FS2002 and Spyware/Virus/Worm

[hmar 0]

Hello,I have the 4sec "stutter bug" and I checked everything in trying to solve it. Sometimes I can make it better for a few hours but it returns. So I did some investigations and what did I found:When I start up FS2002 with a flight, some module wants access to the internet when FS is downloading the scenery textures. If I block the internet access with Zonealarm, FS2002 and my computer will hang after a few minutes. When I do not block internet access, the system will do every 4 seconds a read access to the disk, causing the stutter or a "hiccup", especially visible in "spot plane mode". This is a report of Zonealarm:The firewall has blocked an Internet multicast to your computer (IGMP Query) from 10.95.1.210.Occurred: 2 times between 9/12/02 8:32:46 AM and 9/12/02 8:34:46 AMNo other "attacks" are in the log file, but something in FS2002 must be activated this. How can I remove this malecious software ? I am sure it must be caused by some module loaded by the instalation of a third party airplane or scenery. How to detect wich module is to blame?Thanks in advance!hm

[Guest]

Would have to be a module that's loaded on FS startup, and is not part of the original distribution.Maybe if you make a list of those and post it here, people can help identify those that are not to blame (also post filesizes and DLL version numbers if you can, makes it easier to track down files that might have been corrupted).OR maybe it's a background program that has nothing to do with FS at all, but is triggered by a high CPU load.

[hmar 0]

Hi,This is the directory of my fs2002modules. Any one recognises themodules in question ?20/09/01 2:00 86.087 ablscpt.dll20/09/01 2:00 45.128 acontain.dll 6/06/02 20:15 106.496 ActiveCamera FS2002.dll20/09/01 2:00 49.222 advdrv.dll20/09/01 2:00 143.432 ai_playr.dll20/09/01 2:00 237.635 atc.dll20/09/01 2:00 32.837 chain.dll20/09/01 2:00 151.624 controls.dll20/09/01 2:00 53.318 damage.dll20/09/01 2:00 65.604 demo.dll20/09/01 2:00 36.935 dynamic.dll20/09/01 2:00 184.394 facilities.dll20/09/01 2:00 118.850 fe.dll20/09/01 2:00 159.814 flight.dll20/09/01 2:00 114.757 fsres.dll23/08/02 20:28 58 FSSound-Read-me.txt12/11/01 0:53 13.312 FSSound.dll 9/09/02 17:29 111.616 FSUIPC for Advanced Users.doc 9/09/02 16:56 165.376 FSUIPC History.doc 9/09/02 18:03 223.232 FSUIPC User Guide.doc 9/09/02 18:04 454.124 FSUIPC User Guide.pdf 9/09/02 12:04 4.135 FSUIPC.1.log10/09/02 10:48 307.274 FSUIPC.dll11/09/02 11:54 1.792 FSUIPC.ini20/09/01 2:00 168.003 g2d.dll20/09/01 2:00 438.339 g3d.dll20/09/01 2:00 28.742 global.dll20/09/01 2:00 131.140 gsfs.dll 4/04/02 0:39 196 If you cannot see the DLL.txt20/09/01 2:00 24.650 instructor.dll20/09/01 2:00 245.828 main.dll20/09/01 2:00 24.646 mpchat.dll20/09/01 2:00 106.571 multiplayer.dll20/09/01 2:00 36.935 numeric.dll20/09/01 2:00 323.654 panels.dll20/09/01 2:00 24.647 reality.dll20/09/01 2:00 516.164 sim1.dll20/09/01 2:00 24.644 slew.dll20/09/01 2:00 61.509 sound.dll20/09/01 2:00 36.934 symmap.dll20/09/01 2:00 348.231 terrain.dll20/09/01 2:00 77.895 traffic.dll11/06/02 11:54 81.920 TrafficLook.exe24/01/02 17:45 1.551 TrafficLook.txt20/09/01 2:00 98.372 util.dll20/09/01 2:00 278.600 visualfx.dll20/09/01 2:00 184.391 weather.dll30/05/02 13:08 106.585 WeatherSet.exe25/02/02 14:35 4.848 WeatherSet.txt20/09/01 2:00 81.990 window.dllThanks,hm

[Guest]

It could also be a gauge doing this. Try changing your default plane/panel to something else with different gauges.Doesn't zonealarm tell you what is trying to access the internet when it pops up?The log entry is just a blocked ping from somewhere, and isn't relevant to whatever something in FS2002 is trying to connect.King

[rcbarend 37]

Does your FS2K2 gets real weather data from the Internet ??Rob

[hmar 0]

This IP is only "pinging" me when I play with FShm

[hmar 0]

I use it occasionally, but if the system is indeed trying to download real weather I would love to go on vacation in Switserland because every day the same nice clear weather is scheduled for the flight :-) .hm

[John_Cillis 2,406]

First, run a scan of your system with Adaware, if you haven't done so already.Someone suggested a gauge might be the source of the issue--a very wise thought. Remember that gauges are essentially dll's with a .gau extension. To rule this out, start FS with one of the default aircraft.... Take any module that is not a default FS module, and remove it to a backup location. Use the time/datestamp as your guide. Run FS2002, and see if you still see the stutter and/or pinging. If not, replace the modules one by one, restarting FS2002 after each time.... It is an easy way to find out if an add-on module is the cause.If you have a high speed web connection, disconnect it... See if you get any odd error messages that might reveal an odd piece of spyware on your system.There is also a worm that is not caught by many virus checkers....but it leaves evidence behind in the registry startup vectors. It often has an official sounding, but completely bogus name, like sysinf32.exe, for example. Usually these critters will show up in the O/S's system folder.... Easy to kill--you just delete the registry entries, then the bogus file.Hope some of this helps....-John