MS causes all Windows actions requiring UAC to fail instead
Free - Simple - Scalable
Brought to you by:
sunmnp
Menu
▾
▴
#14 MS causes all Windows actions requiring UAC to fail instead
I installed Moon Secure 2.2.2.163 on Vista Home Premium SP1. Now, AFAICT, all actions fail which should have made the a UAC confirmation dialog box appear. Instead of popping up the dialog, the actions fail.
Steps to Reproduce:
* Install Moon Secure 2.2.2.163.
* Click on anything which normally causes a UAC dialog to appear. For example, click Start > Control Panel > Device Manager.
What happens:
* Nothing. The UAC dialog does not appear, and Device Manager does not appear.
What should have happened:
* The UAC dialog appears.
* I click "Continue".
* Device Manager appears.
Workaround: Either uninstall Moon Secure, or stop the Moon Secure service in the Services snapin (msav).
Dear other Vista users: I would like one other Vista user to either confirm or deny that this bug happens on your PC too please.
Actually, this does not make all UAC-required actions fail, only some. For example, Moon Secure makes it impossible for me to open the "Add Hardware" and "Device Manager" control panels. It also makes it impossible to run 7z464.exe, which is the installer for 7-Zip. But it allows me to get into the "Parental Controls" control panel, and it allows me to run xchat-2.8.6.1.exe which is an installer for SilverEx X-Chat.
This is still an extremely serious bug. Until you fix it, please put up a big warning on your downloads page as http://sf.net/tracker/?func=detail&aid=2562965&group_id=169560&atid=850853 recommends.
I asked on irc.quakenet.org #delphi, and deccer <philipp.voidzero at gmail dot com> kindly attempted to repro. He installed Moon Secure 2.2.2.164 on Vista and tried Device Manager. It caused a UAC popup to appear and worked perfectly. He tried a whole bunch of other Control Panel icons too, and they worked fine. So the problem is either the version difference (I am using the latest stable version; he is using the latest beta) or some other difference between the state of my computer and his.
As for me (Jason), when I have more time, I plan to try 2.2.2.164. If the problem persists, I will check my Windows event log in the Computer Management administrative tool. Then I will try running Sysinternals Process Monitor while trying to repro the bug. Then I will attempt to repro using the latest svn version. If I do any of these things, I will keep you updated.
I don't remember if Moon Secure keeps its own logs, but if it does, I will also check those.
I am experiencing the problem even on 2.2.2.164. I don't know why deccer didn't. I think I should download a Vista VM (Microsoft makes various VMs available) and see if the problem happens there.
Yes, Moon Secure does write to a log file (c:\moonav.log), but only if that named file already exists. Create it manually.
I played around for a long time in Process Monitor but couldn't track down the problem. As my experiment, I ran mmc.exe from a non-elevated Command Prompt. (Sysinternals' sigcheck -m showed me its manifest, which requested execution level highestAvailable.) Without msavcore running, consent.exe ran to show the UAC prompt. I agreed, then mmc ran fine. When msavcore was running, consent.exe didn't run. Instead, mmc.exe quickly exited with exit code -1073740756. That's HRESULT 0xC000042C == STATUS_ELEVATION_REQUIRED.
It appears from the log and from msavcore\uMoonAVCore.pas +/Scaning that the "Scaning" [sic] log message on exec comes from procedure HandleDLLMessasges [sic]. But I'm not sure what causes that procedure to be called. It might be hookers\MoonSysH.dpr, or it might not. MoonSysH seems to never write any log messages in practice, though this might be because it defines a blank pslog procedure.
Even if I manage to fix things, I'm not sure that I can build a new release. I don't plan to shell out the full price for a copy of Delphi, and I don't have a copy either. I grabbed the non-QT version of Lazarus from http://sf.net/project/showfiles.php?group_id=89339&package_id=105599 and now I'll have to play with it and build some small hello-world project to get acquainted with it. Next, I'll see if it can build Moon Secure.
The next question after that will be how to rebuild the installer. Looking inside the .exe shows it's Inno Setup. A quick glance through the source doesn't show any setup builder files.
I wonder if privately emailing Trieu Tran Duc will help me. Googling for trieutranduc looks like it will provide a current (2009) email address.
Another alternative would be to wrap Setup to make it error out on Vista and higher.
dinger1986, you wrote to me in a private mail that this is caused by Vista SP1, and that it does not happen on pre-SP1. Do you know this because you yourself have seen a PC where this bug doesn't happen, installed SP1 on that PC, and then this bug started happening? Or did someone email you and tell you it was so? (If so, please forward the email to this thread.) Or do you know some other way? :-)
Also, you wrote to me that the way to fix this is a certificate from MSFT that costs £2000+. How do you know? Why would a certificate fix the bug?
Hi,
I believe this is caused by sp1 as pre sp1 it worked fine on a large number of machines and nothing was ever reported before sp1 came out, I have not tested this myself. The costs of certificates I know as we had to work round it before to get Moon Secure to work on vista pre-sp1, the workround has clearly been closed by microsoft, a certificate from microsoft would resolve it as the work round would no longer need to be applied(Microsoft only allow certified software to autorun on vista and run services). If anyone has heard of anyway round it please let us know, we will investigate this.
Jason if you would like to investigate this andd come back with a way round it that would be appreciated,
Thanks,
Dinger1986
I did a few Google searches to try to find other apps which cause the same UAC problem that Moon Secure causes. The only search which turned up a useful result was [ uac doesn't work ]. The first search result is a forum thread entitled "UAC doesn't prompt, app does not start". The poster wrote[1], "My problem is that when I run an application such as regedit.exe that would normally result in a UAC elevation prompt, nothing happens: no prompt and no application startup. It's like the command just gets lost. The result is that I can only run regedit by right-clicking and choosing 'Run as administrator'." He later discovered that the Print Audit 4 tracking client caused the problem.
I couldn't find any more info about the Print Audit 4 and UAC problem, even in the Print Audit 4 discussion forum online.
We should check if this bug's symptoms are identical to those of the forum poster's. If so, we should get in touch with the Print Audit 4 developers.
We should research more and try to find examples of other apps with such a problem.
Maybe we should post in some outside forums and ask for help tracking down this bug.
Maybe the best thing to try: We should try disabling certain of Moon Secure's hooks and see which hook causes the problem. We should try to come up with a minimal testcase to cause the problem: an .exe we can run which, while running, the problem happens. We should try to port the testcase to C or C++. If we are still stuck, we should post the testcase source online.
^ [1]. http://www.petri.co.il/forums/showthread.php?t=19877
Please try the new release
Dinger
Thank you for the new release. No, the problem is not solved. According to CVS, the only file which was changed in the new release was psLogUnit.pas -- logfile-writing code -- and so I wouldn't've expected the problem to be solved either. :)