Weird Excel auto-open issue

[HCHTech]

Ok, this is definitely a Monday kind of problem. User at a client emails this morning. "Every time I open Excel, I get this." Then they pasted what looked like a text file installer log for one of their LOB apps.

I remote in, and sure enough, Excel auto-opens this "install.log" file, which is from a recent update loaded for their main LOB app. No other users have reported this symptom, and it didn't appear on the management workstation I keep there, so definitely something with this one user's computer.

They didn't report anything unusual with the update for the LOB app when it loaded last week, or with the use of that app now. This isn't a file recovery thing, just auto-open.

I looked in the XLSTART directory for their version of Office (M365), I looked through the General screen under Options for anything auto-start related, I looked to make sure that the Excel shortcut didn't have a file name appended to the open command, I rebooted, I did a search for "install.log" on the C: drive, but found dozens from various softwares - apparently that's a commonly-used name. I ran full AV and EDR scans, just for fun, but both came up clean. No updates available for Office.

I uninstalled and reinstalled Office, I dug through the registry for Excel entries, I turned off the auto-recovery options, but nothing I did made any difference or provided any clues to what was happening. Opening Excel in safe mode didn't load the file, but that didn't give me any real clues to follow. The only real Office add-in they have is for Citrix Sharefile in Outlook; so not related to Excel as far as I can tell.

Then I remember that File/Info when a file is open in Excel will give you the disk location. That led me to the location of the file that was being loaded, it was on the root of their main client directory on the server. Nothing should be at the root level there, so I just deleted the file. I have no idea how it got there, or how Excel for this one user somehow got stuck autoloading it. Deleting the file stopped the auto-loading. Yeesh - that shouldn't have taken over an hour to find.

 

[nlinecomputers]

Two things. File associations and or possible ransomware. File association may have been altered to try and run malware instead of properly opening Excel. I would check file associations on everything and do a deep level scan of the system for viruses!

 

[nlinecomputers]

Id also check the AV program logs. Maybe something DID get on the system was quarantined and only a remnant file remained.

 

[HCHTech]

Yep - good thought, @nlinecomputers . We have managed AV and managed EDR at this site, and nothing is reported by either. I did run scans with both earlier today when I was looking. I did NOT look at the file association list, though, as spreadsheets opened normally as expected. I can certainly take a look at the association list...just in case. The file that was being opened had a .log extension, so that would be the first thing to check.

The unusual thing in this case is that the file that was being opened was a legitimate log file, it was just in an unexpected place. The way these updates work is that I download them from the company, do the install on the server, then store the workstation updater on the network share and send an email with "Click HERE to install the update" links to everyone to install locally on their machines. It's kind of an idiot-proof system, so I don't know what went wrong for this user, but something sure did.

 

[frase]

I would run WRT and run repair windows and all file associations etc.

HMMM...."It's kind of an idiot-proof system, so I don't know what went wrong for this user, but something sure did."

 

[nlinecomputers]

being opened was a legitimate log file,

For what? And what does this log say?

 

[HCHTech]

It's the log file for an update installation to one of their LOB apps. Just what you would expect - time-stamped entries for copying this and updating that - all referencing that same LOB app.

BTW, the file association for .log files I got with the remote command line was "=TXT", plus Excel has all of it's normal associations. So all of that looks normal.

I'm chalking this up to unknown user self-inflicted error. Can't exactly explain it but I can't find any lingering problems, so time to move on.

 

[alexsmith2709]

I guess you dont have it now, but maybe the install.log had some machine identifier so you could tell if this was from one of the users installing the update and the log got saved there instead of their local machine? Does the LOB app have an option to save the log after install? Thats the kind of thing some users like to press! I guess next time that app has an update, see if that install.log is generated and at least you'll know the issue if it happens again.

 

[NviGate Systems]

Talk about a Monay problem lol. I was trying to setup a new router and couldn't figure out why it refuses to get an IP from 192.168.1.254 to then broadcast network access to an internal 192.168.1.1. It wasn't until I decided to manually set the IP that it gave me a pop-up reminding me the two networks have the same IP Range. Doh!