Malware inside Angry Planes & Noclip Mod

[Drkz]

 

 

Hey look, some guy decided to be a c*nt and put malware inside an ASI mod and now people are paranoid and want to label all ASI mods as unsafe. Seriously, this is pretty silly and probably what the guy wanted in the first place.

Yeah, anyone can come out the wood to spout obvious and judgemental sentences like you did, except it doesn't help with anything and i hope you realize that.

 

People will consider .asi as the devil now, there's no other way around it. I don't need to prove my words, the comment section of asi mods page will do it for me in the next few days. Every new file will be drowned under "is this file safe ???????????????? i want to use it for my next xXXDuBsT3pXXx 420 mod review but i don't want virus!!!! pls respond" type of comments.

 

No. This situation can happen again and probably will. GTA V is an extremely popular title with a very young userbase, which means lots of download, which means gigantic spread potential. Letting such a situation without control is a perfect recipe for disaster. Be glad it was just a "standard" sh*tty password stealer.

 

I understand that this is a problem, but the idea that we label ASI mods as the devil and never download them again is absolutely stupid. If we went by that logic nobody should download anything on the internet again, it might be 'unsafe'.

 

It happened once, I doubt it'll happen often. Throwing up big text saying a mod is potentially unsafe because it's an ASI is silly and just makes the community smaller by scaring people away.

 

This has happened before with previous GTA mods. GTA games has always had an extremely popular audience with younger people. But when stuff like this happened before, nobody went around calling some mods unsafe and acting like we should never download them again.

 

EDIT: To sum it up, if you're paranoid about getting a virus from installing mods, then you shouldn't be installing mods in the first place.

 

 

Nobody said that though. What has been mostly said is that the actual system is a bit too laxist and needs to be improved. The goal is not to scare people away, but to warn them.

 

Besides "mods" is a very broad term. A texture pack is a mod, a sound pack is a mod. And correct me if i'm wrong, but a .rar archive with some sounds or textures in it sounds and looks infinitely safer than a compiled file like .asi that can basically do whatever the f*ck it wants on your computer. So to sum it up it's not about being paranoid about getting a virus from installing mods, it's being paranoid about installing something in .asi.

 

I'm sure you can see the differences and why you can't make such comparaisons and broad statements. Asi, for an average user (like me or someone else) is opaque as f*ck. You don't know what's inside, and most of the time (expect if you have some previous knowledge or you do some dedicated research like OP) you can't know what's inside.

 

Plus, i could potentially do what it wants. There's a lot of implications with .asi, too much implications, and i don't think we can just rely on "trusting" modders to avoid getting infected. There's of course people that you can trust right off, like the people that made modding GTA V possible in the first place, but outside of that i don't think giving your trust and computer away to a random joe with his random noclip mod is a good idea. This is a recipe for disaster.

 

That's honestly it.

Edited May 14, 2015 by Drkz

[EnforcerZhukov]

Hi all, damn, what a crazy shiet today. I wanted to play the game and i found this new.

 

Well, i used the mod and first of all I deleted it. I searched my registry and found nothing with "fade.exe" or "init..exe".

 

On second term, i passed a test with Malwarebytes and Panda Free. The antimalware found nothing (just the typical cookies), and the antivirus... found nothing neither, BUT IT MARKED these two mods as suspicious and deleted them:

 

Tank.asi (the first version of this mod: https://www.gta5-mods.com/scripts/tanks-spawn-at-five-stars) and this too (https://www.gta5-mods.com/scripts/working-restaurants). Has somebody more info about that?

 

BTW, my Angry Planes version was the first one, i didn't updated it... somebody reported being infected with this first version??

Edited May 14, 2015 by noentiendero

[FlyingAce]

deleted... my computer found fade.exe without telling me and I found the innit today deleted both... and removed the registry string... Now what do I need to do? what was this sh*t collecting.. also could someone make a successor to this mod? and report this f*cker to rockstar and have them revoke his cd key and have forums IP ban this asshole?

[NoShotz]

Hi all, damn, what a crazy shiet today. I wanted to play the game and i found this new.

 

Well, i used the mod and first of all I deleted it. I searched my registry and found nothing with "fade.exe" or "init..exe".

