FSDreamTeam forum
Products Support => GSX Support FSX/P3D => Topic started by: Centrefix on December 17, 2015, 09:05:05 am
-
I've been running GSX perfectly well since it's release and I can't fly an airliner without it now, its a great add-on.
I've recently been having huge issues with FS2Crew and uninstalled it (which I've done before), but on this occasion it seems to have had a detrimental effect on GSX.
Since then I've been getting the following error message...
(http://i621.photobucket.com/albums/tt299/Centrefix/Untitled_zpsyir8azhk.jpg)
The executable of the Couatl Scripting Engine for FSX has been modified.
I've checked for viruses, uninstalled GSX and Couatl as per the instructions, then reinstalled - but I still get the error and it doesn't work anymore. Help me please.
-
Are you using the latest GSX version ?
Since the problem is likely caused by an antivirus, which is trying to "heal" the program (since it mistakenly think it's a threat), the current version uses the Taggant standard, which should prevent false positives, assuming your antivirus supports it, of course...
-
I downloaded and installed the most recent installer just to be sure (after uninstalling properly), but with no luck.
The warning still pops up on first run, and after a disabled my anti-virus.
(http://i621.photobucket.com/albums/tt299/Centrefix/Untitled_zpsevleezy1.jpg)
Is it possible to delete the executable and let it create a new one? - I'm not an expert, I'm just stabbing in the dark.
-
Is it possible to delete the executable and let it create a new one? - I'm not an expert, I'm just stabbing in the dark.
That's exactly what uninstalling and reinstalling does. Of course, if a bugged antivirus is blocking the file, it might also block the uninstaller...
Uninstall and reply YES to the question "Do you want to remove the Couatl engine ?". Then check your FSX folder, and see if you still have an fsdreamteam\Couatl folder. If yes, remove it MANUALLY.
Then reinstall. This should ensure you have the latest Couatl version.
-
I've uninstalled as per the instruction on here; clicking yes twice and getting rid of the Couatl engine also. The folder fsdreamteam\Couatl was removed as part of the uninstall.
I reinstalled the most recent Couatl engine (not GSX) and I'm still getting the error.
There has to be something left behind from the uninstall (I don't have anti-virus installed at the minute).
-
I reinstalled the most recent Couatl engine (not GSX) and I'm still getting the error.
Is your Couatl.exe version 3.0.xxxx ( xxxx should be 3187 or more ) ?
There has to be something left behind from the uninstall (I don't have anti-virus installed at the minute).
If the version is the newest one, it means the problem is not the antivirus, but another software that behaves like that.
-
Uninstalled everything properly including FSX - reinstalled only FSX and GSX and still get the error :-(
-
Uninstalled everything properly including FSX - reinstalled only FSX and GSX and still get the error :-(
Nobody told you to install FSX, that's not obviously the problem. If there were a slight chance the FSX installation could cause this, I would have listed it in the possible reasons.
I'll repeat the question again:
Is your Couatl.exe version 3.0.xxxx ( xxxx should be 3187 or more ) ? If the version is the newest one, it means the problem is not the antivirus, but another software that behaves like that.
Or it's the antivirus which is so bugged, that is altering the program even when disabled (yes, we have seen that), or you have two antivirus running without realizing it (yes, we seen that too...).
-
Nobody told you to install FSX, that's not obviously the problem. If there were a slight chance the FSX installation could cause this, I would have listed it in the possible reasons.
I was due a clean install anyway as things we're slowing down, and I thought it would cure the problem. Don't worry about that.
I'll repeat the question again:
...and I'll repeat the answer again...
I reinstalled the most recent Couatl engine and I'm still getting the error. (It is 3.0.0.3187) - I still get the error double-clicking the .exe even when FSX is not running.
Or it's the antivirus which is so bugged
My answer which I already said...
disabled my anti-virus
To Summarise:
*No anti-virus installed
*Clean uninstall and reinstall of FSX - every folder was deleted after a proper uninstall
*No other add-ons running now, just FSX and GSX
*Still get the error message and GSX doesn't work.
