Running the "Jack" as the UTSCSI service
Moderators: Pilot, Bill Smith
-
- Dan isn't smart enough to hire me
- Posts: 296
- Joined: Fri Jan 25, 2008 9:50 am
- Location: HIghland Village, Texas
- Contact:
Running the "Jack" as the UTSCSI service
This is a spin on running the MJ as a service. Instead of creating a new service to run MJ, we use the already installed UTSCSI, assuming of course that you don't care to have UTSCSI running on your machine.
I will assume you are up to speed on installing MJ as a service.
Open the registry editor, and then open "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UTSCSI"
Create a new key and name it "Parameters". Now open key "Parameters" and add the string value "Application". Sound familiar? The string value is the fully qualified path to the binary you wish to launch. Existing MJ service, if installed should be disabled.
Now, change the log on value for the service from the system account to the user account you wish to run MJ under. Delete "UTSCSI.EXE" from "x:\WINDOWS\System32" and replace it with "srvany.exe" and renamed to "UTSCSI.EXE"
So where I am going with this? You could also use this instead to launch a spoofing script/exe or anything else you desire.
I will assume you are up to speed on installing MJ as a service.
Open the registry editor, and then open "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UTSCSI"
Create a new key and name it "Parameters". Now open key "Parameters" and add the string value "Application". Sound familiar? The string value is the fully qualified path to the binary you wish to launch. Existing MJ service, if installed should be disabled.
Now, change the log on value for the service from the system account to the user account you wish to run MJ under. Delete "UTSCSI.EXE" from "x:\WINDOWS\System32" and replace it with "srvany.exe" and renamed to "UTSCSI.EXE"
So where I am going with this? You could also use this instead to launch a spoofing script/exe or anything else you desire.
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
-
- Dan Should Pay Me
- Posts: 703
- Joined: Tue Nov 13, 2007 2:36 pm
- Contact:
Re: Running the "Jack" as the UTSCSI service
Interesting technique -- kills two birds w/ one stone: gets rid of UTSCI & sets up the service.mufon wrote:This is a spin on running the MJ as a service. Instead of creating a new service to run MJ, we use the already installed UTSCSI, assuming of course that you don't care to have UTSCSI running on your machine.
I will assume you are up to speed on installing MJ as a service.
Open the registry editor, and then open "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UTSCSI"
Create a new key and name it "Parameters". Now open key "Parameters" and add the string value "Application". Sound familiar? The string value is the fully qualified path to the binary you wish to launch. Existing MJ service, if installed should be disabled.
Now, change the log on value for the service from the system account to the user account you wish to run MJ under. Delete "UTSCSI.EXE" from "x:\WINDOWS\System32" and replace it with "srvany.exe" and renamed to "UTSCSI.EXE"
So where I am going with this? You could also use this instead to launch a spoofing script/exe or anything else you desire.
Not bad ... newbie ...
mufon,
Ya-But !
Anything I change in my MJ setup sooner or later (mostly sooner) gets overwritten by MagicJack. I don't exactly know what goes on with MJ but I think it tends to overwrite everything in an effort to keep the resident code portable and fresh/updated.
By that I mean if you come in behind someone that has already rung MJ on that machine it rebuilds everything from the ground up. I had deleted everything pertaining to UTSCI.EXE including the file itself and per it's name Magically the whole damn thing reappeared.
It is actually a good feature unless you want to do something a little different than MJ wants you to do. Sneaky little sucker!
PS - I just had to add this little tid-bit, your can format you magicJack and magically that will all reappear also, you can't even kill it. It has to be the first toy I have ever owned that I can't even break. And by the way I am a master at breaking stuff.
Ya-But !
Anything I change in my MJ setup sooner or later (mostly sooner) gets overwritten by MagicJack. I don't exactly know what goes on with MJ but I think it tends to overwrite everything in an effort to keep the resident code portable and fresh/updated.
By that I mean if you come in behind someone that has already rung MJ on that machine it rebuilds everything from the ground up. I had deleted everything pertaining to UTSCI.EXE including the file itself and per it's name Magically the whole damn thing reappeared.
It is actually a good feature unless you want to do something a little different than MJ wants you to do. Sneaky little sucker!
PS - I just had to add this little tid-bit, your can format you magicJack and magically that will all reappear also, you can't even kill it. It has to be the first toy I have ever owned that I can't even break. And by the way I am a master at breaking stuff.
- George -
HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
- SpamBox
- Dan isn't smart enough to hire me
- Posts: 417
- Joined: Fri Dec 14, 2007 4:31 am
- Location: Rocky Mountains Front Range
Re: Running the "Jack" as the UTSCSI service
At first I was like "What the...?"mufon wrote:We are currently accepting donated aluminum foil to help alleviate the shortage in Stephenville Texas.
But just read about the UFO sighting! That's crazy!
