Hi folks, I have run into an unfortunate situation, one that will cause me to reinstall FSX, a tedious and painful experience for me because I have so many addons. Ever since I built my I7/windows 7 64 system back in April 2010, I have not had a reason to reinstall FSX. Before that time, I would tend to reinstall every few months because of various issues, such as tweaking and messing things up, or because I had hardware failures. But that lucky streak of a stable OS/FSX installation has ended, as I was hit with a nasty zbot virus on my OS drive. Although I can access FSX and all my programs ok, I know that the virus is lurking in the background, and only a complete wipe of the hard drive/reformat/reinstall of the OS will give me back my piece of mind. My AV will not remove the virus, and it is one of those viruses that compromises your system by killing your firewall, disabling certain AV features, and installing keyloggers and other malware that tries to get your passwords to wreak havoc financially.

 

My FSX installation is on a separate hard drive, but I know that the program and most of my addons have registry entries saved on the OS drive. I want to know, even though I have to start with scratch on the OS "C" drive, is there any possibility that I can leave the FSX drive intact, and somehow get the new OS to recognize the FSX links to the registry? Perhaps I could backup my registry now, and reimport the registry after reinstallation of the OS? It probably wouldn't make any sense to import the entire old registry, but maybe I could import just some entries, like those related to FSX and addon software? As an FYI, I follow file backup protocol like a religion, and always backup all my FSX cfg files, afcads, and addon databases (like Ultimate Traffic 2's roaming app data folder and EZCA settings) weekly. And to help with the migration, I opened FSX and took screenshots (thanks to W7's nifty Snipping screenshot tool) of various settings screens. So when the FSX reinstall happens, I believe I can restore all the functionality I currently enjoy and have saved all the time I have invested tweaking the many sliders and other preferences in FSX and my addons.

 

I accept that I will have to bite the bullet and take my time carefully reinstalling FSX and everything else over the course of days or weeks, but I would love to see if I can save myself some time and grief.

If I was in your shoes I would look at installing commercial antivirus software which can remove zbot rather than go through the format and restore everything approach. You could even install a 30 day trial of norton or trend micro to get rid of this thing under your trial period. This has to be better than reinstalling everything.

 

Were you using commerical antivirus or a free version?

 

Note of zbot i found using google

 

Roy

 

 

The best way to find and remove zbot! is through software. Antivirus or antimalware programs should be able to locate, quarantine, and eradicate this threat. If you don’t have antivirus software, you should get some immediately, especially if you suspect this or any other infection.

Once you have security software, run a full system scan to look for any threats. All found parasites will be quarantined, and you will be able to delete them in a few quick clicks. Some malware is known to hide from antivirus programs; you may need to utilize a second piece of software to make the detection and removal happen.

It is easier to block a threat such as the zbot! virus than it is to delete it once it has taken up residence on your system and started to cause problems. In fact, some computers are unable to be secured again once backdoor access has been created by a malicious program such as this. Having antivirus on and current at all times can prevent infection in the first place by blocking malicious software from being downloaded at all. Scan any new files, folders, or programs you download in and attempt to block a nasty parasite like zbot! from ever getting on your system.

You can re-install all your registered add-ons, I do it regularly. Some installers will just blanket the new install over the old one, some, like aircraft with custom liveries, are only a little trickier. Say you want to re-register your NGX, but you don't want the installer to re-write your precious aircraft.cfg, you already know it will ignore the extra livery folders. You can 1) make a back-up of your aircraft .cfg, install then replace that document, or 2) put a number "1" next to the title of every folder that represents the NGX (PMDG 737-600NGX becomes 1PMDG 737-600NGX, PMDG 737-700NGX becomes 1PMDG 737-700NGX, PMDG 737-700NGX WL becomes 1PMDG 737-700NGX WL, etc through the series) then after you re-install the NGX, simply delete the installed folders, remove the "1" from the titles of the others and voila, the aircraft is available with all working instruments in your antibiotic'd computer.

 

In fact, some computers are unable to be secured again once backdoor access has been created by a malicious program such as this

This is rich, the stuff superstition is made of. I will accept that some operating systems are unable to be secured again once backdoor access has been created. No offense, I know it was a copy/paste.

