Running the "Jack" as the UTSCSI service

magicJack Tips and Tricks

Moderators: Pilot, Bill Smith

Post Reply
mufon
Dan isn't smart enough to hire me
Posts: 296
Joined: Fri Jan 25, 2008 9:50 am
Location: HIghland Village, Texas
Contact:

Running the "Jack" as the UTSCSI service

Post by mufon »

This is a spin on running the MJ as a service. Instead of creating a new service to run MJ, we use the already installed UTSCSI, assuming of course that you don't care to have UTSCSI running on your machine.

I will assume you are up to speed on installing MJ as a service.

Open the registry editor, and then open "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UTSCSI"

Create a new key and name it "Parameters". Now open key "Parameters" and add the string value "Application". Sound familiar? The string value is the fully qualified path to the binary you wish to launch. Existing MJ service, if installed should be disabled.

Now, change the log on value for the service from the system account to the user account you wish to run MJ under. Delete "UTSCSI.EXE" from "x:\WINDOWS\System32" and replace it with "srvany.exe" and renamed to "UTSCSI.EXE"

So where I am going with this? You could also use this instead to launch a spoofing script/exe or anything else you desire.
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
testing123
Dan Should Pay Me
Posts: 703
Joined: Tue Nov 13, 2007 2:36 pm
Contact:

Re: Running the "Jack" as the UTSCSI service

Post by testing123 »

mufon wrote:This is a spin on running the MJ as a service. Instead of creating a new service to run MJ, we use the already installed UTSCSI, assuming of course that you don't care to have UTSCSI running on your machine.

I will assume you are up to speed on installing MJ as a service.

Open the registry editor, and then open "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UTSCSI"

Create a new key and name it "Parameters". Now open key "Parameters" and add the string value "Application". Sound familiar? The string value is the fully qualified path to the binary you wish to launch. Existing MJ service, if installed should be disabled.

Now, change the log on value for the service from the system account to the user account you wish to run MJ under. Delete "UTSCSI.EXE" from "x:\WINDOWS\System32" and replace it with "srvany.exe" and renamed to "UTSCSI.EXE"

So where I am going with this? You could also use this instead to launch a spoofing script/exe or anything else you desire.
Interesting technique -- kills two birds w/ one stone: gets rid of UTSCI & sets up the service.

Not bad ... newbie ... :lol:
HolmanGT
MagicJack Sensei
Posts: 1127
Joined: Tue Jan 08, 2008 7:13 am
Location: Saint George, UT

Post by HolmanGT »

mufon,

Ya-But !

Anything I change in my MJ setup sooner or later (mostly sooner) gets overwritten by MagicJack. I don't exactly know what goes on with MJ but I think it tends to overwrite everything in an effort to keep the resident code portable and fresh/updated.

By that I mean if you come in behind someone that has already rung MJ on that machine it rebuilds everything from the ground up. I had deleted everything pertaining to UTSCI.EXE including the file itself and per it's name Magically the whole damn thing reappeared.

It is actually a good feature unless you want to do something a little different than MJ wants you to do. Sneaky little sucker!

PS - I just had to add this little tid-bit, your can format you magicJack and magically that will all reappear also, you can't even kill it. It has to be the first toy I have ever owned that I can't even break. And by the way I am a master at breaking stuff.
- George -

HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
User avatar
SpamBox
Dan isn't smart enough to hire me
Posts: 417
Joined: Fri Dec 14, 2007 4:31 am
Location: Rocky Mountains Front Range

Re: Running the "Jack" as the UTSCSI service

Post by SpamBox »

mufon wrote:We are currently accepting donated aluminum foil to help alleviate the shortage in Stephenville Texas.
At first I was like "What the...?"
But just read about the UFO sighting! That's crazy!
And your sig is funny! :lol:
User avatar
laserjobs
Dan Should Pay Me
Posts: 670
Joined: Mon Nov 12, 2007 4:11 pm

Post by laserjobs »

Change UTSCSI to read-only
HolmanGT
MagicJack Sensei
Posts: 1127
Joined: Tue Jan 08, 2008 7:13 am
Location: Saint George, UT

Post by HolmanGT »

laserjobs,

I am embarrassed that I didn't think of that. :oops: Have you tried it, read only? The reason I ask is if there is one think that MJ does very well it is rebuild itself and thwart any attempts I have made to fool it (but I haven't tried read only - YET).