 

On second term, i passed a test with Malwarebytes and Panda Free. The antimalware found nothing (just the typical cookies), and the antivirus... found nothing neither, BUT IT MARKED these two mods as suspicious and deleted them:

 

Tank.asi (the first version of this mod: https://www.gta5-mods.com/scripts/tanks-spawn-at-five-stars) and this too (https://www.gta5-mods.com/scripts/working-restaurants). Has somebody more info about that?

 

BTW, my Angry Planes version was the first one, i didn't updated it... somebody reported being infected with this first version??

I am using tank.asi and lazor.asi from the first link and it hasnt detected them

[TrojanNemo]

This sucks. I loved the AngryPlanes mod, I had it with fireworks and what not, very fun.

 

In any case, I triple checked, and I'm clean, no infection on my end. Maybe it was only on an old version, or maybe my AV (Norton) caught it, but it's not even in the Quarantine history. I guess it also helps that Norton has a pretty strong firewall so even if it had been installed, I know it didn't connect outside after reviewing all my logs. People give Norton sh*t, but hey, I don't think I've ever caught a virus since I've been using it.

 

In any case, while looking at my quarantine log, something DID come up. Food.asi was labeled as having a Trojan inside and was moved to Quarantine. I don't have the time to do a dedicated post like OP did here (great job by the way), but if someone wants to look into it and confirm and alert others, that might be a good idea.

[Drkz]

deleted... my computer found fade.exe without telling me and I found the innit today deleted both... and removed the registry string... Now what do I need to do? what was this sh*t collecting.. also could someone make a successor to this mod? and report this f*cker to rockstar and have them revoke his cd key and have forums IP ban this asshole?

Again stop bringing Rockstar in all this. They don't give the slightest amount of f*ck (or yes they do, when mods try to mess with their GTA Online cash cow) about mods and i'm sure they will have a good laugh if you told them that story.

Edited May 14, 2015 by Drkz

[MarshallRawR]

Mmh, doing yet another scan right now, and ESET found this dat[1].bin

which, as ESET states, has surprisingly the same size as Fade and the for the same reason.

Edited May 14, 2015 by MarshallRawR

[TJGM]

Nobody said that though. What has been mostly said is that the actual system is a bit too laxist and needs to be improved. The goal is not to scare people away, but to warn them.

 

Besides "mods" is a very broad term. A texture pack is a mod, a sound pack is a mod. And correct me if i'm wrong, but a .rar archive with some sounds or textures in it sounds and looks infinitely safer than a compiled file like .asi that can basically do whatever the f*ck it wants on your computer. So to sum it up it's not about being paranoid about getting a virus from installing mods, it's being paranoid about installing something in .asi.

 

I'm sure you can see the differences and why you can't make such comparaisons and broad statements. Asi, for an average user (like me or someone else) is opaque as f*ck. You don't know what's inside, and most of the time (expect if you have some previous knowledge or you do some dedicated research like OP) you can't know what's inside.

 

Plus, i could potentially do what it wants. There's a lot of implications with .asi, too much implications, and i don't think we can just rely on "trusting" modders to avoid getting infected. This is a recipe for disaster.

 

That's honestly it.

 

Yes, you are saying that, in fact you wanted to label all ASI mods as unsafe. The system is fine, you run the same risks downloading an ASI mod as you do downloading anything else on the internet, ASI mods don't need to have some sort of warning sign because of this one recent incident.

 

Yeah, because these ASI's people are installing aren't actually mods. Like I said, if you're paranoid about getting a virus from installing some type of mod, then you shouldn't be installing that type of mod.

Edited May 14, 2015 by TJGM

[MikuVocaloid01]

I checked my Temp folder and there was no folder with bunch of random letters and numbers. So I loaded into the game and checked it again, still nothing. There was no Fade.exe in the Task Manager while GTA V was running either. Am I lucky or am I already f-ed?

[EnforcerZhukov]

 

Hi all, damn, what a crazy shiet today. I wanted to play the game and i found this new.

 

Well, i used the mod and first of all I deleted it. I searched my registry and found nothing with "fade.exe" or "init..exe".

 

On second term, i passed a test with Malwarebytes and Panda Free. The antimalware found nothing (just the typical cookies), and the antivirus... found nothing neither, BUT IT MARKED these two mods as suspicious and deleted them:

 

Tank.asi (the first version of this mod: https://www.gta5-mods.com/scripts/tanks-spawn-at-five-stars) and this too (https://www.gta5-mods.com/scripts/working-restaurants). Has somebody more info about that?

