Drkz Posted May 14, 2015 Share Posted May 14, 2015 I heard the so called modder was apparently a R* games employee trying to shut everyone down on modding the game by making an epic plane mod that had everyone fooled including myself, this incident is to propose a huge impact to warn people modding there game and most importantly turn people away from modding there game completely, now i don't know if i should believe this but looking back at the way R* acted towards the modding community i wouldn't be surprised if this is there retaliation. Don't forgot the tinfoil hat on the way out. Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465504 Share on other sites More sharing options...
Silent Posted May 14, 2015 Share Posted May 14, 2015 I wonder if this is what was going on with this inside the /x64 folder of my steam? it got picked up as a virus and deleted. Does anyone else have another GTA5.exe inside a /x64 folder? Yeah that's it. Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465506 Share on other sites More sharing options...
Igor Bogdanoff Posted May 14, 2015 Share Posted May 14, 2015 I heard the so called modder was apparently a R* games employee trying to shut everyone down on modding the game by making an epic plane mod that had everyone fooled including myself, this incident is to propose a huge impact to warn people modding there game and most importantly turn people away from modding there game completely, now i don't know if i should believe this but looking back at the way R* acted towards the modding community i wouldn't be surprised if this is there retaliation. Yeah and legit steam profile with IP is from Denmark 300% R* job. gooby 1 Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465507 Share on other sites More sharing options...
aboutseven Posted May 14, 2015 Author Share Posted May 14, 2015 Man, I went to bed last night after I posted this with no replies, and then I wake up to see this blown up across the internet. I was really hoping that I was wrong, but looks like I wasn't. I really hope that everyone hit has changed their passwords and that their accounts are safe. I would strongly suggest using something like Keepass from now on. It keeps your passwords in an encrypted database, and sure enough I haven't been hit with any login attempts. Still changing my passwords for the sake of it, might even reinstall Windows soon. ffzero58 1 Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465509 Share on other sites More sharing options...
jippa_lippa Posted May 14, 2015 Share Posted May 14, 2015 I heard the so called modder was apparently a R* games employee trying to shut everyone down on modding the game by making an epic plane mod that had everyone fooled including myself, this incident is to propose a huge impact to warn people modding there game and most importantly turn people away from modding there game completely, now i don't know if i should believe this but looking back at the way R* acted towards the modding community i wouldn't be surprised if this is there retaliation. Seems a little extreme...possible but extreme... By the way how to check for trainers health in the future? I really need the Enchanced Native Trainer for my videos, but i don't know how to check its integrity. Right now the only guy i trust is Alexander Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465511 Share on other sites More sharing options...
Sergeeeek Posted May 14, 2015 Share Posted May 14, 2015 I heard the so called modder was apparently a R* games employee trying to shut everyone down on modding the game by making an epic plane mod that had everyone fooled including myself, this incident is to propose a huge impact to warn people modding there game and most importantly turn people away from modding there game completely, now i don't know if i should believe this but looking back at the way R* acted towards the modding community i wouldn't be surprised if this is there retaliation. That's just as bad conspiracy theories at this point. I think mod author just wanted to make some quick buck and, due to his stupidity, thought no one would ever notice. f*ck this guy, seriously. Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465512 Share on other sites More sharing options...
Igor Bogdanoff Posted May 14, 2015 Share Posted May 14, 2015 I heard the so called modder was apparently a R* games employee trying to shut everyone down on modding the game by making an epic plane mod that had everyone fooled including myself, this incident is to propose a huge impact to warn people modding there game and most importantly turn people away from modding there game completely, now i don't know if i should believe this but looking back at the way R* acted towards the modding community i wouldn't be surprised if this is there retaliation. Yeah and legit steam profile with IP is from Denmark 300% R* job. Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465515 Share on other sites More sharing options...
