General Category > General Discussion

Couatl error message on FSX startup

<< < (2/5) > >>

virtuali:

--- Quote from: MikeEDDK on March 24, 2011, 08:41:14 am ---I scanned the system with various programs and none of them found a part of a virus or a virus itself so it seems I have succesfully removed it.
--- End quote ---

The issue is, to trigger such message, a program needs to "attach" to another executable. Which looks like something a virus could do. A virus in not the only program that could do this, but it's the more probable cause (even if you are the first one seeing this message), since I guess you would know if you used a debugger yourself and, considering you had a virus, the most likely cause is it's still there somewhere. Maybe not the dangerous part which is the detected by the antivirus, but just enough to be detected as a debugger.

You never had this message from Couatl.exe BEFORE catching a virus, right ? This should be evidence the problem is related to that.


--- Quote ---Every program with the exception of couatl.exe and is working as it did before.
--- End quote ---

This doesn't mean much, since not every program has anti-debugger checks.


--- Quote ---I checked my FS9 installation and all cloud9/FSDT sceneries work normal.
--- End quote ---

That also doesn't mean much, since there's no Pyhton capabilities in FS9, and no Couatl.exe. If the program causing the problem attaches only to .exe files, it will not affect FS9, since we only have a .dll there.

MikeEDDK:
Umberto,

thanks for the help so far.

I have never had any issues with cloud9/FSDT files so far, the couatl thing occured after the virus/trojan attack.

Do you have any idea or recomandation how to detect this debugger or the interfering parts of it? Is there a program available that could search for it?

If I can´t remove it it seems the only way to fix is to rebuild the system which would take me ages......

virtuali:

--- Quote from: MikeEDDK on March 24, 2011, 01:05:34 pm ---Do you have any idea or recomandation how to detect this debugger or the interfering parts of it? Is there a program available that could search for it?
--- End quote ---

If you are lucky, perhaps the process will be visible in the Task Manager (enable the option to see all process, not just those started by your user account) and, by terminating those that looks either suspicious or unknown, maybe you'll find the right one.

However, some particularly nasty virus/trojans can't be seen in the Task manager and, in that case, I don't see much other options other than reinstalling the system from scratch.

MikeEDDK:
Umberto,

if I understand it correct the couatl.exe is responsible for moving objects such as airport bridges, ground vehicles etc. For me it sounds like a competition product to Aerosoft´s AES which is stand-alone and not necessary for the appearance of buildings.

I made various tests and scans yesterday and it seems everything with the exception of couatl.exe is working without problems. For your information, this is the thing I caught:

http://www.fakealerts.com/rogue-antispyware-fake-alerts/remove-windows-recovery-malware-561.html

Is it possible to load the sceneries without couatl. exe but to have the buildings visible?

virtuali:

--- Quote from: MikeEDDK on March 25, 2011, 01:38:08 pm ---if I understand it correct the couatl.exe is responsible for moving objects such as airport bridges, ground vehicles etc. For me it sounds like a competition product to Aerosoft´s AES which is stand-alone and not necessary for the appearance of buildings.
--- End quote ---

That's only part of what it does, but it also displays the buildings of the scenery (not all of them, some of them are handled by the Addon Manager) so, it's required to see them.


--- Quote ---I made various tests and scans yesterday and it seems everything with the exception of couatl.exe is working without problems
--- End quote ---

As I've said, fact that other products don't work, doesn't mean much because, if the virus is disguised itself as a debugger, only those products that checks its presence will be affected.

Since Couatl.exe worked on your system before you got the virus, the only possible explanation is something is still there.

Navigation

[0] Message Index

[#] Next page

[*] Previous page