InstallSite Blog : Macrovision

Acresso changes name to Flexera

stefan — Thu, 08 Oct 2009 16:32:00 GMT

Mark Bishof, President and CEO of Acresso Software, today informed customers that the company will change its name to Flexera Software effective October 12, 2009. They plan to issue a formal press announcement about this on October 13. But in his e-mail he already hinted about the reason:

"Under the new corporate brand, Flexera Software, we can fully market, service, and support our products in all geographies where we do business today and where we plan to over the coming years."

So maybe the word "Acresso" has some negative connotations in some language or country, or maybe there were legal or trademark issues.

However, according to the e-mail, "this corporate branding change should be transparent" to customers, and except the name nothing will change.

This is the second name change for the maker of the InstallShield, InstallAnywhere, AdminStudio and FLEXnet product families within 19 months. Here's a brief history:

In July 2004 Macrovision Corp., makers of FLEXnet and multimedia copy protection products, acquired InstallShield Software Corp., makers of InstallShield and AdminStudio.
In June 2005 Macrovision also acquired InstallShield's former competitor, Zero G Software, Inc., makers of InstallAnywhere.
In April 2008, Macrovision's software business unit was sold to private equity firm Thoma Bravo under the name Acresso Software.
On October 13, 2009 Acresso Software will be renamed to Flexera Software.

By the way: In July 2009 the remaining Macrovision Corp. was renamed to rovi Corporation.

Security Vulnerability in FLEXnet Connect / InstallShield Update Service

stefan — Thu, 18 Sep 2008 07:10:40 GMT

When checking for updates, the FLEXnet Connect client (and it's previous versions named InstallShield Update Service) can download and execute scripts from the update server. The problem is that these scripts are downloaded via HTTP, so the identity of the server isn't verified and the scripts are not encrypted. Therefore an attacker could cause the client to execute malicious scripts, for instance by redirecting the connection using a proxy or a DNS attack. There's no fix available but the following article from the US-CERT (United States Computer Emergency Readiness Team) lists some possible workarounds:

Vulnerability Note VU#837092: InstallShield / Macrovision / Acresso FLEXnet Connect insecurely retrieves and executes scripts

Basic Introduction to InstallShield and Windows Installer

stefan — Wed, 07 May 2008 07:56:40 GMT

Found a nice blog article by Susan Gorman that introduces Windows Installer and InstallShield's role:

Basic Introduction to InstallShield and Windows Installer

Upgrade offer for old InstallShield and AdminStudio versions

stefan — Thu, 24 Apr 2008 12:41:39 GMT

There's currently a special offer that allows owners of InstallShield and AdminStudio to upgrade to the current version at a reduced price. InstallShield versions older than 11.0 and AdminStudio versions older than 7.0 are no longer entitled to regular upgrade pricing. However users of these version can now get a 30% discount off the full version when ordering before May 30.

The offer applies to the following product versions (overview, please send your serial number for detailed verification):

For upgrades to InstallShield 2008 Premier, Professional or Express:

InstallShield X and 10.5
InstallShield DevStudio 9
InstallShield Developer 7.x -8.x
InstallShield Professional 5.x-7.x
InstallShield for Windows Installer 1.x-2.x
InstallShield 3
InstallShield X Express
InstallShield Express 2.x-5.x

For upgrades to AdminStudio 8.6:

AdminStudio 1.x-6.x

This is a good chance to move to a supported version if you didn't upgrade for a longer timer. If you want to take advantage of this offer, please don't wait for the last day. Verifying the serial number of your (very) old product may require some research and discussion with the manufacturer, which might take a few days.

For owners of supported versions (InstallShield 11.0-12.0 and AdminStudio 7.0-8.5) there's also a discount offer: they will receive 10% off the upgrade price when ordering before May 30.

For more information and ordering:
InstallSite Shop

One-Click Install (OCI) Security Vulnerability in InstallShield 12

stefan — Wed, 02 Apr 2008 07:04:47 GMT

A security vulnerability has been reported in the One-Click Install ActiveX control in InstallShield 12. The problem only exists in the InstallScript project type; Basic MSI and InstallScript MSI are not affected. The vulnerability only exists in InstallShield version 12. A fix is available. If you are using One-Click Installs (OCI) in InstallShield 12 you should install the fix, rebuild your setup and update your HTML code with the new control.

InstallShield knowledge base article Q113640

Acresso Software now owns InstallShield etc.

stefan — Wed, 02 Apr 2008 00:10:36 GMT

As of today, Acresso Software is the new company that produces the InstallShield, InstallAnywhere, AdminStudio and FLEXnet product families.

