We should try to ban them off of lcpdfr please report all of there mods and try to ban them we cant have are mods turn to shit 

​They weren't on LCPDFR.

It's a good thing the only mods I ever use is simple native, LCPDFR, ELS, then standard car mods. I am not interested in all other misc mods except for vital ones like the police helper one. In GTA V the only mods i'll be using are SAPDFR until LCPDFR is released and again the Simple Native Trainer. I am not big on mods. It is a good thing I am not, and hopefully I never have to worry about such a thing....inb4 car mods contain these files as well. I hope not...

​Nothing wrong with being cautious.

You wouldn't download a random file on the internet without scrutinising it, would you? What's the difference here?

​Because this is really the first time malware/viruses have proliferated through GTA Modding on official sites like gta-mods. Also, when installing mods, anti-virus programs detect false-positives and people are used to ignoring the warnings, so at this point, unless the powers that be in the modding community examine new mods, I would not be comfortable installing them. This is a wake up call. I would only download mods from major, official sites that have been screened for malware. GTA5-Mods claims to be working on it.

Frankly shocked this hasn't happened sooner. Perhaps for now, only download mods from reputable sources and authors.

We'll be stepping up security on LCPDFR.com, including a full re-scan of our entire file database and a resumption of showing anti-virus scan results next to all files.

Discovered another mod that my anti-virus software suspected was malware. Proof here: http://gyazo.com/2da5cb4710886667f120b18952cb8b7e . The mod is supposed to add restaurants in GTA 5 like the ones in GTA 4, but now I say that it shouldn't be trusted. Use that ASI with caution

What website are they on because the only sites i use is GTA4mods.com lcpdfr.com and gtapolicemods what websites are they on

 

if you guys dont have antivirus program you should at least get a trial until you get the full version just be on the safe side

Yikes...with a new larger world much more fun and modifiable....GTA V....apparently with that comes PC modding's darkest. I am surprised this didn't happen sooner as well...i'll have to double check my downloads from here on out...yikes...a new dark era in GTA modding has opened....this wont be good. Here's hoping to the best! And with a game like GTA V where anything is possible....I guess it is true then....now everything changes but unfortunately not all for the better...god save us all! 

Edited May 15, 201510 yr by 1supermiguel

What website are they on because the only sites i use is GTA4mods.com lcpdfr.com and gtapolicemods what websites are they on

 

if you guys dont have antivirus program you should at least get a trial until you get the full version just be on the safe side

​They were released on GTA5-mods.com. This is run by the same people as GTA4-mods.com; it's pretty much becoming the standard site.

As for antivirus: Free antivirus generally works at least as well as paid.

So its only on gta4mods okay i dont use that website much but i will look out for that

You should always be cautious when downloading files from the internet, sadly. 

You should always be cautious when downloading files from the internet, sadly. 

This is kind of a surprise for a lot of people. Many people wouldn't expect modders to put harmful things in their downloads. I don't expect it, and this only makes Rockstar dislike the modding community even more. Regardless of what Rockstar says, it's kinda obvious that they aren't all too excited about modding for 5. 

Edit: Sorry if I sound very negative, but this is a negative situation. All I'm saying is that now Rockstar has a negative grudge to hold against the modding community. 

Edited May 15, 201510 yr by PeetePanda

Do we know for a fact that the Open Interiors mod has malware? Alexander Blade says he was looking into it on GTAForums. I know there was an article saying there was, but Blade said that it is pretty bogus. 

Why would these authors put a key logger on their mod? Is it really the author's who put the key logger? So they made these scripts to entertain people, then secretly steal information? Are modders really that bad today? I thought they were making mods just for fun. 

Do we know for a fact that the Open Interiors mod has malware? Alexander Blade says he was looking into it on GTAForums. I know there was an article saying there was, but Blade said that it is pretty bogus. 

Cyan said he found traces of internet traffic inside the mod, so to be safe, I'd remove it for now and run a malware scan.

