Advertising
News
GTA5: Angry Planes and No Clip include Malware!
14.05.2015, 16:42
Author: Alex

A few hours ago, it turned out that "No Clip" and “Angry Planes” were not just GTA V modifications but also malware! The malicious part of the software was very well hidden, so it was not found until today. (More information @ GTAForums)

These mods were not only published on GTAinside but also on numerous other GTA sites and worldwide known portals (PCgamer, IGN etc.). Such a sneaky attack did not happen in the last 14 years since GTAinside has launched! Of course, we have removed these two modifications immediately from our mod database!

The malicious software is running as "The Fade.exe" and it is a keylogger to be more precise. To remove it, uninstall both GTA V add-ons and start your anti-virus software. For more information, please follow the instructions in the following thread on GTAForums.com: Possibility of Trojan downloaders / spyware installed via GTA V mod ?.

Important: You also have to change all your passwords!

In the future, the uploaded mods will be proofed even more extensively before activation. If you’re still unsettled, we also recommend you to install only *.lua and * .cs script mods, because these formats are OpenSource and malicious software can be detected easily. Modifications which are installed with OpenIV are also 100% safe!

Related Links:
- GTAForums.com




Comments
Your Name/Nick:


Your Message:


Smileys:

Please log in first!
Jonathan6506 id
"Godfather"
Godfather
Comments: 236
Profile
Message
17.05.2015, 08:04

 Quote: Mr. Raspberry Jam

maybe the author of this mod is from a rival company who trying to ruin the gta?

No, if it's from a rival company then they would face lawsuits. My possible guess that it's from a terrorist/hacker division/organization who try to spread their threats widely into the world.

Mr. Raspberry Jam id
"King of GTA"
King of GTA
Comments: 670
Profile
Message
17.05.2015, 05:16

maybe the author of this mod is from a rival company who trying to ruin the gta?

Alex de
"GTAinside Staff"
GTAinside Staff
Comments: 3133
Profile
Message
16.05.2015, 14:18

I've implemented the VirusTotal API v2. This gives you some more safety! yesgood

More information here:
http://www.gtainside.com/en/news.php?do=kommentare&id=5775

FeisalAR aq
"Assassin"
Assassin
Comments: 117
Profile
Message
16.05.2015, 02:57

@rizqan7:
Clearly it's for money (and lulz). By using keylogger, they can gather data such as credit card information, login information (email and passwords), private documents (doxx), and other valuable info from recorded keystrokes which they can sell for $$$, Bitcoin, or other crypto-currency. Basically, it's a profitable form of trolling.

rizqan7 id
"King of GTA"
King of GTA
Comments: 313
Profile
Message
16.05.2015, 00:04

Good job that you've deleted those mods, because maybe you've saved many GTA V PC gamers around here, by the way I pretty confused why the modder put that malware in their mods, maybe that they want to find sensation or just to amuse hunter.

Alex de
"GTAinside Staff"
GTAinside Staff
Comments: 3133
Profile
Message
15.05.2015, 18:07

Schwer zu sagen. Kann gut sein. Änder auf jeden Fall trotzdem deine Passwörter und lass einen Virenscanner laufen.

MrGTAmodsgerman de
"Godfather"
Godfather
Comments: 226
Profile
Message
15.05.2015, 15:12

Ich habe diese beiden Mods benutzt cray Ohne Internetverbindung, bringt das was?

Andryvision09 es
"Pickpocket"
Pickpocket
Comments: 18
Profile
Message
15.05.2015, 12:34

 Quote: FeisalAR

Could this be one of Rockstar's evil anti-modding scheme? It seems that Rockstar is trying to stop V's modding progress in its early stage.

Is it possible that the malware scare is used to spread paranoia among the mod user base, and ultimately diminishing the user base completely?

A rumor stated that Rockstar gained small cut of profit from increased anti-virus sales.

Oooh the conspiracy. scare


Wow, I don't think so... in that case, this situation could turn into a extreme discussion with R*, and finish with a scandal in a lot of forums and news.

Well... we probably can't discover the people who made this, but also it's lame. If another modder try to make the prank again, a lot of people is going to be REALLY piss off.

Alex de
"GTAinside Staff"
GTAinside Staff
Comments: 3133
Profile
Message
15.05.2015, 12:22

The problem is that some mods (especially Trainer files) are considered malicious but actually they are fine. This false positive results have to do with how these files work.

Mr. Raspberry Jam id
"King of GTA"
King of GTA
Comments: 670
Profile
Message
15.05.2015, 11:42

When I download those files, 3 of 6 antivirus in my laptop sign an alert for malware in the file that's why the download always stop at 99% with IDM or basic browser downloader, those 2 files are suspicious from their release, because that I said something, that I will download GTA V mods later, other mods are fine though, never receive any malware on this site anyway except for the noclip and angry planes mod

ermaccer td
"Pickpocket"
Pickpocket
Comments: 6
Profile
Message
15.05.2015, 10:31

Those are professional work.
I wonder if all people from other site will know about it?

