And since it’s a virtual machine, there are no specific drivers that I could install to get this thing to work. I found something called Virtual Machine Additions in MS VPC, which I assumed would be something similar to VMWare Tools.

The funny thing is that there is no indication of any change, during or after the installation of VM Additions. The sound just would not work.
I had enough of MS VPC, and I decided to do a fresh installation, this time on VMWare. The other major reason for doing this is that I really want a fresh and lean server VM where I can install all the stuff I want; and doing this on the already bloated VHD wasn’t a good idea.
One problem though: I do not have a CD of the Windows 2003 Server; but instead I have the whole setup in the form of a folder hierarchy.

What I needed now is an ISO image of the setup that I can use to boot up my virtual machine. Whats more, I needed a bootable CD. I thought I could do this using Nero 7. Ah, but Murphy’s law: the installation of Nero 7 on my machine is from the CD that came free with my SONY DVD writer, and Nero did not provide me a copy of Nero Burning ROM in the disc. So I could not create a bootable ISO. So I looked for a free software that will serve my purpose. I found CDBurnerXP. I found this to be a neat tool which gave me an option of creating ISO images and bootable discs.

Now, before I could create a bootable ISO, I needed a boot image which I downloaded after performing a google search (don’t remember where I got it from, but there are many available online and links to these are provided by the numerous guides). This boot image that I used was called boot.ima, which was a small file 2 KB in size.
To specify that you want to create a bootable disc, click on disc-> boot options:

Click on “make disc bootable”. Select the path to the boot image. Set the emulation type to none. Keep the Load segment as it is, and set the sector count to 4. Select “Disable ISO version number extension(;1)”, and click OK. Click file -> save compilation as ISO file, and create ISO.
That’s all I needed. I created a new virtual machine with VMware, and made it point to the ISO file I just created so that it could boot up from the ISO.

That’s it; I fired up the VM, and it booted from the ISO. I continued with the OS installation as usual. After that was done, I logged into the OS as admin, and what do I see? The sound doesn’t work. I installed VMWare tools and it showed that audio is enabled, but the OS in my VM was simply not able to play any sounds except for the system sounds. This time I opened device manager and chose the option of automatically installing drivers from Windows updates, and it downloaded the required drivers. After a reboot, when I started the machine again, I heard the sweet sound of windows startup.

I did not even bother to look inside the 2^nd link (which mentioned the skype). I just exited the thing, and my default website started! Then I read a little further and made a small little change in the skype connection settings as shown.

I tried to clean up all files from my USB drive but it won’t let me delete the infected files, which had not replicated itself in each folder in the drive. I started a full system scan and found that there is a file called SSVICHOSST.exe in my system32 folder. This file also tried to access the internet which thankfully my McAfee firewall was able to block.

It all started when I used this same pen drive at a cyber cafe in Matunga to get a print out. When I inserted the stick on my home machine, McAfee said that the autorun.ini file is infected and has been cleaned automatically. I thought that was the end of the story. But somehow the infection had persisted and had spread to my physical machine now. I could not format the pen drive, could not delete the infected file from my comp even though my antivirus did detect the infection. It simply said that it was unable to clean/delete/quarantine the file.

I thought that I would simply deal with the problem later after I get back home and I can simply avoid using Yahoo till the time I fix it. When I got back, I realized that the problem was not just with Yahoo messenger. The rogue files were actually hidden files and the folder options in the tools menu of windows explorer was missing. So there was no way to view hidden files (I always keep this setting to show hidden files). I could not navigate using command line as the command window simply kept disappearing as soon as I open it. Task manager and Regedit won’t open. It kept saying that these have been disabled by the Administrator. Even if I get to the files, I won’t be able to delete it cos’ a rogue process called SSVICHOSST was already running.

At this point there was really something easy that I could have done, but somehow I did it a more geeky way. I first booted into linux and tried to see if I could delete the file, but somehow I had some read/write permission issues, so I just dropped the idea there. I wrote a program in C# to list all the currently running process.

Process[] processes = Process.GetProcesses();foreach (Process process in processes)
{
Console.WriteLine(process.ToString());
if (process.ToString().Contains(“SSVICHOSST”))
{
process.Kill();
}
}

That is what actually showed me that there are multiple instances of a process called SSVICHOSST running on my machine. I could not even view the results of my console application till I actually set a breakpoint and debugged into it. Finally I just added a line of code which would kill the process of the above said name. Thankfully the process got killed.