LoneMerc Posted May 14, 2015 Share Posted May 14, 2015 Interesting! This one is also infected, albeit with a different flavour of the malware! This one downloads GTA5.exe from the internet and executes it. Thus, INFECTED. I wonder if this is what was going on with this inside the /x64 folder of my steam? it got picked up as a virus and deleted. Does anyone else have another GTA5.exe inside a /x64 folder? WTF.. and suddendly Strange right! I found it around the same time as using noclip and since not using that (only the once) I haven't had another gta5.exe inside my x64 folder...yet Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465516 Share on other sites More sharing options...
ckck Posted May 14, 2015 Share Posted May 14, 2015 I heard the so called modder was apparently a R* games employee trying to shut everyone down on modding the game by making an epic plane mod that had everyone fooled including myself, this incident is to propose a huge impact to warn people modding there game and most importantly turn people away from modding there game completely, now i don't know if i should believe this but looking back at the way R* acted towards the modding community i wouldn't be surprised if this is there retaliation. No... Please... Just stop.... gooby, zJordan and Igor Bogdanoff 3 Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465521 Share on other sites More sharing options...
LoneMerc Posted May 14, 2015 Share Posted May 14, 2015 (edited) I wonder if this is what was going on with this inside the /x64 folder of my steam? it got picked up as a virus and deleted. Does anyone else have another GTA5.exe inside a /x64 folder? Yeah that's it. Damnit. Do you know if there's anything else to now look for? I'm seriously considering a full format at this point just to make sure. When I think of all the PuTTY SSH sessions I've had open this past few days too. Gah. Edited May 14, 2015 by LoneMerc Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465524 Share on other sites More sharing options...
lewistair1 Posted May 14, 2015 Share Posted May 14, 2015 Strings from one of the running Twitch module: <Module> yuilgy0y.dll EntryPoint Bot mscorlib System Object _userAgentArray _targetChannel Main .ctor System.Net CookieContainer _cookieContainer _channel _randomUrl _userAgent Setup Run Get channel userAgent url System.Runtime.CompilerServices CompilationRelaxationsAttribute RuntimeCompatibilityAttribute yuilgy0y Random Next System.Threading ThreadStart Thread Start .cctor String ToLower Concat Console WriteLine Replace System.Text.RegularExpressions Regex Match Group get_Success GroupCollection get_Groups get_Item Capture get_Value System.Web HttpUtility UrlEncode RegexOptions MatchCollection Matches get_Count Int32 Sleep Contains WebRequest Create HttpWebRequest set_CookieContainer set_Timeout set_ReadWriteTimeout set_UserAgent WebHeaderCollection get_Headers System.Collections.Specialized NameValueCollection Add set_Referer WebResponse GetResponse HttpWebResponse System.IO Stream GetResponseStream StreamReader TextReader ReadToEnd Setup failed Setup OK Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.115 Safari/537.36 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1b2pre) Gecko/20081015 Fennec/1.0a1 Mozilla/5.0 (X11; Linux i586; rv:31.0) Gecko/20100101 Firefox/31.0 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.115 Safari/537.36 Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0 brianthedanishviking http://api.twitch.tv/api/channels/ /access_token No access token response "token":"(.*?)","sig":"(.*?)", No token match http://usher.twitch.tv/api/channel/hls/ .m3u8?token= &sig= No select response http(s)?://([\w+?\.\w+])+([a-zA-Z0-9\~\!\@\#\$\%\^\&\*\(\)_\-\=\+\\\/\?\.