New FSUIPC 7.4.11 contains trojan virus and it`s imposible to register

[Francisco Sanchez]

*** Moved from Announcements sub-forum to FSUIPC7 / MSFS support sub-forum ***

Hi there,

As we were in the last 2 days  attempting to fix the simconnection issue, the new version FSUIPC 7.4.11 results with a trojan malware that prevents the registration of the product with the personal account. Disinfection by the antivirus removes the *.exe file. Any suggeestion? Thanks.

Francisco.

 

InstallFSUIPC7.log

Edited April 1 by John Dowson
Moved to FSUIPC7 support forum

[John Dowson]

What anti-virus software are you using? This is a false-positive and needs to be reported to the provider.
You should add an exception to allow the RegistrationChecker.exe to run. Note this is a known issue with McAfree and has also been reported with other anti-virus software. It is also documented in the provided README.txt:

Quote

Problems installing or registering FSUIPC7
==========================================

If you have problems registering your FSUIPC7 license, then this is caused by one of 3 issues:

1. You have entered your details incorrectly. Please copy and paste the details from your
   purchase email or SimMarket account.

2. You do not have the required VC++ redistributables installed. Please download and install
   the latest combined (ie. 2015, 2017, 2019 & 2022) redistributable packages, both x64 and x86, from
      https://docs.microsoft.com/en-US/cpp/windows/latest-supported-vc-redist

3. Anti-virus software is preventing the license validation. Check your anti-virus reports and
   either add an exception to allow the installer to run or temprarily disable while installing.
 

It is also documented in the Installation and Registration guide, under Installation Problems.

Please also note that you do not have to validate your registration each time you update FSUIPC7. This needs to be done once and only once, and a successful validation will generate an FSUIPC7.key file that contains your registration details. On subsequent updates, your details from the FSUIPC7.key file (previously generated) will be used to poulate the fields on the registration page, but you do not need to validate these again - just press on Skip.

John

[Francisco Sanchez]

30 minutes ago, John Dowson said:

What anti-virus software are you using? This is a false-positive and needs to be reported to the provider.
You should add an exception to allow the RegistrationChecker.exe to run. Note this is a known issue with McAfree and has also been reported with other anti-virus software. It is also documented in the provided README.txt:

It is also documented in the Installation and Registration guide, under Installation Problems.

Please also note that you do not have to validate your registration each time you update FSUIPC7. This needs to be done once and only once, and a successful validation will generate an FSUIPC7.key file that contains your registration details. On subsequent updates, your details from the FSUIPC7.key file (previously generated) will be used to poulate the fields on the registration page, but you do not need to validate these again - just press on Skip.

John

Hi John,

I am using Bitdefender since a couple years but this is the first time I experienced this. I skiped the registration and I`m right now starting a flight to test new FSUIPC. Thanks for supporting. In case of any new query I´ll post it. 

 

Regards.

[PSCH]

Here same. Up till version 7.4.9, FSUIPC could be installed without any problem, no issues with registration, no issues with virus reporting.

7.4.10 had faulty registration process, and 7.4.11 contains virus as reported by BitDefender (build 27.0.30.140): Trojan.Generic.35540783 in file RegistrationChecker.exe

 

To just bluntly have the virusscanner flag an exception for this .exe is not a very good idea. Please investigate this issue more serious please.

 

[John Dowson]

The RegistrationChecker program was recompiled with the latest version of VisualStudio in release 7.4.10 - this was the only change.

54 minutes ago, PSCH said:

To just bluntly have the virusscanner flag an exception for this .exe is not a very good idea. Please investigate this issue more serious please.

This has happened many times before and is always the result of a false-positive by the anti-virus software, I do not know how to investigate this issue "more serious" - what do you expect me to do? What you can do, as a BitDefender user, is to report this false-positive at the following link and this will be investigated/corrected by BitFinder: https://www.bitdefender.com/business/support/en/77209-343054-resolving-legitimate-applications-detected-as-threats-by-bitdefender.html

From that page:

Quote

Bitdefender strives to reduce false-positive reports to a minimum. However, these reports are commonly due to bad programming practices. For example, some applications change the Master Boot Record, add Run registry entries, change system files without the user’s confirmation, or execute custom macros in Office applications.

