bug file locked SCHook.dll after winvnc -uninstall

[redge]

Hi there,

After uninstalling the VNC service ('winvnc.exe -uninstall'), it can take ages before I can delete 'SCHook.dll'.

Most PCs take around 10 seconds, some take a few minutes & a few require a reboot.

This is long after 'uvnc_service' has disappeared from Computer Management & 'winvnc.exe' has disappeared from the Task Manager.

I can't use 'regsvr32' to unregister the dll either.

Any help much appreciated. This is driving me mad!

Moderated by redge at 2010-01-10 13:37:

modified title \"Deleting SCHook.dll\" by \"bug file locked SCHook.dll after winvnc -uninstall\"

[JohnMC]

im having this same issue, i used proccess explorer and search for schook.dll and found that it was hooked into ituneshelper.exe and pidgin.exe... the im client thing makes me wonder what the hell this thing is doing?

and this might be a little retarded, but from a technical standpoint what is schook.dll for? i thought it was related to screen polling but im starting to think im wrong

[supercoe]

Does anyone know of a workaround for this issue?
Still exists in 1.0.8.2

[Bonji]

I also have this problem. It only occurs after a connection has been made to the computer via VNC, however it does not always happen when a connection is made via VNC.

Rebooting the computer is the only way I can free up the file to be able to delete it. This is most problematic with servers obviously. It makes upgrading VNC very difficult.

[Robin]

I also have this problem. It only occurs after a connection has been made to the computer via VNC, however it does not always happen when a connection is made via VNC.

Rebooting the computer is the only way I can free up the file to be able to delete it. This is most problematic with servers obviously. It makes upgrading VNC very difficult.

matter of interrest...what is the actual reason behind SCHook.dll?

[supercoe]

matter of interrest...what is the actual reason behind SCHook.dll?

Not quite sure what the differences are but in my experience (especially with vista and 1.0.6.4) schook.dll gave me better / more accurate screen updates than vnchooks.dll.

[supercoe]

How important is vnchooks.dll?

If vnchooks.dll does not exist, it is not used.

What does it:
The hookdll inform vnc about screen changes...
rectangle changed at (x,y,w,h)

Without hookdll, the only method to find changes is to poll the full screen.
(cpu up)
Using the hookdll, you don't have to set full screen polling, keeping a lower cpu.

Do both hook dll's do the same thing and schook.dll is just a smaller file size?

After doing some testing today with both dll's (using one at a time) it would randomly not allow me to delete the file after killing the server.
So the issue seems to be with both schook.dll and vnchooks.dll

[redge]

if related to bug winvnc -kill with securevncplugin
i think the server won't have time to close properly the winvnc and any file in use like vnchooks.dll or schook.dll

[supercoe]

Redge,

I've been having this issue in my testing using MSRC4Plugin_NoReg.dsm which seems to handle -kill correctly.

[redge]

supercoe


do you have any special software, because you tell me is not happen sometime !
Can you verify whish case this vnchooks.dll is file locked ?
while connection broken ?
while remote use replacement of explorer like wincustomize, windowsblinds ?
etc...
we need to isolate and reproduce the problem, i know sometime is very difficult for find where is the lockup.

after, we hope any available developer can check this bug.

[supercoe]

Redge,

It happens to me randomly which is why I haven't been able to pinpoint the issue yet.
It's done the same thing on Windows 7, Vista and XP, even on completly fresh installs with nothing but UltraVNC.

I'll surely keep you posted on what I find but basically I'll be connected to the server, the server gets "-kill", batch file deletes all winvnc files except hook.dll.

I've never really paid that much attention to it because it happens to me rarely.

[redge]

supercoe

did you see any log entry at eventvwr.exe for the locked file or with sysinternals tools filemon.exe ?
that could help little bit.

[supercoe]

Redge,

I don't see anything in my windows logs, I'll run Filemon the next time it happens to get more info.

[supercoe]

I can reliably get the schook.dll file locked by doing this:

1) Vista 32bit running server 1.0.8.2 as service with MSRC4 plugin. (ChunkVNC InstantSupport)
2) Connect viewer and logout to welcome screen. (viewer closes)
3) Reconnect viewer and login.
4) Kill the server. "winvnc.exe -kill"

After doing this the hook DLL file will be locked until I logout and login again.

Does the same for me with vnchooks.dll and schook.dll.

[redge]

supercoe

sorry, sysinternals Process Monitor (procmon.exe) replace File Monitor (filemon.exe)

command line
c:\>winvnc -kill
success only if there no service_commandline at ultravnc.ini
so your test is'nt possible or i miss something ?

right click winvnc systray left click Kill All client OK

could you try to replace your msrc4plugin 1.2.2.0 by 1.2.4.0
for see if the msrc4plugin could block some file while exit InstantSupport

[supercoe]

Redge,

Sorry I messed up, I used the command line "winvnc.exe -uninstall" not "winvnc.exe -kill".

Same problem with MSRC4 1.2.4.0

Procmon isn't showing me any info about schook.dll when it's locked.