Back in February, Macrovision Corp. announced that they are selling their Software Business Unit to private equity firm Thoma Cressey Bravo (TCB) for $200 million. This resulted in a stand-alone company called Acresso Software Inc.

I don't know how they made up the company name, maybe it's taken from the owning company: THOMA CRESSEY BRAVO

The new company is located in Schaumburg near Chicago, the former headquarters of InstallShield Software Corp. According to information given in a conference call in February, the new company not only took over the software and know how from Macrovision, but also all the employees from Macrovision's software unit as well as some people from shared services such as marketing.

I don't know yet when and how the products will be re-branded.

Macrovision sells Software Unit (InstallShield, AdminStudio, FLEXnet) to TCB

stefan — Fri, 15 Feb 2008 10:46:34 GMT

Macrovision Corp. announced that they are going to sell their Software Business Unit (including the InstallShield, AdminStudio and FLEXnet product lines) to private equity firm Thoma Cressey Bravo (TCB). The cash transaction valued at approximately $200 million is expected to close on or before April 1, 2008.

The transaction will result in a stand-alone company focused on providing solutions that help simplify the business relationship between software producers and enterprises. All products and associated support and services from within the Software Business Unit are part of the transaction. Mark Bishof, currently Macrovision’s Executive Vice President and General Manager of the Software Business Unit, will assume the role of CEO for the stand-alone software company following the close of the transaction.

Besides the FLEXnet product line, the Software Business Unit includes InstallShield and AdminStudio which Macrovision acquired in 2004 for $76 million, and InstallAnywhere which was acquired in 2005 for an undisclosed amount.

TCB is investing in businesses in those sectors that can grow both organically (through changes in their cost structure and expansion of their revenues) and by acquiring and integrating similar businesses.

TCB investments include Attachmate Corp. and NetIQ Corp. (an Attachmate business). These companies offer systems and lifecycle management solutions, including the WinINSTALL MSI Packager. So InstallShield (setup authoring for ISVs), AdminStudio (MSI packaging for corporate IT) and FLEXnet (software protection and license management) might be a good fit to TCB's portfolio.

New Security Vulnerability in FLEXnet Connect

stefan — Sun, 20 Jan 2008 12:23:00 GMT

New reports about security vulnerabilities in Macrovision's FLEXnet Connect (formerly called InstallShield Update Service) have been published on January 15, ~~2007~~ 2008. The vulnerability would enable an attacker to remotely run malicious code on a users machine. The following files are affected:

isusweb.dll version 6.1.100.61372
ISDM.exe version 6.1.100.61372

Other versions may also be affected.

Sample exploit code is available on the web.

Macrovision has not yet replied to my request for a confirmation of these reports. As a workaround you should set the kill bit for the affected ActiveX controls (see below articles for details).

Setups created with Macrovision's InstallShield often ship the FLEXnet Connect/Update Service client by default, even if the author isn't actually using it. I recommend that you review your setup packages and inform your customers, if your setup installed the vulnerable files on their machines.

[edit 2008-02-25: corrected the date]

InstallShield Support for Visual Studio 2008, .NET Framework 3.5 and VC++ 9

stefan — Thu, 03 Jan 2008 18:16:06 GMT

Macrovision released updates for InstallShield 2008 to support integration with Visual Studio 2008 and redistribution of the .NET Framework 3.5 and VC++ 9 runtime files:

These updates are only available for InstallShield 2008, but not for previous versions (although the .NET 3.5 prerequisite and the VC++ merge modules may work with other InstallShield versions)

AdminStudio 8.6 supports Thinstall and Citrix virtualization / Webinar Nov. 8

stefan — Sat, 03 Nov 2007 17:46:00 GMT

On November 1, 2007, Macrovision Corp. released a new version of AdminStudio, extending its application virtualization integration with support for the Thinstall Virtualization Suite. As an independent player, Macrovision is now partnering with two well-known virtualization vendors: Citrix and Thinstall.

Joint press release vom Macrovision and Thinstall

On November 8, 2007 there will be two (to accomodate time zones) webinars about AdminStudio 8.6 and its support for multiple virtualization formats.

15:00 UTC / 7am PT / 10am ET / 3pm UK / 16:00 CET / other time zones
19:00 UTC / 11am PT / 2pm ET / 7pm UK / 20:00 CET / other time zones

Webinar registration page (potential privacy issue: use valid e-mail address but avoid personal data when registering)

AdminStudio and Thinstall are available in the InstallSite Shop

More on the security patch for FLEXnet Connect

stefan — Fri, 02 Nov 2007 11:18:00 GMT

Some additional information about the recently reported security vulnerability in FLEXnet Connect:

According to Secunia the vulnerability is reported in versions 5.01.100.47363 and 6.0.100.60146 of the Update Service ActiveX control (isusweb.dll), but other versions may also be affected. It is recommended that you update all machines which have versions prior to 6.0.100.65101 installed, or set the kill bit for the affected control. For more information see the advisory from VeriSign iDefense Security Intelligence Service.