"Hey, Joe, look here; what's this on the back of this guy's computer case?"

"Ach, looks like zbot! again, see where that little wi-fi port has been welded in? Ya, we aren't going to be able to secure access to this computer..."

When I rebuild my PC I export the HKCU and HKLM Software keys from the registry first - this gives you two big .REG files that can be editted in Notepad.

You can find and cut out the program you want, maybe edit for changed locations, save just that text as <prog>.reg and then double-click that .reg file in Explorer.

Usually works but haven't tried if for FSX or addons (yet).

 

I wouldn't recommend it unless you are fairly clued-up though, and would suggest a normal reinstall first - just do the reg thing as last resort, and be careful.

 

Definitely do not double click the big exported REG files - this will add huge amounts of **** into your registry and probably lead to another reinstall.

 

Cheers

Keith

Sweet, love the reg keys export. Gonna have to remember that one.

The reg keys export sounds like a great idea indeed! That is just what I had in mind, why reinstall FSX if 90% of its contents are already on a separate drive? I will proceed carefully with this "experiment", as I know that the registry is a very delicate file system. I am thinking of doing the following:

 

- Clean install Windows 7 on a new 1 TB hard drive (C Drive). The FSX drive (D Drive) will remain in the same state it is in now, the only thing is the new OS will have no record of where FSX and the addons are installed. That's where the next step will come into play.

- Try to import FSX specific reg keys, one at a time of course.

 

Hopefully, I can at least salvage the main FSX folder structure. There are some addons I have installed in my OS drive, like Active Sky and GEX, but I have no problem reinstalling those from scratch. At this point, I'm in uncharted territory, but I have the time and patience to attempt this project. I have always been curious about the relation of programs that reside outside the C drive to the C drive registry, and it looks like I will soon find out. If there is one thing I have learned from this experience, I need to be more diligent about my backups, and I may want to invest in a more complete, painless way of backing up the OS and FSX in case of future virus threats or unforeseen hardware issues. That may involve getting into doing complete hard drive archives/saved states via disk images. In this day and age, virus and malware threats are all too common, and I was complacent in thinking I was immune, even with my AV software and firewall. If not for FSX, I wouldn't be as concerned about reinstalling programs or the OS, but my FSX installation is a behemoth, and with all the specific settings and addon sceneries/utilties, it's a major PITA to recover from disasters like the one that has befallen me.

 

EDIT: I have changed my mind about importing reg keys. There is no guarantee it will work, and there are just too many reg entries scattered all about the registry to keep track of. I have done some further research on a proper FSX backup strategy, and I have decided on what is the most responsible course of action from this point forward: Disk Drive image backups. For now, it is best to just do the clean install of the OS, FSX, and the billions of addons, but from now on I am going to keep a weekly backup of my OS and FSX on an EXTERNAL USB drive so that I'm prepared for any future calamities! This post has been an epiphany for me, I only wish I had known about this earlier: http://forums1.avsim.net/topic/29195...fsx-insurance/

 

Guys and gals, I can't stress this enough, you must backup, and if you want to save yourself the hassle of installing from scratch, you must do complete hard drive image backups. My previous stategy of piecemeal backups of individual FSX folders on a connected, but separate, hard drive was woefully inadequate. Image backups and automated software to help with the backup make the process easy, and to be able to recover in a matter of minutes or hours versus days or weeks is all the convincing I need.

"only a complete wipe of the hard drive/reformat/reinstall of the OS will give me back my piece of mind"

 

I'm going to stick my neck out and suggest that you should reformat and install everything from scratch. You'll have total piece of mind, a sense of accomplishment, and a fresh well documented FSX install that you know is clean.

when your done crashplan.com $5/month has already saved my butt.

Guys and gals, I can't stress this enough, you must backup, and if you want to save yourself the hassle of installing from scratch, you must do complete hard drive image backups. My previous stategy of piecemeal backups of individual FSX folders on a connected, but separate, hard drive was woefully inadequate. Image backups and automated software to help with the backup make the process easy, and to be able to recover in a matter of minutes or hours versus days or weeks is all the convincing I need.

