Jump to content

Sign in to follow this  
KingGhidorah

Virus Warning, need some recommendations

Recommended Posts

Just got a popup.

 

Object: C:\programfiles(x86)\EZCA\EZCA.exe

Threat: a variant of Win32/Packed.Thermida suspicious application

 

Error while Cleaning

Event occurred during an attempt to run the file by the application C:Windows\System32\rundll32.exe

 

 

My option is to Delete or to Ignore, and if I delete it, then there goes Ezdok.

 

 

I had booted up the computer and hadn't run FSX or done anything at all.  Ezdok has been installed for years now, and no recent updates or changes to it.  I recall seeing the same "Thermida" thing once or twice associated with a Flight1 wrapper, and it was a false alarm. 

 

What would my fellow flight simmers do with this?  Ignore it?  I don't want to have to go through the rigamarole of reinstalling Ezdok, and having to fool around with setting it up again.  My inclination is to blow it off.   Has anybody else gotten an alarm on this recently?

Share this post


Link to post

I am no computer expert, I haven't even heard of that "Thermidor" thing before, so I might be wrong here. However, I have the feeling that a. given the amount of people using Ezdok (and its relative age, plus no recent updates) it is unlikely that it actually is dangerous, and b. you say that this particular warning occured to you in context with the Fligth1 wrapper (which IIRC is also how Ezdok is sold?), which I also highly doubt to be malware.

Furthermore, I have had the experience that certain Anti-virus programs regard many flight sim addons as potential threats, simply because they're not so common. Why shouldn't that be the case with this particular program?

So ultimately, I'd most likely try to have a closer look at what Ezdok might be doing, but in general I would still consider it safe and ignore the warnings.


Florian

Share this post


Link to post

You may also be able to go to your Anti-virus program and tell it that EZDOK is a safe program and to ignore warnings for it.


Charlie Aron

Awaiting the new Microsoft Flight Sim and the purchase of a new system.  Running a Chromebook for now! :cool:

                                     

 

Share this post


Link to post

Probably a false positive... Ask the ezca forums....


|Ryan Butterworth|

| i7 4790K@4.4GHz | 32GB RAM | EVGA GTX 1080Ti | ASUS Z97-Pro | 1TB 860 Evo | 500GB 840 Evo Win10 Pro | 1TB Samsung 7200rpm | Seasonic X750W |

 

 

Share this post


Link to post
King,

 

I got the same alert, and NOD32 quarantined the EZCA.exe file. Like you, I've used EZDok for many years without problems.

 

Here's how I fixed it in NOD32:

 

1. Go into Quarantine, right-click on the file and choose Restore.

 

2. Go into Advanced Setup/Exclusions, select Add, then browse to EZCA.exe and Open it.

 

That did it for me.

 

Just a guess, but I'm assuming that this occurred after a NOD32 virus database update, and there must be a new virus out there that looks a lot like EZCA.exe.

Share this post


Link to post

 

King,
 
I got the same alert, and NOD32 quarantined the EZCA.exe file. Like you, I've used EZDok for many years without problems.
 
Here's how I fixed it in NOD32:
 
1. Go into Quarantine, right-click on the file and choose Restore.
 
2. Go into Advanced Setup/Exclusions, select Add, then browse to EZCA.exe and Open it.
 
That did it for me.
 
Just a guess, but I'm assuming that this occurred after a NOD32 virus database update, and there must be a new virus out there that looks a lot like EZCA.exe.

 

Wish I'd seen this thread before uninstalling EZCA - 'coz now even updates 1.16 and 1.17 are zapped by NOD32 :diablo: Original 1.15 from the Flight1 wrapper installs OK.  Looks like I'm going to have to disable NOD32 altogether while installing and then, as you suggested, add EZCA.exe to the exclusions.  Agree it's most likely that a new threat has characteristics too similar to EZCA.exe for NOD32 to ignore, why else would this start to happen right now and not before.  What a nuisance... :mad:

ADDENDUM : got EZCA installed again, and exclusion for EZCA.exe added to NOD32 after which no further nuisance reports (for now).  I also sent the file to ESET as a possible false positive.  Hopefully they will check it out and do something about it.


