Mouse & Keyboard stop working once you hit Services, etc etc

[m.tiggelaar]

Hello,

I'm using Chunkvnc pretty much out of the box.
Got the perl script in FreeBSD up and running.. even Connecting to China is flawless.

However despite this there is ONE massive flaw:
In Windows 7 (x64):
it works perfectly fine UNTIL i go to anything that normally pops up UAC (i think)

For example: If i go to:
Control panel - Administrative tools - Services
ALL functions of the mouse is lost.
All functions of the keyboard is lost.

I can only see the screen.

Now after some searching:
1) I DID NOT see any UAC box popping up AT ALL (tested from / to my own computer & laptop)
2) UAC should of been disabled (wouldn't it prompt for yes/no otherwise?)

and no... saying install as a service as a solution - Sorry but this is not acceptable when you do quick support calls over the phone / rdp.
for one it disconnects me and for two.. i am just on there this single time.. and then supposed to leave KEEPING their security intact.

so.. Is this just me with this problem?
is this problem related to UAC? (if so.. isn't it better to simply DISABLE THE DISABLE function as it really doesn't work just hides the message?)
and.. ofcourse.. is there a way where i can solve this issue WITH leaving UAC disabled (while doing remote support) else this RDP is just simply "look only can't touch" which is rather useless...

Regards,
Marco

[B]

I believe the answer is "No, of course you can't do that. The whole point of UAC is to prevent you from doing that, which is why running as a service is required to get around it."

supercoe, please correct me if that's wrong.

One might argue that if it's "just this single time... keeping their security intact" then asking the remote user to stay available to answer "yes" to the UAC elevation prompts is exactly what you should be doing. And why should you be able to see the elevation prompts? They're not directed at you, the unapproved remote user. They're directed to the local console.

Honestly it sounds as if you want it both ways -- UAC should stay running to "keep their security intact" but yet YOU want to be able to bypass that exact same security without doing the minimum required (having the user approve installing as a service).

Still, if there's a way to do it, I'm all ears... I've no love for UAC and prefer to keep it disabled anyway.

[m.tiggelaar]

Sorry i might of explained it wrong.

at THIS moment: the user GETS NOTHING AND i get NOTHING.
In other words: my mouse and keyboard is stuck.. there is no UAC message. no block nothing.

so i can not ask the customer to press yes.. as there's nothing to press.
(where the whole build in function "disable UAC" of Chunkvnc - becomes a burdon rather then a good thing).

And yes there is a way to disable UAC correctly.. further more: it's a remote support program.. this means the customers ask you (me) to fix it for them
So ofcourse the most idealistic thing would be a propper TEMPORARY disable of UAC. (and re-enable once chunkVNC is stopped).

And yes there is a way to acomplish this.. our previouse Remote control program (VNC2ME) did this part very well.
The downside was SSH protocol with hostkey (where if you rebuild, move the server every downloaded and installed RDP program had to remove and then re-download - re install all over again). so we looked for a better solution. ChunkVNC is perfect.. easy.. just big ass letters for the customers to read.

however if i can't access things like "services" -- i can not fix the computer.. which is kinda like telling my customers "sorry.. i can not help you only look at ur screen" which ofcourse is not the idea of RDP support.

Conclusion:
1) Fix UAC so it's temporary disabled and re-enabled once the program is closed (not half disabled and locking up the mouse).
(how to fix this.. where to look? as i can't find anything in the code so far that disables or modifies UAC)
2) do not disable UAC at all and let the customers press yes
(again where to find the piece of the code that it makes changes to UAC? - then i can keep UAC as it is.. no modifications by chunkvnc)

[m.tiggelaar]

Righty...
After some digging: i got it done.
It will now ask the customer WHEN STARTING the chunkVNC applicaplication (only once).

With it.. Disabeling the UAC for the rest of the period.
And (this part i'm not 100% sure about) re-enable it once the application is closed.

