For the past week, I’ve seen a blue screen flash by whenever I log into Yahoo! The scary thing about it was the frown graphic in the center that just makes you think “virus” or “malware.” I run AVG Professional which keeps itself up-to-date so I rarely have problems. But I visit a lot of evil sites when tracking piracy of my eBooks, so I expect to get compromised from time to time.
A little research suggests that the “Aw Snap” screen is/was a normal error in early Google Chrome releases, and people even gave Google credit for having a cute error screen. I couldn’t find any mention of it relating to Internet Explorer (I’m running IE 8.0) so I’m still a little suspicious. What I’ll do next is use system restore to set my computer registry back a couple weeks, before I went on my latest piracy tracking adventure, and see if it eliminates the blue Aw Snap screen.
The hard part was capturing a still shot of the error screen as it fleeted by so fast I couldn’t read it. In the end, I had to fire up my Cam Studio software to capture the center of the screen where the error appears, since capturing the whole screen bogs down the laptop too much. Once I did that, it took another five or ten minutes of hitting “Play” and “Pause” in Cam Studio to get a still shot of the screen, which was only captured for one frame.
After go backwards with system restore a couple times and seeing the problem clear up – for just the first or second approach to Yahoo – and then return, I gave up. Neither AVG or MalWareBytes picked up anything bad, but I decided to take it seriously, swapped in my old hard drive and wasted an entire day getting the updates loaded. I’m still curious what the problem was if anybody else comes across this – I can always recreate the Aw Snap Screen Error by swapping the other hard drive back in.
Oh my gosh, I am having the same problem with my IE 8.0, Norton 2008 and Ad-Aware Free have found nothing. I see that your post is very recent, and my problem started only a few days ago. Waiting urgently for your reply. I’m contemplating drastic measures
Iper,
I wasted several hours trying to chase it down, returned to older system restore points, etc, and it kept coming back after a visit or two to Yahoo. So I ended up copying off my data files to a back-up hard drive I keep in an external USB shell (I’m on a laptop), swapped that drive back into the laptop, and spent the next five or six hours reinstalling software and getting it all up to date. So far, with the same virus suite (AVG 9.0) and the same Internet Explorer (IE 8), both with all the updates installed, the error screens haven’t been flashing by.
I tend to think the machine was infected with malware on one of the piracy sites I visited chasing down stats for how badly my eBooks are getting ripped off. It could be that the malware is so new that none of the software I tried could detect it. Jury is still out, but if it doesn’t come back, eventually I’ll wipe the drive that was in the laptop and copy this system onto it.
Morris
I have the same problem on Internet Explorer. Recent. It’s on my work laptop which has very strong virus protection. Any help would be appreciated
Tam,
Based on the number of people seeing this, I’d think it would be due to a Windows update combined with some other factors. Yet, every time I set the registry back (and I went three weeks, before the Aw Snap screen started flickering by), it would only be OK for one or two logins, after which the problem would return.
Morris
I’ve seen this screen too …. a week or so ago. I’ve since noted certain spam appearing in two of my yahoo accounts I use (and not in the other accounts where I can’t memorise the passwords I’ve applied and therefore don’t check them so often). Like you, I suspect something noxious – a keylogger perhaps? I use AVG on one machine and Norton on another and both were affected. One of these machines is a Dell and I often get their ‘Can’t find the page you were looking for’ when I was already looking at it. This started happening after I had to get Dell technical Support for my display driver. I’m not technically skilled so this really ticks me off!
Bob,
All this interest is tempting me to put that hard drive back in and try to figure it out:-) I don’t know if a keylogger would be more likely to escape all the anti-virus and anti-malware stuff we are all running than anything else, I’d think it woul be one of the easier things for them to check for.
It always seemed to come up during a long hesitation as I was trying to log into Yahoo or eJunkie (the site I use for legally distributing my eBooks), but at least once, it popped up when I logged out of Yahoo! If it is malware, you’d think it was malware that had been shut down. In other words, maybe we were all infected for a long time and didn’t know it, but some government shut down the IP addresses the malware was checking in with, so only now do we see an error.
And since “Aw, Snap” seems to have been a Google thing, itmight also be related to the Google toolbar, or a recent update thereof. I wonder if all of us are running the Google Toolbar?
Morris
I’ve just seen the same thing on IE8/Windows 7 with no Chrome installed.
I have got “Google Chrome Frame” installed though (as a result of using Google Wave) and I can get an “Aw, Snap!” screen by browsing to “gcf:about:crash” in IE.
Has everybody else seeing this behaviour got GCF installed?
Greg,
I absolutely do get the Aw, Snap screen is I plug
gcf:about:crash
into the browser bar, and my firewall popped right up and blamed it on Google Crash Handler, the firewall report being:
C:\Program Files\Google\Update\1.2.183.23\GOOGLECRASHHANDLER.EXE
Not an error one would expect to be seeing in Internet Explorer. So I’m going to try uninstalling every Google for the moment, my Toolbar, Chrome which I rarely use, and see that gets rid of Crashhandler. Back in a few minutes, may make a new post.