\:\;\'\,]*)? No URLs {0} URLs Update #EXT-X-ENDLIST X-Requested-With ShockwaveFlash/16.0.0.235 http://www.twitch.tv/ <X W z\V WrapNonExceptionThrows _CorDllMain mscoree.dll VS_VERSION_INFO VarFileInfo Translation StringFileInfo 000004b0 FileDescription FileVersion 0.0.0.0 InternalName yuilgy0y.dll LegalCopyright OriginalFilename yuilgy0y.dll ProductVersion 0.0.0.0 Assembly Version 0.0.0.0 !This program cannot be run in DOS mode. aOU .text `.rsrc @.reloc p*r *BSJB v4.0.30319 #Strings #US #GUID #Blob Strings from the running Steam Inventory evaluation module: <Module> 02bjg5dv.dll EntryPoint Response MemoryReader ByteArrayRocks mscorlib System Object Main Main2 Get .ctor System.Net HttpWebResponse HttpResponse ResponseString BlockSize CloseHandle OpenProcess ReadProcessMemory _processId _handle OpenHandle System.Collections.Generic List`1 FindPattern Empty Locate IsMatch IsEmptyLocate url cookie hObject processAccess bInheritHandle processId hProcess lpBaseAddress buffer System.Runtime.InteropServices InAttribute OutAttribute size lpNumberOfBytesRead MemoryAddress bytesToRead bytesRead pattern self candidate array position System.Runtime.CompilerServices CompilationRelaxationsAttribute RuntimeCompatibilityAttribute 02bjg5dv ToString Exception System.Diagnostics Process GetProcessesByName System.Text Encoding get_UTF8 GetBytes get_Id Enumerator GetEnumerator get_Current IntPtr op_Explicit GetString Contains Add MoveNext IDisposable Dispose get_Count String Concat System.Text.RegularExpressions Regex Match Group get_Success GroupCollection get_Groups get_Item Capture get_Value Kill System.Threading Thread Sleep op_Inequality op_Equality MatchCollection Matches Int32 System.Collections IEnumerator WebRequest Create HttpWebRequest WebHeaderCollection get_Headers HttpRequestHeader Set WebResponse GetResponse System.IO Stream GetResponseStream StreamReader TextReader ReadToEnd Close DllImportAttribute kernel32.dll Zero Byte ToInt32 ToArray .cctor steamwebhelper No process found 7656119??????????%7c%7c No logins found http://steamcommunity.com/home steamLogin= g_steamID = "(.*?)"; http://steamcommunity.com/profiles/ /inventory/json/730/2/ No inventory "market_name":"(.*?)","name_color":"(.*?)","background_color":"(.*?)","type":"(.*?)","tradable":(.*?), z\V WrapNonExceptionThrows _CorDllMain mscoree.dll VS_VERSION_INFO VarFileInfo Translation StringFileInfo 000004b0 FileDescription FileVersion 0.0.0.0 InternalName 02bjg5dv.dll LegalCopyright OriginalFilename 02bjg5dv.dll ProductVersion 0.0.0.0 Assembly Version Strings from the Facebook information stealing module: wpcdrdeu.dll EntryPoint CookieHelper CryptProtectPromptFlags CRYPTPROTECT_PROMPTSTRUCT DATA_BLOB SQLiteHandler record_header_field sqlite_master_entry table_entry mscorlib System Object Enum ValueType _currentCookie Main HttpGet .ctor System.Collections.Generic List`1 GetCookieList TryReadCookies CryptUnprotectData Decrypt value__ CRYPTPROTECT_PROMPT_ON_UNPROTECT CRYPTPROTECT_PROMPT_ON_PROTECT cbSize dwPromptFlags hwndApp szPrompt cbData pbData db_bytes encoding field_names master_table_entries page_size SQLDataTypeSize table_entries ConvertToInteger CVL GetRowCount GetTableNames GetValue GVL IsOdd ReadMasterTable ReadTable ReadTableFromOffset size type row_id item_type item_name astable_name root_num sql_statement content url allowedNames browser file cookieList pDataIn szDataDescr pOptionalEntropy pvReserved pPromptStruct dwFlags pDataOut Datas baseName startIndex Size endIndex row_num field value Offset TableName System.Runtime.CompilerServices CompilationRelaxationsAttribute RuntimeCompatibilityAttribute wpcdrdeu Add System.Text StringBuilder Enumerator GetEnumerator get_Current String IsNullOrEmpty System.Text.RegularExpressions Regex MatchCollection Matches get_Count Match get_Item GroupCollection get_Groups Group Capture get_Value Replace AppendFormat MoveNext IDisposable Dispose ToString Exception System.Net WebRequest Create HttpWebRequest set_Method set_AllowAutoRedirect WebHeaderCollection get_Headers System.Collections.Specialized NameValueCollection WebResponse GetResponse HttpWebResponse System.IO Stream GetResponseStream Encoding get_UTF8 StreamReader TextReader ReadToEnd .cctor Environment SpecialFolder GetFolderPath Path Combine Directory Exists DirectoryInfo GetDirectories FileSystemInfo