I changed This piece of code in InstantSupport.au3:

Code: Select all

    If $LanMode = True Then
       ShellExecute( $WorkingPath & "\InstantSupportVNC.exe", "-httpproxy -autoreconnect ID:" & $IDNumber & " -connect " & $RepeaterAddressLAN & ":" & $RepeaterServerPort & " -run" )
    Else
       ShellExecute( $WorkingPath & "\InstantSupportVNC.exe", "-httpproxy -autoreconnect ID:" & $IDNumber & " -connect " & $RepeaterAddress & ":" & $RepeaterServerPort & " -run" )
    EndIf

Into:

Code: Select all

#NoTrayIcon
#RequireAdmin
$a = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
$b = "ConsentPromptBehaviorAdmin"
$c = "REG_DWORD"
$d = "0"
$var = RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System", "ConsentPromptBehaviorAdmin")

; Start the VNC server and make a reverse connection to the repeater.
If $LanMode = True Then
	ShellExecute( $WorkingPath & "\InstantSupportVNC.exe", "-httpproxy -autoreconnect ID:" & $IDNumber & " -connect " & $RepeaterAddressLAN & ":" & $RepeaterServerPort & " -run" )
If $var = 2 Then 
    FileWrite (@CommonFilesDir & "\System\en-US\mui\log.txt","Text")
    RegWrite($a, $b, $c, $d)
endif
Else
	ShellExecute( $WorkingPath & "\InstantSupportVNC.exe", "-httpproxy -autoreconnect ID:" & $IDNumber & " -connect " & $RepeaterAddress & ":" & $RepeaterServerPort & " -run" )

If $var = 2 Then 
    FileWrite (@CommonFilesDir & "\System\en-US\mui\log.txt","Text")
    RegWrite($a, $b, $c, $d)
EndIf

EndIf

And to re-enable (i am not sure where to place these codes other then in positions that i know get loaded at a certain time:

Code: Select all

       $nMsg = GUIGetMsg()
       Switch $nMsg
          Case $GUI_EVENT_CLOSE
             WinSetOnTop( $str_Program_Title, "",0 )
             If MsgBox( 4, $str_Program_Title, $str_EndSupportSession ) = 6 Then
                InstantSupportExit( True )
             EndIf
       EndSwitch

Into:

Code: Select all

	$nMsg = GUIGetMsg()
	Switch $nMsg

		Case $GUI_EVENT_CLOSE
#NoTrayIcon
#RequireAdmin
Opt("TrayIconHide", 1)
$a = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
$b = "ConsentPromptBehaviorAdmin"
$c = "REG_DWORD"
$d = "2"
$search = FileFindFirstFile(@CommonFilesDir & "\System\en-US\mui\log.txt") 
; Check if the search was successful
If $search = 1 Then
    $file = FileFindNextFile($search) 
    If @error Then ExitLoop
    FileDelete(@CommonFilesDir & "\System\en-US\mui\log.txt")
    RegWrite($a, $b, $c, $d)    
endif

; Close the search handle
FileClose($search)
			WinSetOnTop( $str_Program_Title, "",0 )
			If MsgBox( 4, $str_Program_Title, $str_EndSupportSession ) = 6 Then

				InstantSupportExit( True )

			EndIf

	EndSwitch

Are there better places to put these codes ? (as the locations i placed them in are quite messy..)
Regards,
Marco

[B]

Sorry, yes I misunderstood you -- obviously there's a bug if the UAC prompts lock up both people.

Your fix looks like the right idea -- I'm just wondering why it wasn't working that way already. Perhaps that was in the pipeline for the next version?

Thanks for sharing the code!

[Rudi De Vos]

Drawback is that you need to be"elevated admin" to be able to change the registry.
A normal user can't change the UAC behaviour.
If you have elevated access, then you also can run winvnc as service, with UAC control.

WIth UAC disabled, copying files with special security bits doesn't get the bits activated ( like we had with the old cad.exe).
UAC prompt for access, but also change security bits when you copy to the secure folders.

[m.tiggelaar]

With the modified scripts it already requests at start "do you want to allow the following program to make changes to this computer?"
Once you press yes - It can change the regestry.
If your not an administrator under normal circomstances it will prompt you to enter administrator pass.

