Win10 cursor frequently changes to 'loading' cursor

WARNING: You currently have Javascript disabled!
This website will not function correctly without Javascript enabled.

Logic32

10 discussion posts

Just got a new computer with Win 10 (1709) on it. I have other computers with the same version but I'm pretty sure this one actually has a newer version of DisplayFusion (9.1), I'll need to verify later. Either way, while I have DF running and my cursor in no significant area (e.g. doesn't matter if it's on the desktop or an app, as long as it's not trying to do something like select text) it will periodically change to the loading/spinner cursor. I'd say it does this once a second. Which is quite annoying.

Is there anything I can do to prevent this? What logs do you need me to generate? My troubleshooting page is attached.

• Attachment [protected]: troubleshooting.txt [89,136 bytes]

Dec 7, 2017 • #1

A debug log would be great!

On the DisplayFusion Settings > Troubleshooting tab, change the Logging drop-down to "L1: Log Minimal" and click Apply
Reproduce the issue and note the time so we'll know where to check in the log file
Send us the DisplayFusion.log and DebugInfo.html files (can be found by clicking the Open Log button on the Troubleshooting tab)
Disable debug logging after sending the log

Dec 8, 2017 • #2

Logic32

10 discussion posts

Attached. I only ran it for a couple of seconds. Since I don't have to do anything it was pretty easy to reproduce

• Attachment [protected]: DebugInfoNormal.html [127,141 bytes]

• Attachment [protected]: DisplayFusion.log [133,614 bytes]

Dec 11, 2017 • #3

Thanks! It looks like it might be trying to start the hooks over and over again. To confirm, could you capture the debug log for a bit longer (1 minute should be long enough) and attach it?

Dec 11, 2017 • #4

Logic32

10 discussion posts

Attached.

Turned on, basically didn't move the mouse for about a minute, turned off.

• Attachment [protected]: DisplayFusion.log [228,235 bytes]

Dec 12, 2017 • #5

That definitely looks to be what's happening here. If you look in the Windows Task Manager > Details tab, is DisplayFusionHookApp64.exe listed?

Dec 13, 2017 • #6

Logic32

10 discussion posts

Negative. Only DisplayFusion.exe and DisplayFusionService.exe.

FWIW, I'm an "almost" admin on this computer. I'm not entirely sure what I don't have access to but being a company computer I'm sure there are some GPO rules blocking something from happening as my home computer works just fine (and the computers are nearly identical).

Dec 14, 2017 • #7

Ok, in the Settings > Advanced Settings, if you enable the "Disable Application Hooks" option, does that make the cursor stop changing?

Dec 15, 2017 • #8

Logic32

10 discussion posts

Perfectly! Yes. Now, I can probably live with leaving it this way as I don't use many of the app hook features. However, one thing I do need to work is alt+tab. It currently does not show any of the windows on my second monitor. I'm assuming that makes use of an app hook somewhere? The pop-up warning me about the hooks being disabled didn't indicate as much at least.

Dec 15, 2017 • #9

Was the Alt+Tab working correctly before you disabled the hooks?

Dec 15, 2017 • #10

Logic32

10 discussion posts

Negative. Works fine on my home computer though.

Dec 15, 2017 • #11

Ok, now that we know that the spinning cursor was caused by the hooks trying (but failing) to start, we'll have to figure out how to fix that properly

Could you try backing up your settings (Settings > Options > Export), then do a full uninstall (choose "Yes" when prompted for a complete uninstall that removes all settigns), and re-install fresh? After installing, check to see if the "DisplayFusionHookApp" processes are started correctly. If they are, try restoring your backup.

Let me know how that goes and we'll go from there.

Thanks!

Dec 18, 2017 • #12

Logic32

10 discussion posts

Uninstalled, chose "yes" when asked to purge all options. Reinstalled. As soon as it finished installing the mouse started to do the "loading" thing again. Checked Task Manager and "DisplayFusionHookApp32" is running (not 64?) but mouse is still doing the "loading" thing and alt-tab still doesn't show proper items. Disabling the hooks fixes the mouse.