Respectfully, you are mistaken. Generally, when I run out of room, I purchase a new hard drive, find and empty SATA port and plug it in. Then I install base FSX, then Acceleration. Then I locate my previous FSX folder and copy that over my fresh install. I have several iterations of FSX I keep that way, that were lovingly built up over the years or months. Some still work when the computer is booted from the OS version associated with that drive. To deal with the registration/registry issue, I have copies of all my installers. Things like REX and ORBX don't give a whit, PMDG and Abacus are a little more particular. Again, if I find the PMDG MD-11 has black gauges after a "port over," I rename it's aircraft folders, run the installer, then un-rename the aircraft folders, done. No days or weeks involved.

 

It is said that people who obsessively disinfect their computers have trouble distinguishing cyberspace from their personal avatar. Cleansing "cuts off" that gray area and defines the edge of one's own identity. As children, these people were likely to retain little bits of their own code, for fear they would "trickle away" into oblivion otherwise.

Thanks for all the suggestions folks. I have reinstalled W7 on a brand new hard drive, and I am now going through NickN's OS and FSX setup guide to optimize the new install. It's going to be a lot of work, but in a way, sometimes it's nice to start from a clean slate, especially after 2 years of accumulating all kinds of junk and software I never use. Phew!

 

Anyhow, I learned some valuable lessons on the ever present dangers of malware and viruses, this experience was a wake up call, and rather than curse over having to reinstall everything, I am now very vigilant of the dangers of the web and feel confident that with a proper AV/malware scan and weekly drive backups, I can minimize the chance that I will go though another catastrophic event like the zbot virus infection on my system. Because I had things so good for so long, I became complacent and let my guard down, and I was punished for it. I value your suggestions, I definitely plan on using some new apps to help fight the war on malware (i.e. combofix).

I can vouch for the ComboFix post. My son's computer was unusable because of a virus, I used ComboFix and it worked. I've also recommended it to others who've also had success with it. As far as a complete format and re-install, I just did that. I purposely left out most of the "add-ons" that have piled-up over the years like planes and scenery. I mostly fly in the Pacific Northwest so I loaded some add-ons like ORBX NA (All), UTX, GEX, FSGenesis, and REX plus Overdrive and my sim is so much snappier. I also added my Carenado planes and a few others. I decided to go minimalistic this time and am quite pleased with my "new" sim.

I decided to go minimalistic this time and am quite pleased with my "new" sim.

 

Exactly! I try to run a lean and mean FSX install, in fact, I even removed some default FSX aircraft because I wanted to improve the initial load time, and since I only fly the PMDG NGX, I moved the other PMDG birds I own out of the FSX folder, thinking I may go back to them, but lets be honest, I probably won't. But I have tons and tons of scenery in the library that I seldom see. Ever since I got the NGX, I mostly fly just in the U.S. When I rebuild FSX, I am only going to install the U.S. specific sceneries, and if the mood strikes to go offshore, which will definitely happen when the PMDG T7 arrives and I resume real long hauls, I can then go though the torture of reinstalling the rest of the world airports and scenery!

The one thing on trying to do just an OS reinstall and keep FSX is simconnect. It seems like every version from RTM is kept and it has numerous settings in registry. If you have the sdk, I guess you can install simconnect from there, just not sure if it ends up the same as when you install fsx. Don't know if "repair" can fix it, never tried repair.

 

I think doing everything from scratch gives you some peace of mind. Otherwise everytime you get a CTD or OOM you start wondering if it was due to how you restored fsx.

 

scott s.

.

if you uninstall fsx aircraft keep in mind it will effect your AI numbers. Agreed its good to lean fsx content, you can save a lot of space by deleting scenery that you only used once.

I use UT2 for AI, not the default FSX aircraft. That being said, I do have a few AI files (namely some ORBX sceneries that install their own GA AI traffic) that use some FSX aircraft, so I have decided to just leave the FSX aircraft in the simobjects folder. I don't believe I'm really saving that much time on startup by removing them, and also, some of my AI sounds reference such default aircraft.