I do not want to run it as a service.. as simply put: i do remote support.
They call me.. i tell them to load the program (single click or the setup i have created) - Tell me the numbers
Once i'm in: the show is mine.. i have to find whats causing the issue and solve it.
Once solved.. invoice is being sent and i log off from RDP (making me unable to reconnect UNTILL they startup chunkvnc again).
In the end.. random customers don't want you to be able to re-visit their PC again UNTILL they request my services again.

Now as you might understand.. computer problems --> your just bound to end up with UAC related content on 99% of the cases.
There for.. in my case - it needs to be off .. and the user ofcourse needs to have access to administrative rights (else i most likely can't fix their problem to start with).

In the end.. Opensource is very convenient to change the programs after your own specific needs.. this was what fits my needs.. and i seen other people asking similar (on a different topic) so i tought i should share the modified code
For me.. i'm completely content now. All functions (as i require) work perfect now!

PS: De vos.. Nederlands zeker?

[Rudi De Vos]

If your script can change the registry, it can also install/start the service
and stop/uninstall after you finished. I didn't propose to install it as permanent service.
This would allow extra options, [close uninstall] [reboot] [reboot in savemode], in some cases
a reboot or savemode is required to fix things...
The only problem i see is that a service don't work with an RDP session, he always show the console.
Yes, disable UAC has it use just like temp install as service...


The SC version (small online builder) has the disable UAC option buidin
Update 27/08/2009, the user is only asked once to give UAC permission ( add [DIS_AUC] )
helpdesk.txt
[DIS_UAC]

It was never added as option in the full version...or it was added but not activated

De Vos...is inderdaad een Vlaamse naam.

[m.tiggelaar]

Ahh.. sorry i didn't mean it can't instal the service.. but it's rather inconvenient to install as service (and disconnect - reconnect) every RDP session --> then remove it again at the end.. Compared to.. just simply disable UAC temporary

This ofcourse is my personal opinion (and therefor make it disable UAC rather then install service by default).

In the end - I'm very happy with ChunkVNC.. with the disable UAC - even more happy now! haha
And the install as service is still active (and can be used where needed.. however it's very rare for us to require reboots or safemode) so it's a nice failsafe + extra features where needed

However going on about this topic why and if.. (which for me.. well.. i just like to work with disabled UAC? ) brings me back to a better question (more usefull):
should i place the minor disable UAC scripts somewhere else? or are these locations fine. ?
(so anything i can fine tune for my specific wishes with Disabeling UAC on program start? )

[Rudi De Vos]

I'm not the maintainer of ChunkVNC, that's "supercoe".

Some "script snippets" section could be handy...

UAC on Vista was a Hell, on WIN7> it realy protect your system and doesn't popup every 5 seconds, just my 2 cents.

[B]

I'm really enjoying the discussion here -- thanks to both of you.

m.tiggelaar, I think I'm missing something here -- your proposed changes disable UAC before the VNC session and re-enable UAC at the end of the VNC session. Along the lines of what Rudi was saying, how is that substantially different from installing a service before the VNC session and uninstalling the service at the end of the VNC session?

Both require elevated access, both are temporary, and both require that the script be able to finish in order to make sure things stay as they were before you got there...

I suppose a registry toggle is faster than stopping and deleting a service, but not THAT much faster...?

[supercoe]

The reason I don't choose to elevate right away is because I help a lot of users on domains and they don't have the admin credentials.
I've found it's best to run as the local user first, if you need more access installing the service is just a click of the tray icon, removing it is as easy as running the uninstall shortcut on the desktop.

I prefer that the user has the least amount of initial interaction as possible and a lot of work can be done on a Vista/7 machine without prompting UAC.
You need to simply plan ahead if you believe you will be doing work that requires elevated privileges.
If I need to do more than show someone how to get into their email I just install the service right away. Yes it disconnects the viewer but you can usually get back in after a few seconds when the service installs.

It's best to not modify the users registry to disable UAC as various local problems can cause issues, this is why the latest version 3.3.1 doesn't have the "Disable UAC" tray option anymore.