The installer does non of those things mentioned, so I do not know why it is being flagged.

John

[Crewchief408]

I had the same problem, just today.  I couldn't register 7.4.11 due to Bitfender. 

I ended up uninstalling Bitfender completely, PC reboot, reinstall of 7.4.11 with no antivirus error message but, I still couldn't register.

I uninstalled 7.4.11, and deleted ALL the remnant files still located in the C:\FSUIPC\ folder. Shut down my PC cold and dark, ran an errand for about an hour.  Came home, and then I turned on my PC, and restored the deleted files. I reinstalled 7.4.11 and it read my key file without errors.  Maybe this will work for someone else too. 

Microsoft Defender has always worked well for me, Bitfender was free with my new router. I'm not sure I'll reinstall it, I've had nothing but problems with it to date.

Cheers,
Chris

[Kimchi]

Running into the same problem. I removed FSUIPC completely from my system for a fresh install. Bitdefender wont let me finish the registration proces due to the AV which sets a red flag. Bitdefender was not able to put the file into quarantine and i had to restart the PC for Bitdefender to clean the file?!

I cannot avoid Bitdefender from protecting my system. The problems i encounter lately after updating FSUIPC to 7.4.11 - buttons being switched and stuff, maybe this is not a false positive but actual a real problem?

[Reggie Fowler]

I can't even download to my desktop.  I'm using window's 11 and says virus detected and stops the download.  The bad thing. is you 

need this program to use the addon A Pilot's Life v2.  So I can't even try the workaround they have posted to possible fix the problem.  I read 

a post where you said you don't post older versions but for now some of are stuck got an addon that I can't use because of the virus this program has.

 

[John Dowson]

11 hours ago, Kimchi said:

buttons being switched and stuff, maybe this is not a false positive but actual a real problem?

No, it is a false positive. I have no viruses, and SimMarket also scans all files for viruses and they have not reported anything.
As the virus is reported in the RegistrationChecker program, can you not install and skip registration?

1 hour ago, Reggie Fowler said:

can't even download to my desktop.

Are you using BitDefender? What is it saying, and why is this different from other users reporting this issue - others users could download but had problems running it due to the issue with the RegistrationChecker program. If it is your browser blocking the download, you can tell the browser to download anyway.

 

1 hour ago, Reggie Fowler said:

So I can't even try the workaround they have posted to possible fix the problem. 

What workaround did they post? Can you please provide a reference.

It must be possible to either disable BitDefender when downloading/installing, or adding an exception to allow the program to run.
Can this not be done?

 

 

[John Dowson]

45 minutes ago, John Dowson said:

It must be possible to either disable BitDefender when downloading/installing, or adding an exception to allow the program to run.
Can this not be done?

See:
    https://www.bitdefender.com/consumer/support/answer/13427/
    https://www.bitdefender.com/consumer/support/answer/2393/

[George2]

I have the same issue using Windows 11, Chrome, and Microsoft Defender. I cannot even download the .zip file. It gets blocked by windows.

This is what I see in my Virus and Threat Protection log:

Detected: Trojan:Win32/Znyonm
Status: Removed
Details: This program is dangerous and executes commands from an attacker.
Affected Items: webfile: C:\Users\George\Downloads|Install_FSUIPC7.zip|https://fsuipc.simflight.com/beta/Install_FSUIPC7.zip|pid:5676,ProcessStart:133569011504575050

[uwsherm]

FYI @John Dowson, Microsoft Defender is behaving similarly. I realize this is very likely a false positive, but something about this particular .exe is matching the signature of malware across multiple AV products.