[Edit] Does anyone know what UTSCSI is. I searched it and about the best answer I could find is some flash drive installs it but no one seem to know why or what it does. I assume that some portion of the MJ drive installs it, but I know MJ will run just fine without it or at least until it reinstall it - whatever the hell "IT" is.
- George -

HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
kumar
Dan Should Pay Me
Posts: 806
Joined: Thu Nov 15, 2007 4:29 pm
Contact:

Post by kumar »

What does it mean to run it as a UTSCSI. What are the pluses?
Thanks
Kumar
Will not be on forum until after June 15th.
HolmanGT
MagicJack Sensei
Posts: 1127
Joined: Tue Jan 08, 2008 7:13 am
Location: Saint George, UT

Post by HolmanGT »

kumar,

And in addition to your question what happens if you don't run UTSCSI because you have a fake running?

So many questions and so many phone calls to make before someone wises up to the fact that MagicJack is giving away free long distance phone calls and goes after them with a vengeance, someone like AT&T who makes a lot of money SELLING the same service.
- George -

HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
kumar
Dan Should Pay Me
Posts: 806
Joined: Thu Nov 15, 2007 4:29 pm
Contact:

Post by kumar »

HolmanGT wrote:kumar,

And in addition to your question what happens if you don't run UTSCSI because you have a fake running?

So many questions and so many phone calls to make before someone wises up to the fact that MagicJack is giving away free long distance phone calls and goes after them with a vengeance, someone like AT&T who makes a lot of money SELLING the same service.
But what is UTSCSI?
Kumar
Will not be on forum until after June 15th.
HolmanGT
MagicJack Sensei
Posts: 1127
Joined: Tue Jan 08, 2008 7:13 am
Location: Saint George, UT

Post by HolmanGT »

kumar,

I Googled that program until I was numb reading people say "beats the hell out of us". I could not find any article that claimed to know what it is only some claims that it is installed by some flash drives.
- George -

HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
User avatar
laserjobs
Dan Should Pay Me
Posts: 670
Joined: Mon Nov 12, 2007 4:11 pm

Post by laserjobs »

You don't need UTSCSI running but since MJ installs it, mufon pointed out why not use it to run MJ as a service. Thanks mufon!!!
mufon
Dan isn't smart enough to hire me
Posts: 296
Joined: Fri Jan 25, 2008 9:50 am
Location: HIghland Village, Texas
Contact:

Post by mufon »

UTSCSI is a rootkit. It runs in a highly privileged account. In and of itself, it does nothing. It allows unprivileged accounts to execute procedures through it. Its like an invisible administrator sitting at your console doing what ever you ask it to do. You can tame your MJ by disabling it.
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
LikeMagic
Dan Should Pay Me
Posts: 613
Joined: Tue Jan 01, 2008 9:11 pm
Location: LikeMagic Pacific NW

Post by LikeMagic »

mufon wrote:UTSCSI is a rootkit. It runs in a highly privileged account. In and of itself, it does nothing. It allows unprivileged accounts to execute procedures through it. Its like an invisible administrator sitting at your console doing what ever you ask it to do. You can tame your MJ by disabling it.
Where did you find the info for UTSCSI? That's very fascinating. This could open the door to all kinds of hack attack :)

So why does MagicJack need the UTSCSI service?
mufon
Dan isn't smart enough to hire me
Posts: 296
Joined: Fri Jan 25, 2008 9:50 am
Location: HIghland Village, Texas
Contact:

Post by mufon »