FanFanD cn
"Godfather"
Godfather
Comments: 240
Profile
Message
15.05.2015, 09:15

All the people won't have bastards spreading vice wantonly! good

Jonathan6506 id
"Godfather"
Godfather
Comments: 236
Profile
Message
15.05.2015, 09:07

@FeisalAR: Rockstar no longer prevent modding in GTA V Singleplayer, it's the user itself that include the malware in its files.

FeisalAR aq
"Assassin"
Assassin
Comments: 117
Profile
Message
15.05.2015, 08:44

Could this be one of Rockstar's evil anti-modding scheme? It seems that Rockstar is trying to stop V's modding progress in its early stage.

Is it possible that the malware scare is used to spread paranoia among the mod user base, and ultimately diminishing the user base completely?

A rumor stated that Rockstar gained small cut of profit from increased anti-virus sales.

Oooh the conspiracy. scare

Alex de
"GTAinside Staff"
GTAinside Staff
Comments: 3133
Profile
Message
15.05.2015, 07:59

@jpbuquid:

In no way! We just have to be more careful when using *.asi and *.dll mods.

Everything else is safe! There is absolutely no reason to flip out.

jpbuquid ph
"King of GTA"
King of GTA
Comments: 498
Profile
Message
15.05.2015, 06:14

Modding community is ruined shok cray sorry

imscarlet
"Gangster"
Gangster
Comments: 50
Profile
Message
15.05.2015, 02:24

even though my anti virus actualy detected no clip but i ignored it !! i had problems on my game so i removed it like 3 mintues installed !

Jonathan6506 id
"Godfather"
Godfather
Comments: 236
Profile
Message
15.05.2015, 00:14

 Quote: Megalow

people who do all this should be at least expelled from the page, and if possible; locate and send them to the afterlife (kill)
hunter hunter

Megalow: LOL, possibly not afterlife. The modder would get banned in any GTA Community, might get banned by Rockstar in GTA Online and possibly get arrested in the real world. Remember, spreading such kind of virus is also considered as a crime.

Jonathan6506 id
"Godfather"
Godfather
Comments: 236
Profile
Message
15.05.2015, 00:08

I don't believe this too. The second time happens again that a mod has virus! (After 2007 mod GTA Hood Life for GTA San Andreas)

Andryvision09 es
"Pickpocket"
Pickpocket
Comments: 18
Profile
Message
15.05.2015, 00:01

 Quote: Jonathan6506

Alex, just block the modder for infinite amount of time on this website.
Reason: Sending malware
 Quote: Alex

Of course we already did, Jonathan6506! Those people don't belong to the GTA scene. shok

I think they made a permanent IP-BAN for him xD.
This kind of people... don't deserve to be a part in a MOD community. :)

Alex de
"GTAinside Staff"
GTAinside Staff
Comments: 3133
Profile
Message
14.05.2015, 23:54

Of course we already did, Jonathan6506! Those people don't belong to the GTA scene. shok

Jonathan6506 id
"Godfather"
Godfather
Comments: 236
Profile
Message
14.05.2015, 23:40

Alex, just block the modder for infinite amount of time on this website.
Reason: Sending malware

TheNathanNS gb
"Godfather"
Godfather
Comments: 280
Profile
Message
14.05.2015, 23:23

Pathetic.

As GTA IV/SA use ASI mods too, I'm worrying incase IV/SA will be hit with similar attacks. :|

Alex de
"GTAinside Staff"
GTAinside Staff
Comments: 3133
Profile
Message
14.05.2015, 23:18

@Siriox:
Natürlich prüfen wir die Mods vor Veröffentlichung. Das bedeutet aber nicht, dass sowas nicht passieren kann. Die beiden betroffenen Mods waren zudem auf nahezu jeder spielebezogenen Webseite. Darunter sowohl die ganz ganz Großen wie Gamestar, Gameswelt, PCgamer, IGN als auch jede einzelne GTA Fanpage oder GTAForums ... und es ist trotzdem bis heute Morgen niemandem aufgefallen. Das hat auch damit zu tun, dass *.asi und *.dll Dateien kompiliert sind und der Quelltext somit unbekannt ist. Bei *.lua und *.cs Skripts ist dies nicht der Fall: Der Quellcode ist OpenSource und somit frei einsehbar.

Im Prinzip kann dies bei wirklich JEDER aus dem Internet heruntergeladener Datei passieren. Es gibt immer ein Restrisiko.

####################################
English:

@Siriox:
Of course we check every single mod before publication. But this does not mean that something like this cannot happen. The two affected mods were also on almost every game-related website. From the big players like GameStar, Gameswelt, PCgamer and IGN to every GTA fan page or big communities like GTAForums ... And nevertheless nobody noticed it. This has to do with the fact that *.asi and *.dll files are compiled and the source code is thus unknown. On the other hand, *.lua and *.cs scripts are open source and the source code is visible.