Morris
Greg,
Uninstalling Chrome and the Chrome framework appears to have done the trick, thanks for the major hint:-) The screen had flashed by so fast for me that I never got to click on the link that would have made it clear Google software really was the issue.
Interestingly enough, the Internet Explorer has also seems more responsive. I’ll keep logging in and out of Yahoo! to see if it comes up again, but I’m ready to believe that Google Crash Handler was somehow getting called every time there was a delay in loading a page, and that very call slowed things down further and led to stutters.
Morris
Glad that’s done the trick! It’s interesting that GCF seems to embed itself much deeper into IE than one would expect. According to Google (http://www.chromium.org/developers/how-tos/chrome-frame-getting-started) GCF should only be activated if a specific tag or header are present.
I’ve just tried to log in to Yahoo and saw the same behaviour as you, but didn’t see the header in any of the responses or the tag in the HTML. To be fair I only looked in the post-login HTML, so there may have been an intermediate response right after hitting login that I didn’t capture which included it.
If I get some time I may decide to capture all the traffic to prove this, but I’m not promising anything
[...] Internet Explorer “Aw Snap” Screen Virus On Password? [...]
Running IE7/Windows XP and was having problems opening Adobe fillable forms. Thought I would try to visit windowsupdate.microsoft.com to see if there was a recent update, but I couldn’t even get that site to work and kept seeing this same screen. I had the Google Chrome Frame (installed because of Google Wave and not Chrome) and saw that there was an update on 3/17/2010. Uninstalled, GCF and everything works fine now.
Chris,
That 3/17 date looks just about right, and since you only backed out the update to fix it, I think we have a winner.
Morris
I too have been seeing this blue screen quickly pop up and vanish again for the past couple of weeks, and it has taken me until yesterday to actually find out what it was, as it is too quick to read the message. The worrying thing for me is that, since it started i can no longer access my Yahoo account, email, Flickr, Messenger etc. I tried Log-in Help, but get a message saying, “Cannot reset your password, please contact Customer Services”. For almost 2 weeks now, i have been emailing them, only to get the odd email saying they need me to tell them my security password. Has my account been hacked, and could it be something to do with this “AW, Snap” error?
Lee, try uninstalling the Google Chrome Framework if you have it installed, and if that doesn’t fix it, try uninstalling any Chrome and Googles Updater software.
The trouble accessing all of your accounts doesn’t sound much like hacking, very few of the world’s bad guys would care about your Flickr account. You sould try logging in from another computer for starters. If that doesn’t do it, it could be that a problem on your computer, even something as simple as Caps Lock, caused you to use up all of the retry count, and they assume that somebody is trying to guess your password. But that usually resets itself pretty quick.
Morris
Finally, after having the error for the last few days I’ve uninstalled Google Chrome Framework and the error is completely gone. It was driving me mad. Thanks for the suggestions!
Thank you for posting this. I googled this (after seeing the screen show, “oh snap” long enough for me to at least read that portion of the message). Yours is the only post that wasn’t specifically Chrome related. Glad to now know the reason and what I can do to fix it!
Morris
I just saw this thing today (logging on facebook) and my first instinct was to find out what it is. The odd thing is that I haven’t used the laptop in a days and all I do on it is social networking and gaming. I don’t surf the web past YouTube, Facebook, and other long-time trusted sites. I’m concerned for my Facebook account so until someone finds the problem, I think I’ll be safe changing my password and not using this computer. I also doubt it is windows updated because I don’t keep my system up to date. It slows it down any time I update it (especially slowing games).
Josh
I was also seeing this annoying error when using IE. Lately I had been using the privacy settings to prevent this error from appearing.
I removed Google Framework and the error is gone, even in the normal settings. My IE browser performance also improved! Thanks!
Hey Morris,
I’m gonna uninstall Chrome Frame, and see if that resolves the problem.
Josh,
I don’t see what you have to lose checking if you have Google Chrome Framework installed and removing it if you do – seems to be working for everybody else.
Morris
Thank you for posting this blog. My co-workers brought this to my attention on one of our computers. And for the life of me I couldn’t figure out what it was. I was running every virus scan and spyware I could think of, and nothing was popping up. I saw the Googleupdate warning in my Event logs, but until I read this the two did not click as one and the same.
I have since uninstalled both items I had that were Google, and the face has not resurfaced. Hopefully that will stay that way. I’m glad this wasn’t something malicious (and also that I’m not the only one looking up folder with x eyes on google
)
Thank you, Morris!
I have also noticed this problem using Internet Exploret 7. Moreover, site addresses beginning with https:// cannot always be accessed. Before the aw snap page started flashing occasionally, I had a Google Translate pop-down bar appear every now an then in Internet Explorer when visiting foreign lagunage sites, with no way to turn the feature off.
I have not installed anything Google recently, so I was surprised at this. The Google Translate bar seems to be gone now, but the aw snap page is more frequent. I will try installing the Google Chrome Framework, to see if it helps. I suppose there could be a connection between the unexpected appearance of the Google Translate bar and the as snap screen.
Embo,
That’s uninstalling Chrome Framework, not installing.
And the error started out of the blue for all of us when one of these components updated itself.
Morris
Yes, it was uninstalling that I meant. Anyway, the problem is gone now.