Saturday 11 February 2012

Save As PDF not working in Microsoft Office products

Recently I had two issues to sort out in the office. The first was a few users from a group company that were having issues with some powerpoint files that used a truetype font. Powerpoint would get halfway and then crash every singletime. The second issue was in all Microsoft Office products where users would go to create a PDF by using the Save As... feature instead of using the print to option and using cutePDF or the Adobe PDF printers.

Both these faults started happening around the same time (Mid November) but I treated these as seperate issues to start as they came from different companies. I could replicate both errors on my PC and I didn't have any pdf printers installed so it wasn't an issues with either of those products. I decided it might be a Microsoft Office patch and went through each one and still no fix in sight.

I did one last check with another desktop of mine that hadn't had Novembers patches installed and this had no problem at all with either of the reported faults. This gave me somewhere to look, which was in the set of patches released in November and I found the error. MS11-087 was released to fix a zero day fault in Windows that takes advantage of an exploit in the font subsystem (the worm is named Duqu so if you are a creative using TrueType fonts from any site known to Google be careful and make sure your Windows PC is running AV.) What this patch does is change the file permission for a file called t2embed.dll which lives in Windows\system32 (it also lives in the sysWOW64 folder for 64bit systems.)

and for those wanting to know how to how the Duqu worm works:
Druqu worm cover by MS11-087 patch

So to fix this issue you simply have to undo this permission change and give users read access to this file(s if you're on a 64bit system) and the change will kick in straight away. Either that or you can down this .msi from Microsoft that does the exact same thing, just remember to run the command prompt as an administrator and run msiexec to undo the changes, and then relax and have a beer...