-
I reinstalled the most recent Couatl engine and I'm still getting the error. (It is 3.0.0.3187)
This is the first time you really confirmed the version that got installed is the latest one. I obviously HAD to ask, to be sure it wasn't updated for some reason, usually the antivirus.
I still get the error double-clicking the .exe even when FSX is not running.
Which confirms what I said the problem didn't had anything to do with FSX...
As I've said, the problem is either caused by an antivirus, or by another program that behaves similarly.
disabled my anti-virus
You might have disable your antivirus, but that doesn't ensure you don't have another one running, or your antivirus is STILL acting on the file, even when disabled. As I've said in my previous message, we had seen cases when some antivirus managed to corrupt a file even when it was disabled.
No other add-ons running now, just FSX and GSX
I haven't said anything about another FSX addon being the cause. In fact, the most likely cause is a NON-FSX program, because only an external program that has been installed as a global service, like an antivirus, anti-spyware, or similar, can cause this.
get the error message and GSX doesn't work.
That's normal. If another program has corrupted the executable, it cannot obviously run.
You can check very easily if the program has really been corrupted on your system by an offending program: all our executables are of course digitally signed, and the reason why they are digitally signed, is to ensure you they haven't been altered.
Check the Digital Signature tab in the Couatl.exe Properties. If it's missing or it's invalid, then IT'S SURE the executable has been altered by SOMETHING on your system, so it's not the one we made, but it has been corrupted locally on your system.
If the Digital Signature is valid, then the issue is a bit different, and the 3rd party offending program has not corrupted the actual file, but it's trying to ATTACK IT, in memory, when it runs.
Again. this is usually an antivirus/anti-spyware behavior, but that's just the most common case. There are other less common cases of non-antivirus products doing the same, but we NEVER, EVER had such reports from any Couatl 3 version, which doesn't try to fight these offending products anymore so, it simply cannot happen with the current version (which is why I asked several times to be extra sure you have it), so I still think you have an antivirus running in the background without your knowledge.
OR, last possible reason, you HAVE a virus, which would do exactly that (attaching to a running executable, corrupting it) and of course, since you said yourself you "don't have any antivirus", you cannot obviously exclude the fact you have a REAL virus instead.
Again, check the Digital Signature, and report back.
-
http://i621.photobucket.com/albums/tt299/Centrefix/Untitled_zpstd7e2zwg.jpg (http://i621.photobucket.com/albums/tt299/Centrefix/Untitled_zpstd7e2zwg.jpg)
http://i621.photobucket.com/albums/tt299/Centrefix/1_zpsqnan7sod.jpg (http://i621.photobucket.com/albums/tt299/Centrefix/1_zpsqnan7sod.jpg)
Any help?
The only thing that changed from working to not working was the install then uninstall of FS2Crew.
-
Any help?
Your screenshot shows there is a digital signature, but it doesn't show if it's still valid. Click on the Details button to check it.
The only thing that changed from working to not working was the install then uninstall of FS2Crew.
Please clarify.
Are you saying that:
1) before installing that product, GSX worked, and it stopped working after installing it
OR
2) it worked with FS2Crew installed, and stopped working after you uninstalled it ?
-
http://i621.photobucket.com/albums/tt299/Centrefix/Untitled_zpse9ktgqro.jpg (http://i621.photobucket.com/albums/tt299/Centrefix/Untitled_zpse9ktgqro.jpg)
GSX worked before the install of FS2crew. I didn't use GSX during the short time I had FS2Crew installed, so I'm not sure if it worked or not. Then when I uninstalled FS2Crew it didn't work.
I hope that helps.
-
Since the signature is valid, it means the offending program is just trying to attach to the executable, without trying to modify it (or without succeeding).
GSX worked before the install of FS2crew. I didn't use GSX during the short time I had FS2Crew installed, so I'm not sure if it worked or not. Then when I uninstalled FS2Crew it didn't work.
This is not very helpful: it would look as if FS2crew might have something to do with it, but there's no evidence. Only that GSX worked on your system before installing it.
While I never saw that product, I saw several videos on YouTube showing GSX and FS2crew working together, so I don't have any data to say for sure it's the reason of the problem.
The only thing sure, it's the problem is caused by another executable program in your system.
Try to terminate as many running programs as you can in the Task Manager, maybe you'll find the offending one.
