6095. Due to the new SFI introduced on June 1, the Genealogy that gives the list of affiliates in one’s team changed. We shortly observed that importing the affiliate information into Gerian had some things mixed up. The first revision of Gerian of the month was to address this, to ensure existing columns imported correctly. Later in the month two new columns of the new Genealogy were introduced to the Affiliate List in Gerian, EP for E-Packs, and PRMs for personally referred members. Also we investigated and corrected a situation where the Delete Row menu item was not being enabled initially when the HIDDEN word Prizes list displayed, creating Gerian 1.54.
6143. We revised MBDM to correctly import exported WhatsApp chat text files for groups, doing some live testing afterward. Issues observed were further addressed, including doubling the size of the person or group name, and correcting occasional wrong interpretation of some text lines. The next day, the executable was compiled as version 2.9.
7064. We began revising user registration code for this Blog to stop people from entering URLs as their username or name, like we noticed sometime ago. Next day we concluded the revision, making the users list page more secure, and uploaded the files to our server.
7123. EPPMS client requested assistance in producing payslips from a 2005 database for a deceased staff. We discussed with the end user the exact challenges in this, and after further investigation the issue was successfully sorted out after a few days.
7160. Revised MRLicense Validator to address a situation that would have made login impossible at a client site, then maximized the Multi-Database Change Password window when started by users in automatic mode. The installer was rebuilt and uploaded to the server.
7182. Provided phone support for a client for the successful installation and execution of the revised Multi-Database Change Password tool in MRLicense Validator 7.1. Close to 100 database files were processed.
7226. Set to investigating and resolving a “syntax error” that came up yesterday when we wanted to import recent CSA affiliates into Gerian, finding out it was due to further changes to the Genealogy columns by SFI. Days later we compiled and live-tested the new Gerian 1.55 version.
7230. A MSIL:Agent-CSS viral infection on an unprotected laptop was investigated and resolved over a number of days. It was first noticed last month. In the laptop, MoneyBooks was starting the default demo database all the time, ignoring commandline arguments telling it to start any other database. We were surprised to see the date of the application file mb.exe as 14/6/23 which was wrong. (That was probably the date the viral infection occurred.) Its program icon was also missing when viewed in Windows Explorer. We checked the file info to see that it was 912 KB in size which was wrong. It should have been 2.8 MB in size with a 2020 date. Also the Original filename was saying Buton.exe, while its Description was “ User profile service” instead of “MoneyBooks System module.” We initially replaced the file and it appeared to work fine. Another behavior caused by the virus was that the flash drive was always reported to be in use on attempt to eject, even when no files were being copied to it. (What was actually happening was the virus was checking for and infecting all executable files in the flash drive, just as it did in the hard drive.)
Today a similar situation was observed with Gerian in the same laptop. This time there were two files for it, the rightful gerian.exe that had a wrong icon and didn’t work correctly, and vgerian.exe that had the right icon and appeared to work. Later we discovered the bad gerian.exe we’d deleted was recreated after we’d renamed and executed vgerian.exe. In another laptop with stronger version of an antivirus program, a virus scan of a flash that was used in the laptop reported several files infected with MSIL:Agent-CSS, the files being quarantined. On closer check we saw that the original uninfected versions of the files had been renamed starting with a “v” just like vgerian.exe, while the infected files had empty icon (.ico) files created for them as well. vmb.exe was also seen further down the file listing.
In the course of investigating the viral issue, we reviewed the applications listed in Task Manager in the laptop, and deleted a suspicious process named Paint.exe with “ User profile service” as description and then did a cold shutdown. Later though the viral issue surfaced again. We checked using a Startup Control Panel tool in the laptop and saw where the virus agent file Paint.exe was being launched from a Registry setting during booting—reason why cold shutdown didn’t stop the infection—so not only disabled it, but we went and deleted the file itself to put a final stop to the issue. The weak version of the antivirus program in the laptop was also upgraded. A later review of the quarantine list in the other laptop showed several mentions of “Paint” as being infected in a flash drive, meaning that that viral agent file Paint.exe was being automatically copied to any flash drive inserted in the infected laptop.