Attached is another 1 minute-ish log (prior to disabling).

• Attachment [protected]: DisplayFusion.log [286,884 bytes]

Dec 18, 2017 • #13

Ok, thanks! The log still shows the 64 bit hook process trying to start and then closing immediately every couple of seconds. You mentioned that your work computer has some weird permissions on it. Is it using some third-party sandboxing software like Avecto Privilege Guard or something similar?

Dec 19, 2017 • #14

Logic32

10 discussion posts

Looking at my Task Manager "Cb Defense Sensor Service" is the only thing that stood out. I'm more inclined to believe, that at worst, there are just some Active Directory rules that might limit some of my abilities. Outside of that I'm pretty sure I'm a full-admin. Being a software dev, the company likes to give us at least a little freedom

Dec 19, 2017 • #15

Sounds like that Cb Defense is anti-virus called Carbon Black: https://www.carbonblack.com/products/cb-defense/

Is there any way to temporarily disable it to see if it makes any difference?

Dec 20, 2017 • #16

Logic32

10 discussion posts

It's a system process and I'm fairly certain IT hear would not take kindly to me doing that. However, when I re-enable the app hooks I see some activity from RepMgr64.exe (the Cb Defense Sensor Service) so I think it's pretty obvious that it may be blocking it. I attached a log from the AV for reference. It doesn't look like it is explicitly blocking it but unfortunately I don't seem to have access to see much other than this log (and it's entirely possible I missed something in the log..

Before I go working with my IT to reconfigure the AV system, is there anything else we can do on the DisplayFusion side? Like make it compatible with the 'injector' thing the AV seems to be trying to use?

• Attachment [protected]: confer.log [10,756 bytes]

Dec 20, 2017 • #17

Yep, that's definitely the cause. I can see in the log where Carbon Black is terminating the process because it doesn't like something it's doing:

Code
Copy
Select All

12/20/17 13:19:25: 1088     RptApiCall: disposition TERMINATE: hash 0x3a256bb4, name C:\Program Files (x86)\BinaryFortress\DisplayFusion\DisplayFusionHookApp64.exe, pid 12256, args "C:\Program Files (x86)\BinaryFortress\DisplayFusion\DisplayFusionHookApp64.exe" "7828" "789410" "4134162" "660352" "131332" "65860" "a83da093-43c5-4952-8186-8f296ed66aa6" "C:\Program Files (x86)\BinaryFortress\DisplayFusion\Hooks\AppHook64_2F44A6BB-F31F-400E-8715-4EC08A3FC635.dll" "DisplayFusion" "Software\Binary Fortress Software\DisplayFusion" , disp 0x80, interpreted 0, rep 0x40000, eff src AV, eff rep 0x40000, fname SetWindowsHookExW, target name C:\Program Files (x86)\BinaryFortress\DisplayFusion\DisplayFusionHookApp64.exe, target pid 0, target eff src Not Available, target eff rep 0x80000000, policy (0x0, 0x800000, 0x0, 0xc0, 0x0) delay (0, 0, 0x0), mask 0x08d: id 119482
12/20/17 13:19:25: 1088     The application "C:\Program Files (x86)\BinaryFortress\DisplayFusion\DisplayFusionHookApp64.exe" attempted to inject code into the process "C:\Program Files (x86)\BinaryFortress\DisplayFusion\DisplayFusionHookApp64.exe" by calling the function "SetWindowsHookExW". The operation was blocked and the application terminated by Confer

Unfortunately there isn't anything we can do from our end, no. The best solution I can offer is to see if you can get that process added to the ignore list in Carbon Black.

Dec 21, 2017 • #18

Logic32

10 discussion posts

Well shoot! Kk, I'll work with IT on that.

Could the AV cause the alt+tab issue as well? If not, do you want a new thread to look into that?

Dec 21, 2017 (modified Dec 21, 2017) • #19

The Alt+Tab issue would be caused by this for sure. The AppHook64 process needs to be running in order for it to work

Dec 21, 2017 • #20