-
No luck this end, do you want to take a look with Team Viewer. I can't think of anything else :-(
-
Centrefix: you are not alone I am also suffering the same problem and have attempted the following.
Note my certificate is valid for the exe . version is 3187, I am running windows 10, and attach the evidence of a valid certificate
Following reading the thread:
1. Before anything I scanned my whole system for virus with a negative response.
2. I then started in safe mode , and program launches with no error
3. I then uninstalled and cleaned out my anti virus (which is Taggant compliant) but still get the error.
4. I have stopped all the services and tasks running that I can and still get the error.
My next move is to start restoring to previous images to see when the problem was introduced.
I have not made changes myself to the pc between it working and not working other than a windows update KB3124200
The plot thickens.
-
I too am getting this error.
I dont even have FSX installed and I get an FSX error, I only use P3d V3. I have just about had enouigh of Flight Simulators now!!!!
-
I can double click on the .exe and get the error even when FSX is not running.
Maybe we'll never know the answer.
-
After almost 8 hours of searching/restarts/rebuilds the culprit for me has been found for me.
Trusteer Endpoint Protection which is part of Rapport http://www-03.ibm.com/software/products/en/trusteer-rapport which banks advise to install for online banking.
If I stop their program everything runs just fine and GSX works.
Trusteer had carried out a silent upgrade which was not obvious but showed up searching through programs affected by restore points.
It appears to control access to windows API's to prevent fraud while using banking
In my search on this forum while waiting for restarts I found this from April 2015 http://www.fsdreamteam.com/forum/index.php/topic,8207.msg90313.html#msg90313
My issue appears to me to be similar to the behaviour suffered by the list of 10 or so programs that cause a similar problem detailed in this old thread.
Umberto said this check was being removed in Couatl 3 beta , perhaps this was reinstated or modified?
Looks like I have a good way of testing that my banking is protected now :)
-
My issue appears to me to be similar to the behaviour suffered by the list of 10 or so programs that cause a similar problem detailed in this old thread. Umberto said this check was being removed in Couatl 3 beta , perhaps this was reinstated or modified?
I can confirm Couatl 3 doesn't check anymore if a 3rd party software is trying to hook on it. We removed this in Couatl 3, when the number of bad-behaving 3rd party products that use these questionable methods started to grow.
There's still a check left in against external executables that try to MODIFY Couatl.exe, which I guess is what you are getting, and this really cannot be accepted and I cannot see any reason why a banking security program would have any reason to try to MODIFY another executable it doesn't have any relationship with!
I'd report it as the developers as a serious bug.
-
I've uninstalled everything so I can't check the issue now. However I also have that banking security software installed ???
-
Thanks Umberto for the response.
I have reported it to the IBM Trusteer-Rapport at http://www-03.ibm.com/software/products/en/trusteer-rapport
Given they claim to have over 30 Million users worldwide others will be affected by this I suspect.
-
My advice is to uninstall Trusteer. It duplicates the services provided by your Antivirus program and just causes general mayhem with its select updates.
-
In conjunction with the Support team at IBM I have identified the part of the Trusteer package that is causing this.
It can be disabled via their security policy control panel. It is called 'Early Browser protection' whatever that is!
I am waiting for them to get back now with a response on what they suggest now.
-
Maybe you could supply them with the following information:
The executable which was mistakenly blocked, Couatl.exe, is not simply entirely and utterly safe to use, it's ALSO digitally signed with the "TAGGANT" system, which is an IEEE standard that is supposed to be supported by anti-malware companies in order to prevent false-positive detection bugs:
http://standards.ieee.org/develop/indconn/icsg/amss.html
Here's a scan on Virustotal.com, which scans files with many antivirus all at the same time, and it reports ZERO detection with 55 engines tested:
https://www.virustotal.com/en/file/e83befb9ddfafa015ba1dd10e800b6f58bbe9c9950ec55c10e225aedbbc91285/analysis/
-
No problem, have just sent the info you provided to them
thanks.
-
IBM have just got back to me and informed me that their 'Early Browser protection' package
has now been 'improved' .
I now no longer get the scripting engine error and GSX loads and functions as normal.