[John Dowson]

Yes, I can see this now after virus definitions update. I have allowed an exception and downloaded and checked the file, and it is the same one as uploaded and so this will be a false-positive.
I will report this to windows, and also see if I can fix here. I think the problem is that the installer runs an embedded program to check the registration details and it is this that is being flagged. This program was recently updated (recompiled only) so I will try with the older version. If that also fails, I will have to remove the registration validation until this issue is fixed.

Sorry about this - I will try and fix this asap....for now, please add an exception for the installer to allow it to be downloaded and ran.

John

[John Dowson]

It seems that the latest beta release is not affected by this - I don't know why. This is an exe rather than a zip, so is missing some documentation (README.txt and changes.txt files), but you can try downloading this if you have issues with the official release:
    https://fsuipc.simflight.com/beta/Install_FSUIPC7beta.exe

However, there will most probably still be issues with BitDefender and the RegistrationChecker in this version.

John

[Bambiigamingttv]

I have the same issue, both Edge and Opera gx will not download the latest version due to an virus in the file

[John Dowson]

1 hour ago, Bambiigamingttv said:

I have the same issue, both Edge and Opera gx will not download the latest version due to an virus in the file

As already noted many times, there is now a false-positive report in Windows Defender since the recent update (1,409.80 from 06/04/2024 or maybe a day or two earlier or later, depending upon when the update was pushed). This is definitely a false positive and I have reported it to Microsoft and am awaiting a response.

There is nothing that I can do about this at the moment. To download and install FSUIPC7 (on Windows 11, 10 should be similar), you will have to temporarily allow this threat. To do this, go to the Windows Security panel and select the Virus & threat protection page, ant then select Protection History. Select the entry for the installer (should be the first entry), and then under the Actions menu select Allow. This will allow you to download and run the installer.

Once you have installed FSUIPC7, Go back to the main Virus & threat protection page, click on Allowed threats, select the entry just added (will be Trojan:Win32/nyonm) and click Don't Allow.

You will need to do this to install FSUIPC7 for the time being. Hopefully Microsoft will resolve this issue soon.

Note that when downloading from fsuipc.com you may also get an 'insecure download blocked' warning. This is a separate issue and is because the fsuipc.com site is still on http and not https (sorry, haven't had time to update this yet, been on my to-do list for several years...). Just click Keep (or similar) in your browser. The file itself will still be downloaded over https so this is not an issue.

For other users who are experiencing this, there is no point posting about this as it is a known issue. I will update this topic when I get a response from Microsoft or have any new information.

It also seems that the latest beta release doesn't have this issue (no idea why!), so you can also use/try this if you do not want to allow the current installer to run, available here: https://fsuipc.simflight.com/beta/Install_FSUIPC7beta.exe

John

[Reggie Fowler]

Sorry John don't know why that came up again but the beta version you gave me works fine.  

Thanks for you help.

Reggie

[John Dowson]

33 minutes ago, Reggie Fowler said:

the beta version you gave me works fine.

Yes - I don't understand why that one is fine and the other not, very strange,
I would like to release this a new version ASAP but SU15 should drop any day now so I am holding on for this, but if it doesn't drop in a day or two I will release anyway.

John

[Lawk]

The website is not encrypted, no https. Although the download itself leads to a https site. 

The file is flagged by Windows Defender as a Trojan. 

As we have no way to review the code.

I will not install it & wait for audit/fix. 

[John Dowson]

19 minutes ago, Lawk said:

The file is flagged by Windows Defender as a Trojan. 

As we have no way to review the code.

This is a false-positive and has been reported many times before. See 

 

21 minutes ago, Lawk said:

I will not install it & wait for audit/fix. 

If you don't want to install, that is up to you. But the fix for this must come from Microsoft in its virus updates, and I do not know how long this will take (it has been reported to Microsoft already). This is a false-positive, and you can install by temporarily allowing the installer to be downloaded and ran - instructions in the link I posted above.

John

[John Dowson]

Note that the trojan virus detected in 7.4.11 seems to have been corrected by Microsoft in Security intelligence version 1.409.501.0 (created 25/04/2024 03:28).

John