Zoom Fails to Start CPU 100% - System Mechanic 7 Iolo DMV service problem

[wrensoft]

This is a post about an issue we have become aware of today.

The System Mechanic 7 product from a company known as Iolo can interfere with the Zoom Search Engine functioning (and other software for that matter).

The symptoms of the problem are

1. The Zoom Search application fails to start.
2. There are no error messages and no windows that open. Nothing to indicate the nature of the failure
3. The CPU usage hits 100% and stays there. (If you have dual core CPU's you'll see usage stuck at 50%)
4. The the windows task manager you'll see the ZoomIndexer.exe task running but nothing else happening
5. This effects both V4 and V5 of Zoom and apparently some other applications.

The cause of the problem seems to be that System Mechanic 7 contains a Windows service called, iolo DMV Service, IOLODMVSVC.EXE. This service starts itself when windows boots up.

Once started this iolo DMV Service seems to be inserting code into other processes. That is to say, Iolo are adding new code to our software before it runs. This is not normal behaviour for software but is more typical of Rootkit and virus behaviour.

Iolo also completely fail to document this software on their web site which makes matters even worse and more suspicious.

Finally even after you uninstall System Mechanic 7, Iolo leaves this DMV Service running on your system. So uninstalling System Mechanic 7 doesn't fix the problem as the software doesn't completely uninstall (another typical trait of spyware).

Fixing the problem requires you to uninstall System Mechanic 7 and then manually disable the iolo DMV service from the Windows Control panel / Administrative tools window.

The offending code inserted into other processes is contained in the DLL, ioloHL.dll

What exactly this DLL does, we don't know. But it does screw up other applications. I would like to think it is an accidental flaw in System Mechanic, but why not allow it to be uninstalled? And why not document its existence? So unfortunately we have to classify System Mechanic as malware until we hear differently from them (we have reported this issue but have no response as yet).

However once the service is disabled, the DLL is not inserted and the problem is fixed.

Screen shots:

Here is a screen shot showing the iolo service (after it has has been manually disabled)



Here is a screen shot showing Iolo System Mechanic 7 hooking code into our process.



Thanks to Rob Latour for helping us get to the bottom of this issue.

[wrensoft]

After some further research and some information from nick_s at Wilders it seems the System Mechanic 7 call chain is,

Windows boots & runs ioloDMVSvc.exe as a service, which dynamically drops mchlnjDrv.sys as a file and then starts it as a kernel mode device driver. Once the device driver is in place it hooks all applications upon startup and does a code insertion of the ioloHL.dll into their process space.

Then ioloHL.dll stuffs up big time and gets itself into an endless loop. Using up all your CPU time.

MchInjDrv.sys is part of 3rd party API hooking software development kit call madCodeHook from a guy called Mathias Rauen. It is used by rootkits and security software from comapnies that don't know how to write their own device drivers or don't have time to. It can be used for good or evil depending on the DLL being injected into other software.

We also got an automated reply to the E-Mail we sent to Iolo, telling us how to defragment files. Cute.

[martbd]

This file also interferes with Say The Time

[wrensoft]

We have been in contact with a number of other software developers. We are aware of half a dozen different companies which also have a problem with System Mechanic 7. It seems to be related to the use of a particular library called Armadillo for license key management.

It has been a week now, still no reply from Iolo.

[Les]

Hi,

I've got the same problem, loaded System Mechanic 7 and now Zoom Indexer won't run.

One symptom I notice is that in Windows task manager I see 2 instances ZoomIndexer.exe running even though I only try to start it once.

I have also contacted Iolo customer service and am waiting for their repsonse. I suppose I'll just have to delete System Mechanic if they don't fix it.

It may just be coincidental but Adobe Photoshop Elements stopped working as well and I had to reinstall it and Recordnow CD writer software also stopped working (permanently).

Cheers

Les

[Ray]

Originally Posted by Les

One symptom I notice is that in Windows task manager I see 2 instances ZoomIndexer.exe running even though I only try to start it once.

This is normal behaviour with Zoom, and is not a symptom of the System Mechanic problem. Each instance of Zoom will appear as two "ZoomIndexer.exe" processes in the Process list of the Windows Task Manager.

[pbacon]

I get exactly the same problems with a program called Auction Sentry. I have uninstalled System Mechanic 7 thanks to your instructions. Hopefully iolo may get round to acknowledging their problem sometime soon.
Peter

[Les]

Iolo seem to have fixed this problem.

There have been quite a few System Mechanic updates over the last few days and today my Zoomindexer is working again.

[wrensoft]

Do you have the exact version number for the new version?

[Les]

Hi,

Version 7.1.4 is the current version I have.

Les