Windows 7 Remote Desktop Keeps Reappearing

jackbn · 28 Apr 2013

Using Norton 360 with Windows 7 for a long time, with no obvious problems.

Recently, however, Remote Desktop shows up when I clean files with CCleaner. This is apparently unrelated to a particular website.

Norton 360 is fully enabled.
Norton 360 controls the Windows 7 firewall.
Remote Desktop is disabled via Control Panel.
File sharing is disabled.

Remote Desktop still often appears in a CCleaner list of deleted files.
This occurs with Firefox or Chrome; haven't tried IE.

I have gone to Control Panel, Administrative Tools, Computer Management, Services and Applications, Services

There I have disabled Remote Desktop on three sequential places. HOWEVER something is resetting at least one of these.

I see no evidence on-screen of Remote Desktop, but wonder whether someone is accessing my computer.

What is going on, and how to stop it?

UsernameIssues · 30 Apr 2013

Please post a screenshot of the CCleaner entry (entries?) that shows the remote desktop files. Adjust the windows size and the columns to show as much info as you can. Just press the Analyze button and not the Run Cleaner button.

Screenshots and Files - Upload and Post in Seven Forums

Also, please show a screenshot of the three services that you have disabled.

Ztruker · 30 Apr 2013

If someone connected to your computer via RDT then it would be sitting at the login screen when you returned. Of course that doesn't help if that's where it is normally when you go to use it the next time.

jackbn · 30 Apr 2013

Thanks for your interest.
Here is CCleaner, main screen, and details on Remote Desktop item.

jackbn · 30 Apr 2013

And here is one of the Remote Desktop settings.
I had set it to disabled hours ago, but this is how it looks now, just after running the CCleaner I posted.

The other three items I have been setting are immediatelly above the window. The window is for the middle one. The other two remain disabled, but Remote Desktop just ran minutes ago anyway.

UsernameIssues · 01 May 2013

@jackbn,
Thanks for the screenshots.
When the Remote Desktop Services server service is disabled or not running, that should prevent incoming connections to your computer.

The cache file in your screenshot is created by Remote Desktop Connection (RDC). RDC is used to make outgoing connections that let you control another computer. The time stamp on the cache file should reflect the time that the RDC session ended.

RDC is Microsoft's client application. Remote Desktop Protocol (RDP) is the method that RDC uses to connect to and control another computer. There are browser based apps that use RDP to get stuff too... I just don't know if they use the cache folder that CCleaner is showing you.

If an outgoing RDC connection was established, then there should be a log entry. Look in the Windows Event Viewer > Security log. Event ID 4634 (RDC disconnect) should have a time stamp that roughly correlates to the time stamp on the cache file that CCleaner is showing you. (Use the find/search feature to search for 4634.)

Event ID 4648 (RDC connect) should have info about the RDC connection... we just don't know how long the outbound RDC session was, so we don't know how far back in the log to look. So use the search feature.

We will deal with the Remote Desktop Services that you disable and someone or something sets to manual after you let us know what you learned from the Windows Event logs.

UsernameIssues · 01 May 2013

Ztruker said:

If someone connected to your computer via RDT then it would be sitting at the login screen when you returned. Of course that doesn't help if that's where it is normally when you go to use it the next time.

There is a way to disconnect and unlock the remote computer:

Code:

tscon.exe 1 /dest:console

Sorry about the bad video quality. It really does not like the VMs at those screen resolutions.

Edit: I've replaced the video with a better one - still a bit fuzzy.
For those that might not know:
click on play
select the gear to change the resolution to 720P
click on full screen

Windows 7 Remote Desktop Keeps Reappearing-vid-info.png

Kari · 01 May 2013

I noticed from OP's specs he is using Windows 7 Professional which makes him eligible for Windows XP Mode.

Using the XP Mode or any other Microsoft Virtual PC vm is done over RDP connection, in other words if you run XP Mode you need RDP.

Kari

Ztruker · 01 May 2013

Can you describe it in words? I can't follow the video, it's to small.

UsernameIssues · 01 May 2013

Ztruker said:

Can you describe it in words? I can't follow the video, it's to small.

Even at 480p and full screened it does looks pretty bad:-(

While you are connected, the remote screen will be locked (per the norm). But if you disconnect from the RDC session using this line in a batch file...

Code:

tscon.exe 1 /dest:console

...then the remote computer should unlock.

The batch file must be run as admin and the number 1 might be another number if there are more than one person logged on to the remote computer (switch user). Task manager can show you the session that you are disconnecting from by adding the Session ID column to the Processes tab.