 

BTW, my Angry Planes version was the first one, i didn't updated it... somebody reported being infected with this first version??

I am using tank.asi and lazor.asi from the first link and it hasnt detected them

 

Maybe a false positive =/ who knows

 

 

This sucks. I loved the AngryPlanes mod, I had it with fireworks and what not, very fun.

 

In any case, I triple checked, and I'm clean, no infection on my end. Maybe it was only on an old version, or maybe my AV (Norton) caught it, but it's not even in the Quarantine history. I guess it also helps that Norton has a pretty strong firewall so even if it had been installed, I know it didn't connect outside after reviewing all my logs. People give Norton sh*t, but hey, I don't think I've ever caught a virus since I've been using it.

 

In any case, while looking at my quarantine log, something DID come up. Food.asi was labeled as having a Trojan inside and was moved to Quarantine. I don't have the time to do a dedicated post like OP did here (great job by the way), but if someone wants to look into it and confirm and alert others, that might be a good idea.

I had exactly the same problem with Food.asi, i don't know it this is a false positive or not =/

BTW, have you got the first version of Angry Planes mod? I'm clean (theorically) too and i had only the first one.

 

[Microbots]

There are conflicting reports on reddit and here. But does the asi file need to be run to have the virus installed? Or is downloading the file enough already?

[Drkz]

 

Nobody said that though. What has been mostly said is that the actual system is a bit too laxist and needs to be improved. The goal is not to scare people away, but to warn them.

 

Besides "mods" is a very broad term. A texture pack is a mod, a sound pack is a mod. And correct me if i'm wrong, but a .rar archive with some sounds or textures in it sounds and looks infinitely safer than a compiled file like .asi that can basically do whatever the f*ck it wants on your computer. So to sum it up it's not about being paranoid about getting a virus from installing mods, it's being paranoid about installing something in .asi.

 

I'm sure you can see the differences and why you can't make such comparaisons and broad statements. Asi, for an average user (like me or someone else) is opaque as f*ck. You don't know what's inside, and most of the time (expect if you have some previous knowledge or you do some dedicated research like OP) you can't know what's inside.

 

Plus, i could potentially do what it wants. There's a lot of implications with .asi, too much implications, and i don't think we can just rely on "trusting" modders to avoid getting infected. This is a recipe for disaster.

 

That's honestly it.

 

Yes, you are saying that, in fact you wanted to label all ASI mods as unsafe. The system is fine, you run the same risks downloading an ASI mod as you do downloading anything else on the internet, ASI mods don't need to have some sort of warning sign because of this one recent incident.

 

Yeah, because these ASI's people are installing aren't actually mods. Like I said, if you're paranoid about getting a virus from installing some type of mod, then you shouldn't be installing that type of mod.

 

EDIT: And to clarify, any mod can have some sort of virus, it doesn't have to be an ASI.

 

 

Yup. I wanted to label ASI mods are unsafe because they are by definition unsafe. They have way more potential control over your computer than any other format i met on any modding scene whatsoever.

 

EDIT: And to clarify, any mod can have some sort of virus, it doesn't have to be an ASI.

 

But you're just fundamentaly wrong. Unless the said mod is coming in a .exe (which is shady as f*ck 99% of the time anyway) you take close to no risks.

 

you run the same risks downloading an ASI mod as you do downloading anything else on the internet

 

No. Except if you are a clueless dude that install every single "download manager" and other .exe.

 

Like I said, if you're paranoid about getting a virus from installing some type of mod, then you shouldn't be installing that type of mod.

 

Indeed. That's exactly what i was doing back then, and that's exactly what i'm doing now. And i'm sure a lot of people will now do the same thing after that incident, hence my ideas to gain that "trust" back.

Edited May 14, 2015 by Drkz

[TJGM]

There are conflicting reports on reddit and here. But does the asi file need to be run to have the virus installed? Or is downloading the file enough already?

You need to run the game with the mod installed first, simply downloading won't install the malware.

 

EDIT: @Drkz, complete sh*t. As I said, practically every file type can be labelled unsafe, just because one file runs the risk of easily have more control over your computer than another, does not mean it needs to be labelled unsafe compared to other file types. If you're so f*cking afraid of getting a virus from mods then don't mod. Labeling ASI's just because of this one incident is the dumbest idea and yes, it WILL scare people away from modding.

