beta 11/12 logon issues

[gelöscht]

(This is a repost, apparently I can't find my posting from yesterday anywhere on this board)

I apologize in advance for my wordy description, I have found multiple logon issues after upgrading to betas 11 and 12 from beta 10.
Setup: WinXP SP3 Enligh PC with default SuRun settings, FUS enabled, 2 admin accounts + 1 user account, winlogon screen enabled showing the 1 user's picture only, not the admin's.
With beta 10 I can logon as admin or as user from the winlogon screen with no problem.
Instead with betas 11 and 12 something has broken, and performing a logon is very difficult, then the PC runs with some more issues. Details follow.
When Windows shows the single user logon picture, I can press the down arrow key to focus the password entry field, at which point letter keys are not working, so I can't type in the user's password. I can press Ctrl+Alt+Del twice rapidly to go to the old-fashioned password entry dialog, but when this dialog shows up it's practically invisible, the only visible part is the background rectangle of the user/password field (I'm not sure which of the two). Anyway, letter keys ARE working, so with a bit of luck I can type in Administrator/password and logon as admin. At this point I can see the desktop background but no taskbar or desktop icons. Tapping the power off key seems to unblock something, and the taskbar and desktop icons immediately show up. However, Windows is half functional. Only top-level items of the Start menu work, all sub-items do nothing when clicked. Several programs fail starting up, and complain about "access denied, system error 5". Luckily the control panel is a Start menu top level item, so I can uninstall SuRun beta 11/12, reboot, and install SuRun beta10 again. :)

Kay

I think the issue with your system is releated to SuRuns "IAT Hook".
But some questions first:
* Are you using XP x64 or XP 32?
* Are you a domain member?
* What HIPS/AntiVirus programs do you use?

I would appreciate your help to find the bug: You can deactivate SuRuns IAT hook by unchecking "Set a Hook into all processes that directly execute applications" in SuRuns Options on page 3 "Execution hooks".

If I'm right, you should then be able to use your system with Beta11/12...

If that works, in Beta 12 you also could try to check "Set a Hook into all processes that directly execute applications" and uncheck "Also set a hook into services and administrative processes." to see if that is the bad guy.

Thanks,

Kay

[gelöscht]

Thanks Kay, I will try your suggestions and report my findings. Meanwhile, some answers:
- XP 32
- not a domain member
- no HIPS no AV (when I was testing, since then I installed Outpost

[gelöscht]

Kay, it went exactly as you described.
I deactivated SuRuns IAT hook in beta 10, then performed the upgrade to beta 12, and logged in with no issues.
Then I reactivated IAT hook in beta 12 without activating "Also set a hook into services and administrative processes" (I don't dare do that!). Again logged in with no issues.

When I had issues, I think that the final settings were the same, but the path to get there was different, the IAT deactivation and reactivation missing. Does this experiment help you "fix whatever in your code" ?

Incidentally, why did you add "Also set a hook into services and administrative processes" ?

Kay

step wrote: Does this experiment help you "fix whatever in your code" ?

Yes! It tells me to keep hands off services. The next Beta will have that option removed.

step wrote: Incidentally, why did you add "Also set a hook into services and administrative processes" ?

Primarily it's there to intercept the "new hardware found" wizard.
SuRun is able to ask for your permission when new hardware is found.
This way you don't need to enter an admin password on the user desktop.

But you also could intercept services (such as RealVNC) starting programs as limited user and then saying: "You need to be admin to use me".

[gelöscht]

Intercepting the "New hardware found" dialog seems a boon to me, pity to lose it. Maybe you could keep this feature but with a default whitelist including "new hardware found" only. It's your call anyway. I think SuRun is terrific. Thank you.

Kay

I kept the option. (http://translate.google.com/translate?hl=de&sl=de&tl=en&u=http%3A%2F%2Fforum.kay-bruns.de%2Fpost%2F2238)
SuRun now only "infects" services.exe...
Would you try if it works on your system?

[gelöscht]

Yes, beta 13 works on my system. I upgraded from 12 to 13 without changing SuRun settings. The execution hooks page now has 4 checkmarks only, all 4 enabled.

I noticed an issue with time setting. A non-admin user can change the time, but not the timezone.

Kay

It works here...strange.
At least you could do "restart as admin" and set it.

[gelöscht]

I keep forgetting about "restart as admin", nice usability touch. My habit is to go start control panel as admin. Thanks.