http://gtaforums.com/topic/794383-possibility-of-trojan-downloaderspyware-installed-via-gta-v-mod/#entry1067463416
 

The mods "noclip" by Xenos and "Angry Planes" by Onsby have been confirmed to have malware in them! They install fade.exe wich is a password stealing software!

DO NOT DOWNLOAD THEM!

And if you already have here some tips to get rid of them: Reddit   GTAForums

Edited May 14, 201510 yr by ineseri
Title edited and topic featured

.asi mods are just C++ .dlls with a different file extension. They should be treated with no less suspicion than any other binary downloaded from the internet. I am seriously surprised that this has not happened before.

<snip>

Edited August 2, 201510 yr by AlconH

Topic featured to spread the word. 

 

If you feel that this topic has been pinned in error, please report this post.

 

http://gtaforums.com/topic/794383-possibility-of-trojan-downloaderspyware-installed-via-gta-v-mod/#entry1067463416
 

The mods "noclip" by Xenos and "Angry Planes" by Onsby have been confirmed to have malware in them! They install fade.exe wich is a password stealing software!

DO NOT DOWNLOAD THEM!

And if you already have here some tips to get rid of them: Reddit   GTAForums

​I've already used both of those. I don't see how such things can be stored within a .asi. Huh. this explains a lot, no wonder avast and Malwarebytes picked up some shit. Already deleted the registry key it made with MBAM and avast blocked the exe from running and ridded of it, I think I should be fine.Could of been unrelated though.  If this is true then report those downloads (Unless they are already taken down)

Edited May 14, 201510 yr by Sonny236

<snip>

Edited August 2, 201510 yr by AlconH

​A .asi file is basically a .dll file. A .dll file is a collection of programs or pieces of code that the software can call upon when needed.

If the malware is placed inside the .asi file, it can then be invoked when the script is run.

​Ah I see. Well I'm gonna do a boot time scan later anyways, I've already checked where this fade.exe is supposed to be located and theres nothing of suspcision in my temp or appdata at all. MBAM didn't find anything either. gonna avoid them from being downloaded though.

EDIT: After reading through that thread fully it seems this sucker got as far as trying to run Init.exe which avast blocked. Which is when I scanned and found the startup registry key and ridded of that too. I never found fade.exe or anything alike which is strange, and it could still be lurking about my system. hope that scan works.

Edited May 14, 201510 yr by Sonny236

<snip>

Edited August 2, 201510 yr by AlconH

An ASI isn't basically a DLL, it's literally a (native, not .NET) DLL. The DLL-to-ASI process consists of renaming the DLL file from ".dll" to ".asi". DLL files in Windows are also essentially the same as executables; the file format is identical, the only real difference is that DLLs can't be launched into their own address space. Anything bad you can do with an EXE can be done just as easily in a DLL; you just have to get something to load the DLL and call a function.

<snip>

Edited August 2, 201510 yr by AlconH

I hope this does not destroy confidence in the modding community. Now every mod people download will be questioned as to whether or not it is a virus.

<snip>

Edited August 2, 201510 yr by AlconH

I also hope that modding isn't affected by this. It's not necessarily the modders that will be affected, more so the moddèè's, persè. 

I've posted a PSA to a couple of subReddits now, let's hope that everyone has the sense to read it. Laziness saved my life, if I weren't too lazy to swap out RPFs I'd have probably fallen victim.

O/T in spoiler.

I also hope that modding isn't affected by this. It's not necessarily the modders that will be affected, more so the moddèè's, persè. 

​Moddee, per se. Neither are French - the former is pseudo-English, the latter is Latin.

Edited May 14, 201510 yr by EvilJackCarver

​I've already used both of those. I don't see how such things can be stored within a .asi. Huh. this explains a lot, no wonder avast and Malwarebytes picked up some shit. Already deleted the registry key it made with MBAM and avast blocked the exe from running and ridded of it, I think I should be fine.Could of been unrelated though.  If this is true then report those downloads (Unless they are already taken down)

​They were not actually stored inside the asi, the asi downloaded the malware, that is how it evaded all virus and malware scanners. Luckily, for some, the files it did download were caught before they could do any damage.

asi shows clean because antivirus has no signature match , so it goes into dynamic analysis i.e. emulating library execution and finds still nothing because this stuff is called only when script starts ingame (no proper environment for antivirus) , so there will be signatures in av bases soon for the downloader function inside asi , signatures for logger which it is downloading are already in 1/4 of antiviruses

I've posted a PSA to a couple of subReddits now, let's hope that everyone has the sense to read it. Laziness saved my life, if I weren't too lazy to swap out RPFs I'd have probably fallen victim.

O/T in spoiler.

Hidden Content

​I did feel kinda weird typing that, thanks for the heads up man.

 

​They were not actually stored inside the asi, the asi downloaded the malware, that is how it evaded all virus and malware scanners. Luckily, for some, the files it did download were caught before they could do any damage.

​Oh, I see. Well I did change my passwords just incase, I never found any signs of life from "fade.exe" or any of its variants, nothing im temp besides init.exe which tried to run from AppData, then avast got rid of that. Already deleted all the registry keys associated with it. It's pretty sneaky, this is scary knowing such thing can not really be prevented just by scanning the .asi file, I wonder how gta5-mods and other sites are going to handle this.

​Oh, I see. Well I did change my passwords just incase, I never found any signs of life from "fade.exe" or any of its variants, nothing im temp besides init.exe which tried to run from AppData, then avast got rid of that. Already deleted all the registry keys associated with it. It's pretty sneaky, this is scary knowing such thing can not really be prevented just by scanning the .asi file, I wonder how gta5-mods and other sites are going to handle this.

​Yeah just make sure if you've ever used any Bank Companies such as PayPal or Visa change your passwords on those, or if you used someone else I would advise them to change them.

Wow what a piece of shit. I had the Angry Planes and sure enough I found all those files the same day I downloaded it.

We should try to ban them off of lcpdfr please report all of there mods and try to ban them we cant have are mods turn to shit