A stand-alone installer to update the FLEXnet Connect Client on your end users' machines is available (Download). Unfortunately the installer isn't digitally signed, so it will display a UAC dialog with yellow title bar on Windows Vista, warning about an unidentified program. Note that this stand-alone installer will not update the redistributables on your development machine. You need to install the latest Connect SDK to do this.

To update the files in the InstallShield Redist folders on your development machine, download and install the latest version of the FLEXnet Connect SDK. I did this on a machine which has both InstallShield 12 and InstallShield 2008 installed. This updated the files in the Macrovision\IS12\Redist\Update Service folder, but not in its IS2008 counterpart. So after installing the SDK you should verify the version numbers and update the files manually as needed.

Security patch for FLEXnet Connect

stefan — Tue, 30 Oct 2007 17:00:00 GMT

Today, Macrovision Corp. notified customers of FLEXnet Connect® (formerly called InstallShield Update Service) of a security vulnerability in the FLEXnet Connect client version 6.0. Customers using the FLEXnet Connect functionality that is bundled with some editions of InstallShield and AdminStudio are also affected. The problem only exists in the Windows client, not the Universal client. Also, version 6.1 is not affected.

Macrovision has released a patch to fix the vulnerability. If you are using FLEXnet connect and distributed the client to your customers, you need to take action as soon as possible. After updating the Connect SDK on your development machine you have to create an update for your application setup and ship it to your customers in order to update the Connect client on their machines.

Macrovision knowledge base articles:

Side note: End users can't update the client dircetly from Macrovision because it was installed by your setup as a merge module. This servicing limitation is making merge modules less popular these days, see Rule 43 in the Tao of the Windows Installer.

Weird MSI problems on Vista caused by InstallShield bug

stefan — Tue, 30 Oct 2007 16:37:25 GMT

Recently, I've seen posts about some problems that really sounded weird to me. From the forum posts I was unable to tell what the setup authors might have done wrong. Here are some of the symptoms that have been reported in setup communities:

After a Major Upgrade, you have two entries in Add/Remove Programs control panel.
Error message "1: ALLUSERS property is not 1 - this MSM cannot be used for a per-user or fallback-to-per-user install" during installation, although ALLUERS had been set to 1.

When attempting to uninstall the application you may also see the following error messages:

"Another version of this product is already installed. Installation of this version cannot continue. To configure or remove the existing version of this product, use Add/Remove Programs on the Control Panel." (Windows Installer error code 1638)
"This action is only valid for products that are installed". (Windows Installer error code 1605)

As it turns out, this can be caused by a problem in InstallShield 2008. If a Basic MSI setup includes a custom action written in InstallScript, the script engine changes the value of the ALLUSERS property.

Macrovision has released a hotfix to address this problem, and also documented some workarounds:

HOTFIX: InstallScript Initialization Code Modifying ALLUSERS Property

Application Virtualization

stefan — Thu, 04 Oct 2007 16:42:46 GMT

Applicaton virtualization aims to combine the best of both worlds: the efficiency of locally installed software and the convenience of virtual machines. While the techology has been around for quite some time, it was almost unnoticed. But recently the market is evolving, and you can read about company acquisitions and strategic partnerships frequently.

Application virtualization works by placing an application in a "semi-transparent petri-dish". The application runs on the local operating system, but its access to the file system and registry gets filtered and redirected to a virtual store on a case-by-case basis. This means that the program can load system DLLs from the real machine, but if it requests a DLL that's specific to the virtualized application, this read access is redirected to the virtual file system. The same is true for registry access.

Benefits compared to operating system virtualization:

No need to include the whole operating system in the package, thus saving space and avoiding licensing hassles.
Application has physical access to devices like printers, USB ports or the graphics card, resulting in higher performance.

Benefits compared to local software installation:

No need to put application specific DLLs and registry entries (like COM registration) on the real machine. Thus no installation program is required, and the application can be easily removed without traces.
Applications can run from removable media like a CD-ROM or a USB memory stick.

There are various application virtualization solutions available. Some require a client or a server, others are self contained. Streaming support, network bandwidth usage and application startup times are also quite different, as discussed recently in an InfoWorld article.