Cheers,
Emile Bax.

ugcx_banner.png&key=01b5683e492e3b742827

Boeing777_Banner_Pilot.jpg

Share this post


Link to post

When I came apon this post, I couldn't resist offering a bit of advice that I know could help anyone using a Windows OS and especially Flight simmers.

 

I don't use Anti virus, Malware or any other security software. Not needed.

 

Daily Continues Mirror Image Backup !!

 

This has proven to be the only way to ensure my flight simming experience continues without frequent disasters.

It's no fun starting over.

 

My snapshot history goes back 380 days.

Best of all, I can go back to yesterday when FSX or P3D worked perfectly.  :-)

 

Cheers

Steve

Share this post


Link to post

Themida is a copy protection suite that encrypts executables. It's semi popular among weak malware developers, it can be used to hide the payload code of malware, therefore it's sometimes flagged by antivirus. It's not actually malware in and by itself


vatsim s3

1133704.png

Share this post


Link to post

I use Carbonite.

 

I like it because it's automatic, continues online backup of all my important files.

 

It daily or apon request takes mirror image snapshots of my C/ drive which contains Windows 8.1 and FSX to an external USB drive. This all takes place quietly in the background while I use the computer.

 

Daily snapshots is the key.

Weekly isn't frequent enough, When things go wrong it's usually not expected. Restoring an image works great but if several days has past it's hard to remember what changes, settings, installs, have been made. When snapshots are taken daily, restores are almost seamless.

 

I had nearly given up MSFS several times because of unresolvable issues that required a do over. No fun at all !

 

This is no longer a worry.

It's twice saved me this horrible experience of starting over and re-installing everything again.

 

Free trial is available.

 

Cheers

Steve

Share this post


Link to post

This is an automatic message.

 

This topic has been moved from "MS FSX Forum" to "Hangar Chat". This move has been done for a number of possible reasons.

  • The most likely reason is that the post was off topic.
  • The topic could also have contained images or a video that were not appropriate to the original forum it was posted in.
  • The images might not have been "illustrative" or "explanatory" in nature.
  • The topic could have been moved because we deemed it to be more appropriately placed elsewhere.
Please ensure that your posts are "on topic" and contain illustrative images or videos as appropriate. Do not post videos or images just for entertainment purposes anywhere but in the screen shot or video forums. See our image posting rules here.

 

Members who continue to post off topic posts can be denied entry to specific forums in order to reduce and remove the practice. Your cooperation is appreciated.


ADMIN BOT... Do not PM or send Email.

Share this post


Link to post

Just to append it to the prior discussion for those who might encounter the same and wonder, I just got an identical Thermida warning on TOPCAT, on a different computer.

Share this post


Link to post

 

King,
 
I got the same alert, and NOD32 quarantined the EZCA.exe file. Like you, I've used EZDok for many years without problems.
 
Here's how I fixed it in NOD32:
 
1. Go into Quarantine, right-click on the file and choose Restore.
 
2. Go into Advanced Setup/Exclusions, select Add, then browse to EZCA.exe and Open it.
 
That did it for me.
 
Just a guess, but I'm assuming that this occurred after a NOD32 virus database update, and there must be a new virus out there that looks a lot like EZCA.exe.

 

But it must be a virus if the computer says it is?


538923.png             

 

 

Share this post


Link to post

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  
  • Tom Allensworth,
    Founder of AVSIM Online


  • Flight Simulation's Premier Resource!

    AVSIM is a free service to the flight simulation community. AVSIM is staffed completely by volunteers and all funds donated to AVSIM go directly back to supporting the community. Your donation here helps to pay our bandwidth costs, emergency funding, and other general costs that crop up from time to time. Thank you for your support!

    Click here for more information and to see all donations year to date.
  • Donation Goals

    AVSIM's 2020 Fundraising Goal

    Donate to our annual general fundraising goal. This donation keeps our doors open and providing you service 24 x 7 x 365. Your donation here helps to pay our bandwidth costs, emergency funding, and other general costs that crop up from time to time. We reset this goal every new year for the following year's goal.


    22%
    $5,550.00 of $25,000.00 Donate Now
×
×
  • Create New...