And your sig is funny!
laserjobs,
I am embarrassed that I didn't think of that. Have you tried it, read only? The reason I ask is if there is one think that MJ does very well it is rebuild itself and thwart any attempts I have made to fool it (but I haven't tried read only - YET).
[Edit] Does anyone know what UTSCSI is. I searched it and about the best answer I could find is some flash drive installs it but no one seem to know why or what it does. I assume that some portion of the MJ drive installs it, but I know MJ will run just fine without it or at least until it reinstall it - whatever the hell "IT" is.
I am embarrassed that I didn't think of that. Have you tried it, read only? The reason I ask is if there is one think that MJ does very well it is rebuild itself and thwart any attempts I have made to fool it (but I haven't tried read only - YET).
[Edit] Does anyone know what UTSCSI is. I searched it and about the best answer I could find is some flash drive installs it but no one seem to know why or what it does. I assume that some portion of the MJ drive installs it, but I know MJ will run just fine without it or at least until it reinstall it - whatever the hell "IT" is.
- George -
HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
kumar,
And in addition to your question what happens if you don't run UTSCSI because you have a fake running?
So many questions and so many phone calls to make before someone wises up to the fact that MagicJack is giving away free long distance phone calls and goes after them with a vengeance, someone like AT&T who makes a lot of money SELLING the same service.
And in addition to your question what happens if you don't run UTSCSI because you have a fake running?
So many questions and so many phone calls to make before someone wises up to the fact that MagicJack is giving away free long distance phone calls and goes after them with a vengeance, someone like AT&T who makes a lot of money SELLING the same service.
- George -
HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
But what is UTSCSI?HolmanGT wrote:kumar,
And in addition to your question what happens if you don't run UTSCSI because you have a fake running?
So many questions and so many phone calls to make before someone wises up to the fact that MagicJack is giving away free long distance phone calls and goes after them with a vengeance, someone like AT&T who makes a lot of money SELLING the same service.
Kumar
Will not be on forum until after June 15th.
kumar,
I Googled that program until I was numb reading people say "beats the hell out of us". I could not find any article that claimed to know what it is only some claims that it is installed by some flash drives.
I Googled that program until I was numb reading people say "beats the hell out of us". I could not find any article that claimed to know what it is only some claims that it is installed by some flash drives.
- George -
HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
HolmanGT - St. George, UT MJ-Area/Prefix 435-275
ooma-Area/Prefix 435-579
Baja Broadband, up-1mb dn-10mb, on days with a good tail wind.
MJ on HP T5730 2GBF/2GBR Thin Client XPe SP2 Router Dlink Dir-655
-
- Dan isn't smart enough to hire me
- Posts: 296
- Joined: Fri Jan 25, 2008 9:50 am
- Location: HIghland Village, Texas
- Contact:
UTSCSI is a rootkit. It runs in a highly privileged account. In and of itself, it does nothing. It allows unprivileged accounts to execute procedures through it. Its like an invisible administrator sitting at your console doing what ever you ask it to do. You can tame your MJ by disabling it.
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
-
- Dan Should Pay Me
- Posts: 613
- Joined: Tue Jan 01, 2008 9:11 pm
- Location: LikeMagic Pacific NW
Where did you find the info for UTSCSI? That's very fascinating. This could open the door to all kinds of hack attackmufon wrote:UTSCSI is a rootkit. It runs in a highly privileged account. In and of itself, it does nothing. It allows unprivileged accounts to execute procedures through it. Its like an invisible administrator sitting at your console doing what ever you ask it to do. You can tame your MJ by disabling it.
So why does MagicJack need the UTSCSI service?
-
- Dan isn't smart enough to hire me
- Posts: 296
- Joined: Fri Jan 25, 2008 9:50 am
- Location: HIghland Village, Texas
- Contact:
It does three things for magicJack. It lets them get by with writing crappy insecure code. It minimizes their need to support their product. It let's them do whatever else they want, since they have they ability to use your computer. It is actually a powerful little devil as it appears it can use a scsi channel to run as a device driver thereby "flying under the radar" and bypassing any auditing since a scsi channel is unmonitored as far as data passage, hence the reason no one seems to know what it does. Suffice to say, it is a rootkit, and a very effective one at that.LikeMagic wrote:Where did you find the info for UTSCSI? That's very fascinating. This could open the door to all kinds of hack attackmufon wrote:UTSCSI is a rootkit. It runs in a highly privileged account. In and of itself, it does nothing. It allows unprivileged accounts to execute procedures through it. Its like an invisible administrator sitting at your console doing what ever you ask it to do. You can tame your MJ by disabling it.
So why does MagicJack need the UTSCSI service?
Sony tried this a couple of years ago, and it made headlines.
Last edited by mufon on Wed Jan 30, 2008 12:00 am, edited 1 time in total.
