Warning for all AIG Users - Security Scam Alert!

[RaptyrOne 1,447]

This evening I decided to open up AIG's AI Manager to install a few extra liveries. All went according to plan. I then decided to click on the Red button "Repair missing Paints" just to check all was in order. Process ran Ok until I reached the Airline NordStar, It required a manuaI download, so I selected Ok. A blank webpage opened and then a few more pages flashed up followed almost immediately by a pop-up message in the bottom right of my screen warning I have a virus and must click a button to clean. Now I'm not an word not allowed, was not going to click that button. Then I would no doubt have a virus for certain! This message continually came up every few seconds even when I closed AIG Controller and the browser. So, I rebooted and again, the warning - Your PC is Infected, click here to clean (or something along those lines) message popped up incessantly. Big red font and warning symbols. Quite alarming even for a somewhat PC savvy person. 

So, absolutely not a dig at the amazing team at AIG but heads up - not a good idea to use the manual install function. I will NEVER use it again. This has the potential to turn a good DAY into a really bad YEAR!

 

Just for info, what I did to fix this. I figured out quickly it was not a virus or malware. More like adware running thru the browser. So what I did:

1. Went into Notification Settings - disabled the notification for yowa (dot) co (dot) in. which had suddenly appeared as the top entry in Notifcations list (Settings - System - Notifications). Rebooted. That seemed to stop the incessant warning message boxes popping up.

2. Went into Edge and deleted all cookies, every last one - yowa (dot) co (dot).in was in there too. I had to repeat this twice. On the second attempt I set all aspects of the cookie to disabled. Rebooted again and deleted. This time it was gone from the cookies list.

3. Ran a Quick Scan using MS Defender - no reported issues. 

4. Ran Regedit, searched yowa (dot) co (dot) in and found THREE entries. Went ahead and deleted all three registry Keys entirely. Rebooted.

5. Added yowa (dot) co (dot) into the blocked list for saving and reading cookies in Edge Settings - probably not necessary but an added safety net.

6. Made a note to myself - NEVER EVER again try to install a manual livery with AIG AI Manager.

 

[voske 36]

10 minutes ago, RaptyrOne said:

Process ran Ok until I reached the Airline NordStar, It required a manuaI download, so I selected Ok. A blank webpage opened and then a few more pages flashed up followed almost immediately by a pop-up message in the bottom right of my screen warning I have a virus and must click a button to clean.

My guess is that the manual download would be from the United Traffic Team website, which is down. You might want to be careful with other Russian airlines that use repaints from United Traffic Team.

[orchestra_nl 947]

39 minutes ago, voske said:

My guess is that the manual download would be from the United Traffic Team website, which is down. You might want to be careful with other Russian airlines that use repaints from United Traffic Team.

I hope one day AIG will be able to host all the liveries and models themselves but there are possibly legal reasons and certainly bandwidth costs that might that unlikely.

[TomCYYZ 218]

I ran the "Repair missing Paints" today as well, but did not have any issues with manual downloads. I have seen it though in the past, did the manual download, but I had never experienced the Virus message.

[Kaiii3 1,980]

UTT's website has been hosted in the Ukraine, since the start of the war there have been regular downtimes. The last downtime sadly has been there for more than a year now. We have keept the URLs to the website in our database in the hopes that the site will return one day....

Seems now the site has gone for goods - might be even taken over by some hostile actions. We are in the process of removing all links to the website from our flightplans and database. Till this is completet we advice to disable manual downloads in AIM.

The downsite of the DB removal is that all SimObjects that required the UTT website will be marked as invalid and be removed from the system (should only effeft P3D)

[RaptyrOne 1,447]

6 hours ago, voske said:

My guess is that the manual download would be from the United Traffic Team website, which is down. You might want to be careful with other Russian airlines that use repaints from United Traffic Team.

Yes, you are correct, there was definitely something about United that flashed on one of the web pages in the milliseconds before this all unfolded.
I have since removed NordStar from my installed liveries to be sure I don’t run across this one again in the future.

 

[Kaiii3 1,980]

we have updated all flightplans so you can install those again without the UTT urls - but sadly ofcause without the repaints as well 😞