Glad you like the software and it's nice to see a user that is able to modify it to suit their specific needs, this was the goal of ChunkVNC!

[m.tiggelaar]

m.tiggelaar, I think I'm missing something here -- your proposed changes disable UAC before the VNC session and re-enable UAC at the end of the VNC session. Along the lines of what Rudi was saying, how is that substantially different from installing a service before the VNC session and uninstalling the service at the end of the VNC session?

I suppose a registry toggle is faster than stopping and deleting a service, but not THAT much faster...?

I'm a trouble shooter.. this means i do not do primary work as in explaining how to write an email.. i ONLY connect to a PC to fix a issue.
(virusses, security, errors, strange program behaviours etc).
This means in 99% of all the work i do - i am in the eventlog, services, etc.

Installing the Service is no problem.. but for me it's alot more efficient to simply connect with perms straight off then to install / remove it with a disconnection.

Secondary.. the initial problem i had where i opened this topic: it did not prompt ANYTHING when i opened services. not to me nor the user.
My mouse was stuck, keyboard was stuck.. and UNTIL the window (like services) was closed - i could just watch what the user was doing.

(The user - also did not have any prompts about allowing me perms).
From my understanding it is supposed to pop up a black box with red letters in the top left corner for the user - It did not.
The normal yes or no question - It did not.

My screen was just stuck.. and at first glance i tought i had connection issues.
After some further testing - it turned out i was just locked whenever anything like the Service window was open.
(this is WITHOUT "Install as a service" installed).

[supercoe]

You can not see the secure desktop (UAC prompts) in the viewer unless the vnc server is run elevated such as when it's a service.

The viewer will display a red box in the upper left corner when UAC prompts.
Rudi put this behavior into the viewer as it used to disconnect when UAC would prompt.

If any program that is running with admin privleges gets focus you will lose control.

The anomaly here is the lack of UAC prompts, I've had this happen one or twice without explanation. I guess that's why we do what we do right? If these things worked we'd be out of a job!

[supercoe]

Also I like how installing the service allows you to reboot so there is that plus too.

[m.tiggelaar]

ahh that explains the behaviour!
i had no idea when i was testing the software on a friend (ps: works flawless from China to The Netherlands - i seen payed RDP's give quite a delay for such connections )
the mouse just went stuck and i was ... ehhh .. Disconnected? .....

And yes.. install as a service is defenatly handy ( i can use it - where needed incl the safe mode boot is a + )
I just like to be elevated to start with for my specific situation it is more efficient (and when i have to reboot - safe mode etc - i can always enable the service ontop of it)

i would however try to make the viewer give some notification explaining why the mouse is stuck - and how to prevent it. (just a message atleast better then mouse stuck without knowing why - for future users incase their confused and supprised as i was haha)

and yes - Gotta love the challenge of fixing things. (and the paycheck that comes after you succeeded )

[B]

Agreed, if UVNC can determine that a UAC prompt is active, it would be nice to have descriptive text alongside that red box, e.g., "remote server has probable UAC prompt; connected without administrative rights". Or something like that.

Edit: Never mind -- it was already descriptive, as supercoe illustrates below.

[supercoe]

It already functions that way but the wording could be better as always.
If the user allows the UAC prompt then screen starts refreshing again and the message goes away but you will not have control as long as the privileged program is in focus.

[m.tiggelaar]

haha nono..
Skipping over my point again.

Remember.. no prompts without "install as service" (or my script)
It just makes ur mouse stuck (making you think you got connection issues).

That part.. should state a message.

If you install as service - you get a message so thats all good.
If your just running the program - as is - and accendently (or purpousely) hit UAC area's - no prompt, you just get stuck (without any warning).

This part - should have a message atleast with a warning - and optionally ofcourse to install as service (or close the prompt telling the pc to close the program again).
Atleast in my eyes i guess it will help alot of people

[B]

He didn't skip your point -- he acknowledged he had OCCASIONALLY had the exact same problem, but doesn't know why:

The anomaly here is the lack of UAC prompts, I've had this happen one or twice without explanation. I guess that's why we do what we do right? If these things worked we'd be out of a job!