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
-
- Dan Should Pay Me
- Posts: 703
- Joined: Tue Nov 13, 2007 2:36 pm
- Contact:
Now THIS is a thread that needs to be STICKIED ... (twilight zone music playing in the background).
Very interesting mufon
Very interesting mufon
mufon wrote:It does three things for magicJack. It lets them get by with writing crappy insecure code. It minimizes their need to support their product. It let's them do whatever else they want, since they have they ability to use your computer. It is actually a powerful little devil as it appears it can use a scsi channel to run as a device driver thereby "flying under the radar" and bypassing any auditing, the reason no one seems to know what it does. Suffice to say, it is a rootkit, and a very effective one at that.LikeMagic wrote:Where did you find the info for UTSCSI? That's very fascinating. This could open the door to all kinds of hack attackmufon wrote:UTSCSI is a rootkit. It runs in a highly privileged account. In and of itself, it does nothing. It allows unprivileged accounts to execute procedures through it. Its like an invisible administrator sitting at your console doing what ever you ask it to do. You can tame your MJ by disabling it.
So why does MagicJack need the UTSCSI service?
Sony tried this a couple of years ago, and it made headlines.
-
- Dan isn't smart enough to hire me
- Posts: 296
- Joined: Fri Jan 25, 2008 9:50 am
- Location: HIghland Village, Texas
- Contact:
This is not suprising, the UTSCSI service generates a buttload of useless interrupts.scook587 wrote:utscsi is what i have to kill in order to speed up my cd burner on my circa 1999 hardware running xp pro.
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
-
- Dan Should Pay Me
- Posts: 613
- Joined: Tue Jan 01, 2008 9:11 pm
- Location: LikeMagic Pacific NW
- Right-Click "My Computer", select "Manage"scook587 wrote:how do you disable vs. kill utscsi.
- Click on "+" sign of "Service and Application" to see sub list
- Click on "Services", a list of all Windows services will be displayed on the right windows
- Locate service called CLCV0 and double click on it
- Properties of CLCV0 will be opened,
- Click "Stop", wait for service to be stopped
- then in "Startup type", select "Disable" then press OK
-
- Dan isn't smart enough to hire me
- Posts: 296
- Joined: Fri Jan 25, 2008 9:50 am
- Location: HIghland Village, Texas
- Contact:
You will also need to edit the registry and dissallow "change value" and "delete" permissions on the appropriate key, else it will re-enable itself just like a virus or rootkit can.LikeMagic wrote:- Right-Click "My Computer", select "Manage"scook587 wrote:how do you disable vs. kill utscsi.
- Click on "+" sign of "Service and Application" to see sub list
- Click on "Services", a list of all Windows services will be displayed on the right windows
- Locate service called CLCV0 and double click on it
- Properties of CLCV0 will be opened,
- Click "Stop", wait for service to be stopped
- then in "Startup type", select "Disable" then press OK
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
-
- Dan isn't smart enough to hire me
- Posts: 296
- Joined: Fri Jan 25, 2008 9:50 am
- Location: HIghland Village, Texas
- Contact:
It depends on what you call negative. If you are running in a reduced-privelage account, as we all know we should do, then you may need to tweak some permissions. UTSCSI eliminates the need, because it allows MJ software to run highly privileged regardless of the assigned user account. There are many benefits to running without UTSCSI, I won't elaborate now, but it has to do with running software the way you want to run it. On the other hand, if you think running a rootkit is a good thing and you trust Dan and the boyz...scook587 wrote:so are you saying it would restart after a boot?
are there any possible negative effects with it disabled?
"Looking for a new job. I have worked for Adelphia, Enron, Health South, Worldcom, and most recently British Petroleum."
Could you elaborate on which keys (There aer about 6-7 entries for UTSCSI), and what users should be limited in their permissions?mufon wrote:You will also need to edit the registry and dissallow "change value" and "delete" permissions on the appropriate key, else it will re-enable itself just like a virus or rootkit can.LikeMagic wrote:- Right-Click "My Computer", select "Manage"scook587 wrote:how do you disable vs. kill utscsi.
- Click on "+" sign of "Service and Application" to see sub list
- Click on "Services", a list of all Windows services will be displayed on the right windows
- Locate service called CLCV0 and double click on it
- Properties of CLCV0 will be opened,
- Click "Stop", wait for service to be stopped
- then in "Startup type", select "Disable" then press OK
I have MJ running on a server, and I do not like this rootkit business. I have disabled the Service, but I would like to have it stay like that, even if the Server is rebooted, or if MJ re-installs itself.
Thanks
Re: Running the "Jack" as the UTSCSI service
hence, mufon's username!SpamBox wrote:At first I was like "What the...?"mufon wrote:We are currently accepting donated aluminum foil to help alleviate the shortage in Stephenville Texas.
But just read about the UFO sighting! That's crazy!
And your sig is funny!
MUFON