Edited May 14, 2015 by TJGM

[Bencici]

There are conflicting reports on reddit and here. But does the asi file need to be run to have the virus installed? Or is downloading the file enough already?

It has to be run

[Igor Bogdanoff]

Is NoClip.asi with 111 616 bytes size it?

[MarshallRawR]

Is NoClip.asi with 111 616 bytes size it?

 

I personally had it with the NoClip mod.

[RainingAcid]

Don't know if Im safe or not, but i recently format and did a clean install of windows. I also use LastPass to generate and store my passwords. LastPass also auto fills my information so I don't know if keyloggers can do its thing wirhout detecting keystrokes.

[Drkz]

 

There are conflicting reports on reddit and here. But does the asi file need to be run to have the virus installed? Or is downloading the file enough already?

You need to run the game with the mod installed first, simply downloading won't install the malware.

 

EDIT: @Drkz, complete sh*t. As I said, practically every file type can be labelled unsafe, just because one file runs the risk of easily have more control over your computer than another, does not mean it needs to be labelled unsafe compared to other file types. If you're so f*cking afraid of getting a virus from mods then don't mod. Labeling ASI's just because of this one incident is the dumbest idea and yes, it WILL scare people away from modding.

 

 

just because one file runs the risk of easily have more control over your computer than another, does not mean it needs to be labelled unsafe compared to other file types

 

 

f*cking lmao. Of course they are. Why the f*ck do you think Windows is telling you to be careful with .exe and not .jpg files to name the most basic exemple in the universe ?

 

You have no f*cking arguments whatsoever and you know it. You keep coming with your "other file types" yet never name any. I don't know what agenda you're trying to push here to be so blind to valid complaints but you're obviously alone. Besides stop spouting that "don't mod don't mod", there's a million ways to create f*cking mod for GTA V outside of .asi. Some of the best mods ou there, like Crime and Police Rebalancement aren't asi.

 

Enjoy getting more and more of this stupid sh*t soon, as various pass stealers and hackers understand that there's a popular free market here.

Edited May 14, 2015 by Drkz

[connorlawd]

 

EDIT: And to clarify, any mod can have some sort of virus, it doesn't have to be an ASI.

 

But you're just fundamentaly wrong. Unless the said mod is coming in a .exe (which is shady as f*ck 99% of the time anyway) you take close to no risks.

 

You forget .dll files in that

[Christopher Smith]

Please, please please, pretty please. answer my question.

 

Basically, I have done everything, check my reg, nothing found. Searched for Fade.exe, nothing found. Done everything, nothing found. I have the noclip mod, I directly downloaded after 1minute of it being uploaded. Please tell me I'm fine, if so please tell me what more to do to make sure that the keylogger didn't install. I have malware byte and avg, done a scan with both nothing found.

 

Please please please reply. Anything else that I can do to check that the keylogger didn't install? Thank you!

[TrojanNemo]

This sucks. I loved the AngryPlanes mod, I had it with fireworks and what not, very fun.

 

In any case, I triple checked, and I'm clean, no infection on my end. Maybe it was only on an old version, or maybe my AV (Norton) caught it, but it's not even in the Quarantine history. I guess it also helps that Norton has a pretty strong firewall so even if it had been installed, I know it didn't connect outside after reviewing all my logs. People give Norton sh*t, but hey, I don't think I've ever caught a virus since I've been using it.

 

In any case, while looking at my quarantine log, something DID come up. Food.asi was labeled as having a Trojan inside and was moved to Quarantine. I don't have the time to do a dedicated post like OP did here (great job by the way), but if someone wants to look into it and confirm and alert others, that might be a good idea.

I had exactly the same problem with Food.asi, i don't know it this is a false positive or not =/

BTW, have you got the first version of Angry Planes mod? I'm clean (theorically) too and i had only the first one.

 

I had been keeping my mods updated, so I had the latest version from gta5-mods.com which included the option for kamikaze and fireworks instead of missiles. I think it was 1.6 or something.

[Igor Bogdanoff]

Hey look, some guy decided to be a c*nt and put malware inside an ASI mod and now people are paranoid and want to label all ASI mods as unsafe. Seriously, this is pretty silly and probably what the guy wanted in the first place.