LikeMagic wrote:
mufon wrote:UTSCSI is a rootkit. It runs in a highly privileged account. In and of itself, it does nothing. It allows unprivileged accounts to execute procedures through it. Its like an invisible administrator sitting at your console doing what ever you ask it to do. You can tame your MJ by disabling it.
Where did you find the info for UTSCSI? That's very fascinating. This could open the door to all kinds of hack attack :)

So why does MagicJack need the UTSCSI service?
It does three things for magicJack. It lets them get by with writing crappy insecure code. It minimizes their need to support their product. It let's them do whatever else they want, since they have they ability to use your computer. It is actually a powerful little devil as it appears it can use a scsi channel to run as a device driver thereby "flying under the radar" and bypassing any auditing since a scsi channel is unmonitored as far as data passage, hence the reason no one seems to know what it does. Suffice to say, it is a rootkit, and a very effective one at that.

Sony tried this a couple of years ago, and it made headlines.
Last edited by mufon on Wed Jan 30, 2008 12:00 am, edited 1 time in total.
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
LikeMagic
Dan Should Pay Me
Posts: 613
Joined: Tue Jan 01, 2008 9:11 pm
Location: LikeMagic Pacific NW

Post by LikeMagic »

But MagicJack can function without UTSCSI service. What are we missing if UTSCSI service is disabled?
testing123
Dan Should Pay Me
Posts: 703
Joined: Tue Nov 13, 2007 2:36 pm
Contact:

Post by testing123 »

Now THIS is a thread that needs to be STICKIED ... (twilight zone music playing in the background).
Very interesting mufon
mufon wrote:
LikeMagic wrote:
mufon wrote:UTSCSI is a rootkit. It runs in a highly privileged account. In and of itself, it does nothing. It allows unprivileged accounts to execute procedures through it. Its like an invisible administrator sitting at your console doing what ever you ask it to do. You can tame your MJ by disabling it.
Where did you find the info for UTSCSI? That's very fascinating. This could open the door to all kinds of hack attack :)

So why does MagicJack need the UTSCSI service?
It does three things for magicJack. It lets them get by with writing crappy insecure code. It minimizes their need to support their product. It let's them do whatever else they want, since they have they ability to use your computer. It is actually a powerful little devil as it appears it can use a scsi channel to run as a device driver thereby "flying under the radar" and bypassing any auditing, the reason no one seems to know what it does. Suffice to say, it is a rootkit, and a very effective one at that.

Sony tried this a couple of years ago, and it made headlines.
mufon
Dan isn't smart enough to hire me
Posts: 296
Joined: Fri Jan 25, 2008 9:50 am
Location: HIghland Village, Texas
Contact:

Post by mufon »

LikeMagic wrote:But MagicJack can function without UTSCSI service. What are we missing if UTSCSI service is disabled?
I am not missing a thing
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
scook587
magicJack Apprentice
Posts: 22
Joined: Thu Jan 03, 2008 4:19 pm
Location: Covington, Ga.

Post by scook587 »

utscsi is what i have to kill in order to speed up my cd burner on my circa 1999 hardware running xp pro.
LikeMagic
Dan Should Pay Me
Posts: 613
Joined: Tue Jan 01, 2008 9:11 pm
Location: LikeMagic Pacific NW

Post by LikeMagic »

mufon wrote:
LikeMagic wrote:But MagicJack can function without UTSCSI service. What are we missing if UTSCSI service is disabled?
I am not missing a thing
Neither am I. I disabled UTSCSI service and my MJ service is still kicking butt :)
scook587
magicJack Apprentice
Posts: 22
Joined: Thu Jan 03, 2008 4:19 pm
Location: Covington, Ga.