get_FullName File Console WriteLine Empty ToLower Contains get_Length get_Default GetBytes System.Runtime.InteropServices DllImportAttribute Crypt32.dll GCHandle GCHandleType Alloc AddrOfPinnedObject Free IntPtr Zero Byte Marshal Copy GetString Substring FlagsAttribute StructLayoutAttribute LayoutKind <PrivateImplementationDetails>{8BBC7D72-C61E-48B2-B139-18F84516FABA} CompilerGeneratedAttribute __StaticArrayInitTypeSize=10 $$method0x6000009-1 RuntimeHelpers Array RuntimeFieldHandle InitializeArray Microsoft.VisualBasic FileSystem OpenMode OpenAccess OpenShare FileOpen LOF Strings Space FileGet Int32 FileClose CompareTo Decimal Compare BitConverter ToInt64 op_Equality Microsoft.VisualBasic.CompilerServices Utils CopyArray Convert ToInt32 Subtract ToUInt16 ToUInt64 Int64 Math Round get_Unicode get_BigEndianUnicode Multiply IndexOf Char Split LTrim Conversions c_user https://m.facebook.com/settings/account/ <br /><span class="(.*?)">(.*?)</span> @ [{0}] [Alias: {1}] [Email: {2}] [Cookies: {3}] [Language: {4}] FacebookData GET Cookie Google Chrome User Data Cookies Mozilla Firefox Profiles cookies.sqlite moz_cookies cookies host host_key .facebook.com name value encrypted_value {0}={1}; SQLite format 3 Not a valid SQLite 3 Database File Auto-vacuum capable database is not supported table UNIQUE z\V WrapNonExceptionThrows _CorDllMain mscoree.dll VS_VERSION_INFO VarFileInfo Translation StringFileInfo 000004b0 FileDescription FileVersion 0.0.0.0 InternalName wpcdrdeu.dll LegalCopyright OriginalFilename wpcdrdeu.dll ProductVersion 0.0.0.0 Assembly Version 0.0.0.0 If you have any questions or requests let me know and I'll see if I can figure out more. I don't have a ton of time to spend on it as my lunch break is over. What should we look for in the registry to be specific? Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465532 Share on other sites More sharing options...
MarshallRawR Posted May 14, 2015 Share Posted May 14, 2015 (edited) The thing, that's where I got my NoClip from Silent, could you please analyze those mods: http://www.palmbeachgames.com/files/file/3-sapdrapid-response/ https://www.gta5-mods.com/scripts/ambulance-miini-missions Along side NoClip, these are pretty much the only mods I used and I had the Fade and the fake GTA5.exe Edited May 14, 2015 by MarshallRawR Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465533 Share on other sites More sharing options...
ZZCOOL Posted May 14, 2015 Share Posted May 14, 2015 I heard the so called modder was apparently a R* games employee trying to shut everyone down on modding the game by making an epic plane mod that had everyone fooled including myself, this incident is to propose a huge impact to warn people modding there game and most importantly turn people away from modding there game completely, now i don't know if i should believe this but looking back at the way R* acted towards the modding community i wouldn't be surprised if this is there retaliation. they'd make something more epic this was a simple simple simple simple script mod Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465536 Share on other sites More sharing options...
TrojanNemo Posted May 14, 2015 Share Posted May 14, 2015 I think there are two questions that have yet to be answered: 1) Was it every copy of the mod and did it activate for every user, every time? 2) How can you tell if you ever had it when (now) you have no indication anywhere that you got infected? In my case, as I said before, I had used the mod repeatedly and updated it with every update to it. But my AV has nothing in quarantine, I had nothing in my registry, nothing in my temp files, nothing suspicious running. My firewall has no log of anything like what has been mentioned here before. So I wonder if I was infected and it self-destroyed to not leave a trace, or if for some reason, I never got hit in the first place even though I actively used the AngryPlanes mod. Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465540 Share on other sites More sharing options...
