jul 05, 2006 4:05 pm

Many thanks to dkunkle. When I finally got around to trying this last weekend, it worked perfectly - I was back on my T41 within 5 minutes.

I uninstalled the offending software via Windows and will not be reinstalling any version of this junk. I had just been letting IBM/Lenovo update everything suggested via the software installer. No longer.

someguy · #20 Post by **someguy** » Thu Jul 13, 2006 3:10 pm

The cause of this issue is the communication layer that talks to the
security chip. It uses a SOAP interface to communicate to a service. You will not be able to communicate with the security chip if you have a firewall that:
1.) doesn't trust the 'winlogon' service
2.) blocks the loopback address 127.0.0.1
3.) blocks tcp port: 0x6060

To disable the logon portion of CSS you can do the following (do not clear your chip):

1.) boot into safe mode
2.) regedit
3.) HKLM/SOFTWARE/Lenovo/TVTGINA
4.) remove the value for 'Plugins' that says 'css_gina_plugin.dll'. You can just leave this value blank.
5.) reboot

You should be able to login normally. If you adjust your firewall software to allow the settings above. Once you adjust your firewall settings, you can put the TVTGINA setting back or enable the logon through policy manager.

pgtips64 · #21 Post by **pgtips64** » Wed Jul 19, 2006 4:55 am

I also received the error message

"CSSAuth.exe - Unable to locate component
This application has failed to start beacuse tvt_banner.dll was not found. Re-installing the application may fix the problem."

This can be solved by adding the director path name where the tvt_banner.dll is located to the Path variable for your machine. In my case the directory path name was c:\Program Files\Common Files\Lenovo.
The Path variable can be found by pressing the "Start" button, right clicking the "My Computer" entry, and then choosing "Properties". Choose the "Advanced" tab and then press the "Environment variables" button. The system variables list should have a Path entry. If it does not, just add a new entry called "Path". Then type in the directory path name needed for the tvt_banner.dll to the end of the list (separated by a ; from any previous entries if there are any).

egibbs · #22 Post by **egibbs** » Wed Jul 19, 2006 6:13 am

I had an interesting experience with this myself this weekend.

Have been on travel and not keeping up with the forums, so I was not aware of the issues. I ran SW Installer, saw that a new version of Rescue and Recovery was available. I initially declined it, but then I was bored on Saturday and had a couple hours to kill, so I decided what the heck. Turned out I needed them all.

The install of R&R went fine, which included removing CSS V6. I got a message stating that I would need to download and install CSS V7 after the install, so I went to SW installer and to my surprise it wasn't offered. Ok - pop over to the Lenovo site, quick search for CSS, find V7, and go to download it.

Instead of the download page I get a page advising me that CSS V7 has been pulled from the web until it can be fixed. There was a description of the issue, along with instructions for the poor unfortunate souls who had already been bit. Ok, good - at least I didn't get locked out of my system.

But I do have Private Disk volumes, and need CSS to access them. And the stuff I work with most often is in the Private disk Volumes. No CSS, no files, so I'm down.

So I wound up uninstalling R&R and reinstalling the old version with CSS 6 integrated. Fortunately R&R uninstalled nice and clean, unlike some previous versions which had a tendency to crash during uninstall and leave you with an unbootable machine. I breathed a huge sigh of relief when I was able to access my data again.

So Lenovo, if you are listening - if it's going to be a little bit before you get CSS V7 back up on the web, you should really pull the new version of R&R as well so people don't get stuck with inaccessible Private Disks.

Ed Gibbs

davidspalding · #23 Post by **davidspalding** » Wed Jul 19, 2006 9:09 am

[snarky] Lenovo's running out of toes to shoot off. Okay, so they pulled the bad code, but left up code which tells you to remove good code so you can download (not!) and install (not!) the bad code.

Yeesh....

[/snarky]

egibbs · #24 Post by **egibbs** » Wed Jul 19, 2006 11:38 am

Actually, the code they left up removed the good code without any intervention on my part, then told me I needed to go get the bad code.

OTOH:

They did pull the actual bad code (half credit) and admit that it was bad.

The new good code uninstalled cleanly and the old good code could be reinstalled with no problem - that was often not the case in the IBM days. There are lots of folks who have been left with unrecoverable systems by previous versions of R&R (aka Rapid Restore).

It's a sad comment on the state of the 'puter industry, but I'd have to say their performance on this one (bad as it was) was above average.

Ed Gibbs

K0LO · #25 Post by **K0LO** » Wed Jul 19, 2006 11:42 am

There are so many horror stories of updates gone wrong with ThinkPads lately that I'm really starting to question the competence of the Lenovo software crew.

My current philosophy is to look carefully at the changes for each new update and then to decide if I really want or need to update.

The old saying "If it ain't broke, don't fix it" applies here. If my system is running well (and it is) and if the update doesn't offer to fix something I'm having a problem with, then I won't update.

As a result, I haven't downloaded anything from Lenovo since May.

Smirk · #26 Post by **Smirk** » Wed Jul 19, 2006 12:40 pm

As mention earlier:

The old saying "If it ain't broke, don't fix it" applies here. If my system is running well (and it is) and if the update doesn't offer to fix something I'm having a problem with, then I won't update.

If not Critical updates and no new "required" features, do not bother. I personally waisted hours applying all recommended updates (not critical)... and needed to revert back.

cbcb3 · #27 Post by **cbcb3** » Wed Jul 19, 2006 11:00 pm

hi all, I never used any version of CSS program before. But I am just curious about one thing, will a stystem recovery or a fresh window installation clear any CSS related system error like those mentioned above? Thanks

Tony's X60s · #28 Post by **Tony's X60s** » Thu Jul 20, 2006 3:25 am

Normally I would strongly agree with:

My current philosophy is to look carefully at the changes for each new update and then to decide if I really want or need to update.

However, when it comes to security technology like CSS, the fix lists seem to be deliberately minimalised. My assumption is that there are many fixes that are not spelled out. For example, the upgrade from CSS6 to CSS7 included an upgrade of the incorporated SecureDisk software from Utimaco by about ten minor releases - none of which was mentioned by Lenovo.

myoda · #29 Post by **myoda** » Sat Jul 29, 2006 5:08 am

Lenovo now has CSS Version: 7.00.0022.00 Release Date: 2006/07/17 as a download now. Anybody know if this is a good version??

http://www-307.ibm.com/pc/support/site. ... MIGR-63819

Nick Y · #30 Post by **Nick Y** » Sat Jul 29, 2006 6:34 am

There is a discussion about it at 'New CSS 7 (Client Security Solution) Posted July 19, 2006', this forum.

Cannot logon after CSS V7 install

Cannot logon after CSS V7 install

Fixed it once - accidentally? Hope it never happens again!

Logon successful

Thanks for the warning

tvt_banner.dll

CSS7

Fix lists don't tell the whole story with security stuff.

Who is online