Post by scook587 »

how do you disable vs. kill utscsi.
mufon
Dan isn't smart enough to hire me
Posts: 296
Joined: Fri Jan 25, 2008 9:50 am
Location: HIghland Village, Texas
Contact:

Post by mufon »

scook587 wrote:utscsi is what i have to kill in order to speed up my cd burner on my circa 1999 hardware running xp pro.
This is not suprising, the UTSCSI service generates a buttload of useless interrupts.
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
LikeMagic
Dan Should Pay Me
Posts: 613
Joined: Tue Jan 01, 2008 9:11 pm
Location: LikeMagic Pacific NW

Post by LikeMagic »

scook587 wrote:how do you disable vs. kill utscsi.
- Right-Click "My Computer", select "Manage"
- Click on "+" sign of "Service and Application" to see sub list
- Click on "Services", a list of all Windows services will be displayed on the right windows
- Locate service called CLCV0 and double click on it
- Properties of CLCV0 will be opened,
- Click "Stop", wait for service to be stopped
- then in "Startup type", select "Disable" then press OK
mufon
Dan isn't smart enough to hire me
Posts: 296
Joined: Fri Jan 25, 2008 9:50 am
Location: HIghland Village, Texas
Contact:

Post by mufon »

LikeMagic wrote:
scook587 wrote:how do you disable vs. kill utscsi.
- Right-Click "My Computer", select "Manage"
- Click on "+" sign of "Service and Application" to see sub list
- Click on "Services", a list of all Windows services will be displayed on the right windows
- Locate service called CLCV0 and double click on it
- Properties of CLCV0 will be opened,
- Click "Stop", wait for service to be stopped
- then in "Startup type", select "Disable" then press OK
You will also need to edit the registry and dissallow "change value" and "delete" permissions on the appropriate key, else it will re-enable itself just like a virus or rootkit can.
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
scook587
magicJack Apprentice
Posts: 22
Joined: Thu Jan 03, 2008 4:19 pm
Location: Covington, Ga.

Post by scook587 »

so are you saying it would restart after a boot?
are there any possible negative effects with it disabled?
mufon
Dan isn't smart enough to hire me
Posts: 296
Joined: Fri Jan 25, 2008 9:50 am
Location: HIghland Village, Texas
Contact:

Post by mufon »

scook587 wrote:so are you saying it would restart after a boot?
are there any possible negative effects with it disabled?
It depends on what you call negative. If you are running in a reduced-privelage account, as we all know we should do, then you may need to tweak some permissions. UTSCSI eliminates the need, because it allows MJ software to run highly privileged regardless of the assigned user account. There are many benefits to running without UTSCSI, I won't elaborate now, but it has to do with running software the way you want to run it. On the other hand, if you think running a rootkit is a good thing and you trust Dan and the boyz...
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
scook587
magicJack Apprentice
Posts: 22
Joined: Thu Jan 03, 2008 4:19 pm
Location: Covington, Ga.

Post by scook587 »

very interesting, i only have one user account (mine). thanks for the info.
msjfb
MagicJack Newbie
Posts: 3
Joined: Mon Feb 04, 2008 6:58 pm

Post by msjfb »

mufon wrote:
LikeMagic wrote:
scook587 wrote:how do you disable vs. kill utscsi.
- Right-Click "My Computer", select "Manage"
- Click on "+" sign of "Service and Application" to see sub list
- Click on "Services", a list of all Windows services will be displayed on the right windows
- Locate service called CLCV0 and double click on it
- Properties of CLCV0 will be opened,
- Click "Stop", wait for service to be stopped
- then in "Startup type", select "Disable" then press OK
You will also need to edit the registry and dissallow "change value" and "delete" permissions on the appropriate key, else it will re-enable itself just like a virus or rootkit can.
Could you elaborate on which keys (There aer about 6-7 entries for UTSCSI), and what users should be limited in their permissions?
I have MJ running on a server, and I do not like this rootkit business. I have disabled the Service, but I would like to have it stay like that, even if the Server is rebooted, or if MJ re-installs itself.

Thanks
XD45
magicJack Apprentice
Posts: 13
Joined: Thu Feb 07, 2008 6:49 am

Re: Running the "Jack" as the UTSCSI service

Post by XD45 »

SpamBox wrote:
mufon wrote:We are currently accepting donated aluminum foil to help alleviate the shortage in Stephenville Texas.
At first I was like "What the...?"
But just read about the UFO sighting! That's crazy!
And your sig is funny! :lol:
hence, mufon's username! ;)
MUFON
Post Reply