Once that happened, I was able to open the command window, and my antivirus was able to delete the dirty file. Now I also opened msconfig and saw that the file was set to start at bootup, so I unchecked that option too. I still did not have my taskman, regedit, and folder options. But the infected files I thought were gone.

Booted the comp in safe mode, and logged in as Administrator (which should have been the first thing I should have done). I ran the virus scan again and it caught another instance in another folder. This one was attached to the winlogon.exe. I was able to quarantine it so that it does not launch itself everytime with winlogon. Turned off system restore, installed AVG AntiRootkit utility. I searched for malicious instances in the registry and deleted them. (found one in yahoo messenger, and one in msconfig related keys)

Logged back in normal mode and ran the AntiRootkit utility which found nothing. So finally I think the infection was gone, but the damage still remained. To get regedit working, I opened gpedit.msc -> User Configuration | Administrative Templates | System. There was an option pertaining “disable registry editing tools”. It was set to “Not configured”. Nevertheless I enabled it once, and then set it back to “Not configured”. Doing this ensures that the DisableRegistryTools registry value is removed successfully. Now I could open the registry editor.
Next I navigated to HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies\ System and deleted the DisableTaskMgr key. This got my taskman back.
Finally made another small change in group policy to get back the folder options. The last thing I did was to disable autorun on all drives using TweakUI.

As I write this, my machine is being scanned by the Kaspersky online AV scanner. I hate people who use their programming skills to create malicious software that causes pain and misery to others.

The first question that was raised in my mind is that who will actually use the Safari browser on windows when you have IE7 and FF2? Unless there is some real compelling reason, I dont think a firefox loyalist like me will move on to use Safari. There are a couple of things about Safari that irritate me you see. First of all, it doesn’t support the hotkeys that have been support on IE and Firefox for quite a while.
Type “google” and hit ctrl+ enter on Safari: nothing happens, and you are left with an irritating surprise. There is another kind of URL completion feature on the Safari though. You type a URL, and the browser somehow guesses the .com or .org part of the URL.

The only use I see now is that testing web applications will be easier. Applications that are also targetting the Safari browser can be tested on a windows machine instead of setting up a dedicated Mac machine like we have been doing till now.

By the way, read this post on slashdot which talks about a couple of bugs found on the first day in the windows version of Safari. Oh and one more thing to note: when I checked the plugins installed in the browser by default, look what I found.

Thats the Windows Genuine Advantage plugin bundled right into Safari!

Me: “Ask your friend to turn off windows updates.”

Bro: “What will happen if windows updates is turned off?”

Me: “Nothing!”

Yup, if you want nothing to happen, then turn off your windows updates. I am no supporter of piracy, but I feel that the cost of a genuine copy of Windows XP is a little too high in India.

The problem with most Indian users is that they don’t know whether their copy of windows is genuine or not. Most of them have their windows updates ON by default. This went fine till the time Microsoft decided to push the WGA (Windows Genuine Advantage) notifier through the windows updates service. This is when the notifier got installed on user PCs and it started pestering people saying that their copy of windows is not genuine. Well, the ideal thing to do when you find out that your copy is not genuine is to click on the Get Genuine button and get a licensed version. But that doesnt seem to be a viable option for poor people who cannot afford one . Well, the good thing is that Microsoft doesn’t do much more than just inform the user of the status of his/her operating system, i.e. genuine, non-genuine etc. This doesnt cause you much more trouble than the occassional irritation of looking at the notifier popup (which can also be avoided using some hacks). Thankfully Microsoft isn’t taking legal action against the erring users (as yet). So the situation is fine for now.

Consider this: The windows xp service pack 3 is underway. It will be available in a couple of months. Now imagine what happens if the WGA notifier is integrated inside the service pack 3? All users who install SP3, get the pesky notifier on every boot up (unless you work around it). This move will not be unanticipated since Microsoft already has GenuineCheck.dll integrated with most of its downloads.

So basically the users need to be aware that they are using pirated operating systems, and that windows updates and the service packs are not meant for them.

Where did I get this idea of WGA notifier integrated with SP3? Dont ask me.