I had the mod installed and other than an alt tabbing issue, I didn't find any harmful files or whatnot on my system. But to be safe, I deleted it and changed my password.

Edited May 15, 201510 yr by ineseri

Why would these authors put a key logger on their mod? Is it really the author's who put the key logger? So they made these scripts to entertain people, then secretly steal information? Are modders really that bad today? I thought they were making mods just for fun. 

​

I had the mod installed and other than an alt tabbing issue, I didn't find any harmful files or whatnot on my system. But to be safe, I deleted it and changed my password.

​Alexander Blade 'confirmed' that this mod is/should be safe.

Edited May 15, 201510 yr by TheUniT

Cyan said he found traces of internet traffic inside the mod, so to be safe, I'd remove it for now and run a malware scan.

I had the mod installed and other than an alt tabbing issue, I didn't find any harmful files or whatnot on my system. But to be safe, I deleted it and changed my password.

​Hm. This makes me worried. I hate to not trust GTA5-Mods right now, but I think that might have to be the case for awhile. I'll run a scan and see what I get.

 

EDIT: A quick scan showed nothing. Doing a full system scan to see if I find anything.

Edited May 15, 201510 yr by Ringo4493

​Hm. This makes me worried. I hate to not trust GTA5-Mods right now, but I think that might have to be the case for awhile. I'll run a scan and see what I get.

 

EDIT: A quick scan showed nothing. Doing a full system scan to see if I find anything.

​

Both Avast and Malwarebytes declare the file safe, and a full sys scan shows nothing. Also, there's none of the files that people on GTAForums are reporting come with the infected files. It seems like the interiors mod is safe, as Alexander Blade has looked into it and found nothing. 

GTA5-Mods is actually OK, at the moment it seems like the most popular V mod site.

I think that gta4mods banned them because when i search them up it does not show anything

​

Both Avast and Malwarebytes declare the file safe, and a full sys scan shows nothing. Also, there's none of the files that people on GTAForums are reporting come with the infected files. It seems like the interiors mod is safe, as Alexander Blade has looked into it and found nothing. 

GTA5-Mods is actually OK, at the moment it seems like the most popular V mod site.

​A scan won't always be good enough. The ASI can download the malware which then executes itself. It does what it needs to do, gets the information it needs, and then deletes the virus to cover any tracks. Plus, the ASI isn't the virus. The ASI downloads the virus. Antivirus softwares won't see the ASI as a virus. Any report should be taken seriously, since any ASI on that website could be the cause of malware

Why would these authors put a key logger on their mod? Is it really the author's who put the key logger? So they made these scripts to entertain people, then secretly steal information? Are modders really that bad today? I thought they were making mods just for fun. 

​The authors were most likely payed by the malware companies to have the virus downloaded by the ASI. Kinda sad when the modding community has some corrupt modders

NONE of the antivirus sofware currently detects the attack used by the two mods. The code that downloads fade.exe, the malicious file, and executes it is only accessible when scripthook runs the code. None of them are capable of reaching that code when trying to analyse the file. The only point they can detect it is when fade is being downloaded or executed. Even then, fade.exe appears to be detected by only 40% of antiviruses.

Noclip.asi detection rate:
https://www.virustotal.com/en/file/2ce282e6153e8cbf8bca500a5f9fb86256d1160214781fd89147563562a310fd/analysis/
http://virusscan.jotti.org/en/scanresult/35bfa4cf14a189415897bc76555da42b8fba9af4
https://malwr.com/analysis/ODUyZDA0NDA4ZjA3NGExMTkwYTU5ZTM0MTBhYTAyN2U/

Fade.exe detection rate (I assume this is the fade.exe the asi distributed):
https://www.virustotal.com/en/file/96fc6e090cb28dc36c35607fd8f189d62f044d2be18f43e39c58fd1ce2aa9336/analysis/

Edited May 15, 201510 yr by Sniper296
Correction, 40% detection rate