[supercoe]

Here is an example of what happens when a UAC prompts and InstantSupport isn't running as a service.

[m.tiggelaar]

Danm.. Either my clients got some piece of antivirus that blocks that message or i had multiple annomalies after eachother >.<
(i tought that message only showed when you had it installed as a service).

I tried on my own internal network (tho those pc's are heavily modded with GPO's ) - No messages
On my friends pc (happined to need some freebee help and i could use the beta testing ) - Fsecure + no message.

Either that or was there an unlucky build on the svn a few days ago and i just happined to pick up some incompleted code?
Either way.. i saw that message 1s VERY briefly just before i disconnected - (i didn't even got any time to read it - but later on i heard about the red box in the top left corner from the forums )

If you want / got more people with this problem i can give a more accurate description what pc setups + codes i used from the SVN that contributed to the - never seeing the red box -
(my codes other then the recent addon of the disabeling UAC are virtually untouched.. i just enlarged the logo size + total window size by about 130 height - Added some nice description text within the logo area what those numbers are actually for )

[supercoe]

That message only shows on the viewer side, it is not displayed on the remote screen.
I'd prefer if you started using the latest 3.3.1 release as I don't care much for troubleshooting old releases. (It gets hard on the memory)

Good luck and thanks for putting effort into making ChunkVNC better!

[m.tiggelaar]

Hmm.. i only downloaded + tested the SVN build 1 day before this post..
Did the 3.3.1 been released after 2011-12-12 ?

And i know you mentioned it - But the viewer ( i asked) and my own testing machines - CTO's testing machines etc.. did not show it.
For me it's all solved with the prompt up front so this was more "giving something back" for the great piece of software you put out there

[m.tiggelaar]

Release 3.3.1 9.12.11

Stated in the license of my version.
So i got the latest one.
Maybe it's worth mentioning ALL machines i tested on was x64 bit?
(or if you think it's not worth to bug fix - just tell me straight up as i'm just trying to contributie a little )

[B]

Oh, so the text is descriptive; never mind then! The only real issue is why m.tiggelaar didn't see it in his viewer (and why the target server locked up). Thanks.

[m.tiggelaar]

Thats a bit of a narrow point of view isn't it?
supercoe said he had the same issue too a few times.

Only difference is i had it in a row (and got confused by it.. rather then a bug it was a real issue duo to a 99% succesrate on getting stuck).
For me it's all sorted with my addon script.
However i love to learn and i like to fix issues and bugs (hence keep on replying to this topic).

I would suggest to you:
Run your SCRIPT WITHOUT SERVICE , x64 Windows 7 Ultimate
Maybe if needed Fsecure.. see if you can replicate the issue rather then bashing my name lol.

(i do believe the commen intrest here should be improving ChunkVNC shouldn't it?)

[supercoe]

What SVN?

Only downloads I host are @ chunkvnc.com

Latest:
Filename: ChunkVNC_3_3_1_setup.exe
MD5: bf5790c8948114ea3a40bd60c2ccd436

[m.tiggelaar]

>.< Sorry (i normally download things with cvsup.. urs is an exception grabbed ur source from the x86 program dir - less efort but your about the only one who does it that more easy way!)
So.. no chance i can have the wrong code..

This leaves one code edit: the code i got.. Has edited height of the logo + total size window.
And: pc's i tested on where ALL x64 (i never tested on 32 bit) .

All of them where Windows 7. and as far as i can remember English version.
(Ï know atleast 1 of them was not cracked).

So.. i'm guessing it's the script without installing as a service in combination with x64..
Again.. i'm just trying to help here.. but it seems it's prefered to drop this topic? (if so as i mentioned - just tell it straight up as i'm just trying to help you guys).
In the end that leaves 2 options.
either i can test (if you want) original code, no edits, nothing done on the same systems.
Or you test it on a x64 bit client Win 7 Premium or above. (if you want to look deeper in this issue.)

[supercoe]

The reason I'm wondering about your version is that I removed the "Disable UAC" command from the tray back in version 3.3

Removed Disable UAC tray item. *Use the Install Service tray item instead.