Examsoft thinks VMware is still running when I'm natively in BootCamp/WinXP

[physicsguy52]

There is test taking software, Softest by Examsoft which, for security reasons, will not run under vmware. I am booted into WinXP natively on my bootcamp partition, but Softest still thinks vmware is running. It prompts me to terminate vmware or it can't continue.

I think this problem originated when I tried a trial version of vmware with my bootcamp volume a few weeks ago. The default vmware preference when quitting Windows was to suspend rather than shut down. So I guess when I quite Windows, it suspended under vmware. Now that the trial period expired, I can't go back into vmware to do a proper shutdown of Windows.

I booted natively with bootcamp/WinXP, searched for any file (including hidden) that had vmware in the name or contained the text "vmware" and deleted all of them (except for some installer logs that Windows keeps around). I also did a control panel removal of vmware tools. Multiple reboots. Windows disk check and repair. Reinstalled Softest. No dice. Softest still thinks vmware is running.

How can I solve this problem? Is there a file I need to delete somewhere on the Windows volume? I don't want to buy vmware just to do a shutdown (I alread have Parallels and was just curious about vmware).

Thaks for any help. Mac Leopard 10.5.2 on Macbook core duo. Whatever vmware version was current Feb. 2008. WinXP service pack 2.

[admin]

But Examsoft's SofTest is still refusing to run because it still detects vmware fusion. Uploaded and attached is the image of the SofTest error window. It seems that it must be detecting some process that vmware fusion is still running. It seems you are an employee there, so I hope you can track down how to fix this, and feedback to your developers to not allow vmware fusion to run anything when vmware fusion is not being used. If I don't get this fixed in about 3 days, I'll have to wipe out my bootcamp image and reinstall Windows. Thanks.

It's possible that we're forgetting to uninstall something and SofTest is picking up on it, but I think Bob's response is more likely. There doesn't seem to be any trial version of SofTest available, and I don't think we can figure out what it's doing without getting our hands on it (or if someone with a copy helps out as Woody suggests).

[WoodyZ]

I would be more then glad to to the forensic analysis if someone would provide access information to the program via private message. I have the tools to examine the changed state between a clean built Boot Camp partition and a Virtual Machine of the Boot Camp partition with VMware Tool installed and removed and then attempt to detect what exactly ExamSoft is looking for however with out the ExamSoft program I can do nothing other then to say ExamSoft is looking at the Windows Registry and or Filesystem for something and my guess it the Windows Registry.

[physicsguy52]

Here is the reply from Examsoft. Note that the link only works from a Windows browser, not a Mac browser (javascript error).

This procedure (deleting the three files) worked. I tried it. Thanks for all the help in this forum.

Evidently SofTest checks for the presence of the following files:

1) Vms_fb.dll

2) Vmx_fb.dll

3) Vmx_svga.sys

These are usually found in the following locations but you may still want to perform a search for them as well.

C:\WINDOWS\system32\vms_fb.dll

C:\WINDOWS\system32\vmx_fb.dll

C:\WINDOWS\system32\drivers\vmx_svga.sys

Please search for and delete these files if found on the machine. These files are drivers used by VM Ware and are usually left behind after uninstalling VM Ware. You can also visit the link below for more information on removing VM Ware.

http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&externalId=1308

Thanks.

Sherrod Seeharack

[admin]

Thanks for contacting them about SofTest and reporting back. I've filed a bug about these components not being properly uninstalled.

[Technogeezer]

I was going to suggest that maybe they saw some hidden devices left behind in the registry, but never mind, looks like you got the answer about what's happening...

[physicsguy52]

A better way would be to delete any vmware-specific files at shutdown of the virtual machine and reinstall them upon startup of the virtual machine. That would ensure that a natively booted bootcamp volume is not affected by unneeded drivers. This seems to be the approach that Parallels (2.x) takes. At every startup of the virtual machine, there is a short pause where it installs its specific drivers. There is no trace of Parallels when booted in native mode, but for a network protocol for the virtual network interface in each network connection (probably would take too long to delete and reinstall this every time).

Because of this and my dependence on Examsoft for the near future, I will have to stick with Parallels unless/until you come up with something similar. Thanks.

[admin]

A better way would be to delete any vmware-specific files at shutdown of the virtual machine and reinstall them upon startup of the virtual machine. That would ensure that a natively booted bootcamp volume is not affected by unneeded drivers.

Just because hardware is missing doesn't mean that the drivers should be deleted from disk, that's way too drastic. The driver should detect that there is no matching hardware and not do anything, if the OS bothers to load it at all. The problem is that Examsoft is looking for the files on disk, which doesn't have anything to do with whether you're running in a virtual environment. I think this is sloppy on their part.

I agree that we should uninstall the three files if you uninstall Tools, but that's very different from deleting Tools on every reboot.

This seems to be the approach that Parallels (2.x) takes. At every startup of the virtual machine, there is a short pause where it installs its specific drivers. There is no trace of Parallels when booted in native mode, but for a network protocol for the virtual network interface in each network connection (probably would take too long to delete and reinstall this every time).

I doubt they actually reinstall their Tools each time (rather, it's probably what they do with Windows activation or something).

[WoodyZ]

Now that it's know what ExamSoft is looking for it is very easy to script a solution so one could use ExamSoft on their Boot Camp partition without deleting VMware Tools and still have the ability to run the Boot Camp partition as a Virtual Machine when not needing to use the ExamSoft. There are several ways this could be approached and I'm not suggesting that VMware do anything as this is really more of a User issue and some simple scripting can handle this as needed.