To clarify:
1) Setup server as service to autoreconnect to a repeater.
2) Connect viewer.
3) Log out to the windows welcome screen (viewer closes when I do this)
4) Connect viewer again.
5) Log into windows account.
6) Uninstall service "winvnc.exe -uninstall"
7) Try to delete schook.dll

[redge]

supercoe

bug file locked SCHook.dll or vnchook.dll confirmed after winvnc -uninstall run as administrator



requirements:

[poll]
TurboMode=1
PollUnderCursor=0
PollForeground=1
PollFullScreen=1
OnlyPollConsole=0
OnlyPollOnEvent=0
EnableDriver=0
EnableHook=1

and

vnc authentication
no repeater
no dsmplugin
winvnc service system + service_commandline + reverse connection
vncviewer -listen


steps

1. winvnc reverse connected to vncviewer
2. log off (remote)
3. log on (remote)
4. winvnc reverse connected to vncviewer
5. winvnc -uninstall (viewer connected to winvnc)

this explain why many users report upgrade fail if ultravnc server running.
even after reboot, the file SCHook.dll still locked
a true upgrade do not need any restart of windows if process uninstall/install is correct.

this part fail and need fix
winvnc -uninstall must unload any used file like SCHook.dll and vnchooks.dll before remove uvnc_service.

[redge]

If you are using 1.8.2 an select Lock Workstation when last Client disconnects, you can't Shutdown your System from the Windows desktop. The Lock Workstation command is executed after and stops shutdown.

supercoe
source of the schook.dll locked file ?
we must waiting winvnc compiled for check

[supercoe]

redge,

I was testing today with pgmoney's new compile:
http://www.advantig.com/files/winvnc_32_uac_fix.zip

Now the schook.dll will be locked if the server is sent "-kill" while a viewer is connected.

If the viewer is closed first the file is never locked.

I'm testing while using the repeater.

[Bonji]

I'm not sure if this helps, but here's some more information I have with this problem:

I needed to upgrade VNC on a server and once again the SCHook.dll file could not be deleted because it was in use. Rebooting this server is not an option, so I had to come up with something.

I downloaded a program called Unlocker that claims it will remove all file locks. Once installed it showed me all the programs with locks on it, but it couldn't actually remove the locks. However, knowing what was locking it enabled me to manually terminate the processes to free up the file. Four of the programs using it were applications started in the context of the user logged onto the console. The remaining application using it was a service that starts automatically.

None of these applications would use this DLL normally, and like I said I have no clue if this provides any insight to the problem. But at least I was finally able to free up the file so I could replace it.

[pgmoney]

Now the schook.dll will be locked if the server is sent "-kill" while a viewer is connected.

If the viewer is closed first the file is never locked.

I'll see what I can do to fix that.

[pgmoney]

Now the schook.dll will be locked if the server is sent "-kill" while a viewer is connected.

If the viewer is closed first the file is never locked.

Exe updated with patch, see if this one helps.

http://www.advantig.com/files/winvnc_32_uac_fix.zip

[supercoe]

pgmoney,

Thanks for the update but the issue still remains.
Let me be more specific what is happening.

Here are the OS's I'm testing with: ( others report this issue on XP aswell )
Windows 7 32bit running the viewer.
Windows Vista 32bit running the server.


1) Server makes reverse connection to the repeater.
2) Viewer connects to repeater.
3) "winvnc.exe -kill" is executed.

If the viewer is connected while the server is sent "-kill" via command line the schook.dll is locked.

If the viewer is closed, then "-kill" is sent to the server schook.dll isn't locked.

If the viewer is connected to the server installed as a service and you logout to the welcome screen the file is locked after login.



Thanks for your help. Let me know if I can explain it better.

[pgmoney]

pgmoney,

Thanks for the update but the issue still remains.
Let me be more specific what is happening.

Here are the OS's I'm testing with: ( others report this issue on XP aswell )
Windows 7 32bit running the viewer.
Windows Vista 32bit running the server.


1) Server makes reverse connection to the repeater.
2) Viewer connects to repeater.
3) "winvnc.exe -kill" is executed.

If the viewer is connected while the server is sent "-kill" via command line the schook.dll is locked.

If the viewer is closed, then "-kill" is sent to the server schook.dll isn't locked.

If the viewer is connected to the server installed as a service and you logout to the welcome screen the file is locked after login.



Thanks for your help. Let me know if I can explain it better.

Thanks, Was trying to force an usethooks after killing user and before shutting down. guess i need to dig deeper. I'll get it setup on a win7 32 system so i can duplicate it.

[redge]

solution for locked file schook has been finally found ?

if not found
i have another idea based on discovery of Rudi today.
the file have a extra bit security file source downloaded internet file.

remove this extra bit should solve the issue ?

[simy202]

I just encountered the same problem, , i used proccess explorer and search for schook.dll and found that it was hooked into ituneshelper.exe and pidgin.exe... the im client thing makes me wonder what the hell this thing is doing?

Thanks for any help

Wallace

[Rudi De Vos]

The goal of an hook is indeed to hook all running applications and monitor the window message.
movewindow, menu, etc
The hook then report the position of the window element so vnc can proper capture the screen data.

If winvnc isn't proper closed, the hook keeps running.
killing winvnc doesn't close the hook, this is only done when the viewer disconnect.

[chullos]

I also have this problem, this problem begins after a connection has been made to the computer via VNC, although it is not all the times. The only way to release the file and delete it is restarting the computer.

[ceq]

I thing...I have this problem too, when make a connection to the computer via VNC. Then go to restart my computer.

[ahqaf]

i have also this problem when already connection to the computer ready with VNC. then go to command restart my computer.......