A related trend is to combine virtualization and Windows Installer (MSI): Microsoft offers a utility which wraps a SoftGrid virtualized application in a .msi file to make it easily deployable with existing systems like SMS. Macrovision's AdminStudio can repackage applications as .msi file or for Citrix Presentation Server, or convert MSI packages to Citrix virtual profiles.

This is part three of my series about virtualization technologies. Here are links to all parts (will be updated when additional articles are published):

Virtualization Technologies Overview
Operating System Virtualization
Application Virtualization (this article)

AdminStudio and Thinstall are available in the InstallSite Shop

Macrovision announces end of life for InstallShield, InstallAnywhere and AdminStudio versions

stefan — Fri, 28 Sep 2007 17:38:45 GMT

On September 28, 2007 Macrovision announced the end of life for the following product versions:

InstallShield Premier and Professional, version 10.5
InstallShield X Premier, Professional and Express, version 10.0
InstallShield DevStudio 9
InstallShield Express 5
InstallAnywhere 6
AdminStudio 6

Users of these versions have until December 31, 2007 to upgrade to the latest version at the reduced upgrade price. Support for those versions will also be phased out with full support ending September 28, 2008 and limited support ending April 30, 2009.

If you decide not to upgrade to the latest version I highly recommend you download and save all hotfixes, service packs, add-ons etc. for your version, before they get pulled from the web site. You may also want to save or print important knowledge base articles for future reference.

Repackager Certification by Macrovision

stefan — Tue, 11 Sep 2007 14:25:15 GMT

Marovision Corp., makers of InstallShield and AdminStudio, respond to a repeated customer request and are now offering Repackager Certification exams. It's a combination of a 5-day training course with a 2-hour test at the end. The course covers the repackaging workflow, ICE rules and validation, custom actions, conflict solving etc. It’s meant for veteran IT professionals and persons who previously took the standard AdminStudio training class. Attendees are encouraged to bring in difficult-to-package applications so Macrovision instructors can work with them to configure them correctly.

The course and exam is currently available in United Kingdom and USA only. If you are interested in a similar offering for Germany please let me know.

InstallShield 2008 Express Released

stefan — Tue, 21 Aug 2007 10:28:00 GMT

On August 16, Macrovision released InstallShield 2008 Express. This completes the 2008 edition of the InstallShield product family. Express 2008 includes improved support for Windows Vista and UAC, Windows Server 2008 beta, .NET framework 3.0, Windows CE 6.0 and more.

InstallShield 2008 is available in the InstallSite Shop

Uninstalling MSI Setups created with InstallShield can corrupt Windows

stefan — Sat, 11 Aug 2007 08:01:00 GMT

There's a bug in the way InstallShield extracts COM data that can corrupt the operating system when your "Basic MSI" or "InstallScript MSI" setup is uninstalled. Read how Christopher Painter lost TCP/IP settings on his computer because of this problem. This can happen if you use the "COM extract at build" option for a component.

A hotfix for InstallShield 2008 is available but Christopher reports that InstallShield 12 is affected by the same problem. There's no information about previous versions. Macrovision knowledge base article Q113345 also includes instructions for a manual workaround that should work for any versions of InstallShield.

New AdminStudio 8.5 supports Citrix Virtualization

stefan — Tue, 10 Jul 2007 12:49:00 GMT

Macrovision Corp. today released a new version of AdminStudio, their solution for packaging, customization and testing software for deployment. AdminStudio 8.5 now includes the latest version of InstallShield 2008 as Editor, which includes improved Windows Vista support and other enhancements.

The Enterprise Edition of AdminStudio 8.5 also supports Citrix Application Virtualization. It can convert MSIs to Citrix virtual profiles and can also repackage legacy applications into Citrix virtual profiles without using snapshots.

What's new in AdminStudio 8.5

AdminStudio 8.5 is available in the InstallSite Shop

Macrovision preparing end-user patch for FLEXnet Connect/Update Service security issues

stefan — Thu, 21 Jun 2007 19:32:00 GMT

Updated information about the recent security vulnerability reports in Macrovision's FLEXnet Connect and InstallShield Update Service products: Product manager Trent Wheeler told me they are currently in the process of rolling out the fix for the two problems reported by US-CERT to customers of InstallShield, AdminStudio, and other Macrovision products that utilize the FLEXnet Connect product.

And they are writing an additional patch, one that is appropriate for end-users of FLEXnet Connect to apply directly to the installed version of the agent rather than the intermediate consumers of the SDK. This will be made generally available to customers of Macrovision's products that utilize FLEXnet Connect, and to interested 3rd parties, as soon as it clears QA.