Console peasant?

Edit: Well I don't have any track from this malware, but I found 5 different

Edited May 14, 2015 by Tomasak

[Drkz]

 

 

EDIT: And to clarify, any mod can have some sort of virus, it doesn't have to be an ASI.

 

But you're just fundamentaly wrong. Unless the said mod is coming in a .exe (which is shady as f*ck 99% of the time anyway) you take close to no risks.

 

You forget .dll files in that

 

 

True.

[Tuskin38]

Console peasant?

Wouldn't he need to the PC version to know if it worked though?

 

The guy is just an asshole.

[Nah nah nah Gta 6]

I did use the noclip mod but I don't have any fade.exe or the BAE2BCEE folder, I also searched for the fade.exe on my computer.

 

I've had the mod for ages and nothing has happened, but nonetheless I deleted the mod.

[Igor Bogdanoff]

 

Console peasant?

Wouldn't he need to the PC version to know if it worked though?

 

The guy is just an asshole.

 

He should die slowly and painfully.

[kakashi07]

My mods are:

 

-MAFINS' Object Spooner

-Classic IV car enter

-open all interiors

-native trainer

-spawn attacking ped

 

Am i f*cked?

[Drkz]

Native trainer (if you mean the Alexander Blade one) is obviously safe. For the rest, well, who knows. See ? Doesn't take a big red "unsafe" label to scare people, people are naturally scared after that incident. For perfectly good reasons.

Edited May 14, 2015 by Drkz

[Silent]

Still, such incidents are a new thing. The only previous instance of a virus I recall was some rogue-as-f*ck .bat file for IV labeled PLS RUN GIVES YOU MOAR FPS I SWEAR.

 

Can only hope it was one time. Maybe you could stay away from ASIs in V, but not in earlier games.

Edited May 14, 2015 by Silent

[TJGM]

 

 

There are conflicting reports on reddit and here. But does the asi file need to be run to have the virus installed? Or is downloading the file enough already?

You need to run the game with the mod installed first, simply downloading won't install the malware.

 

EDIT: @Drkz, complete sh*t. As I said, practically every file type can be labelled unsafe, just because one file runs the risk of easily have more control over your computer than another, does not mean it needs to be labelled unsafe compared to other file types. If you're so f*cking afraid of getting a virus from mods then don't mod. Labeling ASI's just because of this one incident is the dumbest idea and yes, it WILL scare people away from modding.

 

 

just because one file runs the risk of easily have more control over your computer than another, does not mean it needs to be labelled unsafe compared to other file types

 

 

f*cking lmao. Of course they are. Why the f*ck do you think Windows is telling you to be careful with .exe and not .jpg files to name the most basic exemple in the universe ?

 

You have no f*cking arguments whatsoever and you know it. You keep coming with your "other file types" yet never name any. I don't know what agenda you're trying to push here, but you're obviously alone. Besides stop spouting that "don't mod don't mod", there's a million ways to create f*cking mod for GTA V outside of .asi. Some of the best mods ou there, like Crime and Police Rebalancement aren't asi.

 

Enjoy getting more and more of this stupid sh*t soon, as various pass stealers and hackers understand that there's a popular free market here.

 

It's a good thing the modding community isn't Windows, otherwise we'd have to label everything as unsafe.

 

I'm not talking specifically about the games files either, simply extracting files from a .zip/.rar can contain malware. [Removed - Not sure where I got that information wrong, but it was wrong]

 

We'll enjoy, this has happened before and the flood gates have been open for years and years, it rarely happens. You keep acting like this will frequently happen now because of this one incident and if that's the case, why didn't it become more common when this previously happened? People who want to upload viruses know how easy it is to upload them among the modding communities, how come it's only going to become frequent to the GTA modding community? Why isn't it common among the Fallout/Skyrim modding community?

 

EDIT: Asked around, turns out you can store viruses into GTA file types. It's possible to store and execute a virus via a model file, texture archive file etc.. (this was done for Vice City's file types, which would've been .dff and .txd)

 

EDIT2: Turns out it can be done for any Renderware GTA (III, VC & SA). Not sure if I'm allowed say how it was done, but it's been done.

Edited May 14, 2015 by TJGM