jippa_lippa Posted May 14, 2015 Share Posted May 14, 2015 (edited) Interesting! This one is also infected, albeit with a different flavour of the malware! This one downloads GTA5.exe from the internet and executes it. Thus, INFECTED. I wonder if this is what was going on with this inside the /x64 folder of my steam? it got picked up as a virus and deleted. Does anyone else have another GTA5.exe inside a /x64 folder? WTF.. and suddendly So basically, I've been infected by both? Great. My Avast locked in quarantine "Fade.exe" the first day i have used it (8th of may) and on the same day, between 10 p.m. and 00 a.m. closed 8 GTA5.exe files in quarantine. Strange behaviour...my original GTA V.exe has never been deleted though. What are these fake exes? What's their purpose? By the way how does the virus ACTIVATE? Is it safe to just move the asi files around? (like saving them in a folder in the data drive)? Edited May 14, 2015 by jippa_lippa Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465554 Share on other sites More sharing options...
LoneMerc Posted May 14, 2015 Share Posted May 14, 2015 (edited) The thing, that's where I got my NoClip from Silent, could you please analyze those mods: http://www.palmbeachgames.com/files/file/3-sapdrapid-response/ https://www.gta5-mods.com/scripts/ambulance-miini-missions Along side NoClip, these are pretty much the only mods I used and I had the Fade and the fake GTA5.exe I used that exact same noclip. Edited May 14, 2015 by LoneMerc Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465559 Share on other sites More sharing options...
Igor Bogdanoff Posted May 14, 2015 Share Posted May 14, 2015 (edited) Can someone if this one https://www.sendspace.com/file/qho05mhas virus too? Edit: Nope, it should be safe (it's from this thread http://gtaforums.com/topic/792103-noclip/) Edited May 14, 2015 by Tomasak Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465564 Share on other sites More sharing options...
AlexanderLove97 Posted May 14, 2015 Share Posted May 14, 2015 WTF I didn't find any malware, nor the the 'fade.exe' file. Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465592 Share on other sites More sharing options...
Gamingalkaline Posted May 14, 2015 Share Posted May 14, 2015 I used the Angry Planes mod. I alt+F4'd my game because of the missiles. I check my task manager because the game was running slowly, I see Fade.exe, I open file location, and delete the files the same day I got the mod. No idea if it stole anything but I changed the passwords, and my antivirus never picked it up, but I did. Now my concern is what the f*ck is wrong with people that they'd make a mod that works, only to include a malaware and sh*t in it, like dude, you register on a website that can log your IP when you sign in and upload files. Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465594 Share on other sites More sharing options...
nkjellman Posted May 14, 2015 Share Posted May 14, 2015 I don't really want to read through 9 pages. Can anyone confirm if any of these mods contain anything? -Lua script loader *Enhanced train driver *IV style enter and exit -Native Trainer -Open interiors -PC Trainer -11Zero11 trainer. -Endeavor mod menu. -IPL loader -Rare vehicles spawn in SP. -Heist vehicles spawn naturally in SP. -Working JB 700. Fortunately, I have not installed the angry planes or the no clip mod. Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465599 Share on other sites More sharing options...
Gamingalkaline Posted May 14, 2015 Share Posted May 14, 2015 I used the Angry Planes mod. I alt+F4'd my game because of the missiles. I check my task manager because the game was running slowly, I see Fade.exe, I open file location, and delete the files the same day I got the mod. No idea if it stole anything but I changed the passwords, and my antivirus never picked it up, but I did. Now my concern is what the f*ck is wrong with people that they'd make a mod that works, only to include a malaware and sh*t in it, like dude, you register on a website that can log your IP when you sign in and upload files. Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465604 Share on other sites More sharing options...
Sergeeeek Posted May 14, 2015 Share Posted May 14, 2015 So guy who uploaded Angry Planes to gta5-mods.com goes by the name of onsby. There is an account on gtaforums with the same name registered a week ago. They could be different people though, because gtaforums account from Netherlands (if it's anything to go by). Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465611 Share on other sites More sharing options...
Drkz Posted May 14, 2015 Share Posted May 14, 2015 I used the Angry Planes mod. I alt+F4'd my game because of the missiles. I check my task manager because the game was running slowly, I see Fade.exe, I open file location, and delete the files the same day I got the mod. No idea if it stole anything but I changed the passwords, and my antivirus never picked it up, but I did. Now my concern is what the f*ck is wrong with people that they'd make a mod that works, only to include a malaware and sh*t in it, like dude, you register on a website that can log your IP when you sign in and upload files. IP is totally and absolutely meaningless Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465624 Share on other sites More sharing options...
TJGM Posted May 14, 2015 Share Posted May 14, 2015 So guy who uploaded Angry Planes to gta5-mods.com goes by the name of onsby. There is an account on gtaforums with the same name registered a week ago. They could be different people though, because gtaforums account from Netherlands (if it's anything to go by). IP's were checked, they're the same people. Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465626 Share on other sites More sharing options...
Igor Bogdanoff Posted May 14, 2015 Share Posted May 14, 2015 What will we do? Give criminal complaint (I don't really know how to say this in english) Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465634 Share on other sites More sharing options...
404UserNotFound Posted May 14, 2015 Share Posted May 14, 2015 I saw this being discussed somewhat on the first page, but I'm from the AlliedModders community and on our forums when you add a .sp file as a post attachment, it comes up with two options: Get Plugin Get Source Get Plugin gets you the compiled .smx file and Get Sourcr gets you the uncompiled .sp file. The forum runs the attached .sp file through the sourcepawn compiler at the time of download and counts every download. It's also against our T&C to upload compiled plugins without the source. The .sp files are completely readable in any notepad program. Our forun also has a New Plugin section and users who are designated as Plugin Approvers. These users know how to spot malicious code and approve good plugins which moves the new plugins thread into the Approved Plugins section. Plugjns that reproduce things in existing plugins, or plugins that no longer work (due to game updates) are usually moved to the Unapproved Plugins section. That setup sounds like what this community needs to prevent the spread of malicious mods. MarcusBlack, ffzero58, Drkz and 1 other 4 Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465635 Share on other sites More sharing options...
juaao Posted May 14, 2015 Share Posted May 14, 2015 (edited) Damn Edited May 14, 2015 by juaao Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465639 Share on other sites More sharing options...
Zeynohh Posted May 14, 2015 Share Posted May 14, 2015 My PC also shutted down itself not too long ago. Before I didnt have all these mods it didnt used to but when Im on GTA V, it is possible for it to turn off itself. Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465647 Share on other sites More sharing options...
MagikarpIsOP Posted May 14, 2015 Share Posted May 14, 2015 Damn You still need to clean the registry. Can we update the first post in order to help people solve this issue? juaao and RoachKiller_416 2 Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465654 Share on other sites More sharing options...
Snowshoe Posted May 14, 2015 Share Posted May 14, 2015 (edited) I saw this being discussed somewhat on the first page, but I'm from the AlliedModders community and on our forums when you add a .sp file as a post attachment, it comes up with two options: Get Plugin Get Source Get Plugin gets you the compiled .smx file and Get Sourcr gets you the uncompiled .sp file. The forum runs the attached .sp file through the sourcepawn compiler at the time of download and counts every download. It's also against our T&C to upload compiled plugins without the source. The .sp files are completely readable in any notepad program. Our forun also has a New Plugin section and users who are designated as Plugin Approvers. These users know how to spot malicious code and approve good plugins which moves the new plugins thread into the Approved Plugins section. Plugjns that reproduce things in existing plugins, or plugins that no longer work (due to game updates) are usually moved to the Unapproved Plugins section. That setup sounds like what this community needs to prevent the spread of malicious mods. Pawn scripts =/= entire C++ projects/DLLs with numerous source files and dependencies How would this even work? server-side MSVC? It would make sense with CLEO mods possibly but not this. Edited May 14, 2015 by Snowshoe Link to comment https://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/page/9/#findComment-1067465660 Share on other sites More sharing options...
Recommended Posts