In principle, this can happen with every file you download from the Internet. There is always a residual risk.

jocoadic fr
"Bounty Hunter"
Bounty Hunter
Comments: 87
Profile
Message
14.05.2015, 23:05

MEIN GOT !!!!!! cray

Siriox
"Vic"
Vic
Comments: 4
Profile
Message
14.05.2015, 22:30

Wie ist sowas möglich ? Ich bin davon ausgegangen, dass ihr das prüft, bevor es öffentlich gemacht wird.
Ist ja nen Witz.

Wieso sollte ich jetzt noch weiterhin Mods downloaden, wenn sie Viren enthalten KÖNNEN ? stop Mein Vertrauen ist angeschlagen.

Andryvision09 es
"Pickpocket"
Pickpocket
Comments: 18
Profile
Message
14.05.2015, 20:19

 Quote: Alex

You're completely right, Szthomas: We have to be more carefully, but there is absolutely no reason to flip out. hunter

But anyway, it's a very sad moment for GTA modding. shok

@Andryvision09:
Right. We have to carry the responsibility to inform those people who have installed this malicious mods. scare

== [ENG] ==
Yes, I already made a video (In spanish, sorry, but my english isn't so good xD.) that explains this problem, with the solution and how people can find it.

Here is the link ^^! (CAUTION, It's spanish.) https://www.youtube.com/watch?v=hoM9I1dwagQ

Greetings!

== [ESP] ==
Si, de hecho acabo de hacer un vídeo que explica todo el problema, con su solución y con la forma de que la gente lo pueda encontrar.

¡Aquí está el link ^^! https://www.youtube.com/watch?v=hoM9I1dwagQ

¡SALUDOS! =)

Andryvision09 es
"Pickpocket"
Pickpocket
Comments: 18
Profile
Message
14.05.2015, 19:57

 Quote: IForgotPassword

So, the .asi mods may be dangerous?

Not all. But yes, It also can be a risk. A strong one.

Megalow py
"King of GTA"
King of GTA
Comments: 2787
Profile
Message
14.05.2015, 18:40

people who do all this should be at least expelled from the page, and if possible; locate and send them to the afterlife (kill)
hunter hunter

Alex de
"GTAinside Staff"
GTAinside Staff
Comments: 3133
Profile
Message
14.05.2015, 18:12

- Texture, Handling and other mods which have to be installed with OpenIV are 100% safe.

- *.lua and *.cs mods are pretty safe because malicious software can not be hidden easily.

- *.asi and *.dll mods are POTENTIALLY dangerous, because malicious software COULD be hidden. I'm sure that 99.9% of ASI and DLL mods are safe but there is a risk.

KeeJay13
"King of GTA"
King of GTA
Comments: 1132
Profile
Message
14.05.2015, 18:01

So, the .asi mods may be dangerous?

Tardisfaction
"Vic"
Vic
Comments: 3
Profile
Message
14.05.2015, 17:52

I don't want to offense any modder or author with my comment, I am just worried now. Because - funny thing- this morning my anti vir software said that the Mod "Car Controls" (I downloaded v2, got updated to v3 over time) could be a virus. It contains "Hacktool.Win64.Agent.p". Is that normal? I use "Kaspersky Internet Security". Car Controls is a ScriptHook mod and comes as an .asi data.

Alex de
"GTAinside Staff"
GTAinside Staff
Comments: 3133
Profile
Message
14.05.2015, 17:26

You're completely right, Szthomas: We have to be more carefully, but there is absolutely no reason to flip out. hunter

But anyway, it's a very sad moment for GTA modding. shok

@Andryvision09:
Right. We have to carry the responsibility to inform those people who have installed this malicious mods. scare

Szthomas
"Pickpocket"
Pickpocket
Comments: 15
Profile
Message
14.05.2015, 17:24

Most of the mod makers are still "clean" and they are playing nice, so i don't think this event will cause great troubles in the future, but we need to be more careful from now on, that's for sure. It is kinda sad that people are willing to use even mods to spread those shity things...

Andryvision09 es
"Pickpocket"
Pickpocket
Comments: 18
Profile
Message
14.05.2015, 17:08

== [ENG] ==
I can't believe this can happen in a community that only makes extra content for users.
This kind of things scare the shit out of me, cause you never expect one day, an asshole could do anything like this. Great.

Well... now, all the GTA V MODs' places will try to find new malware to prevent another disaster like this.
Despite the situation is hard, is great to see all the people taking care of this problems.

Greetings.

== [ESP] ==
No puedo creer que esto ocurra en una comunidad que solo hace contenido extra para los usuarios.
Este tipo de cosas me ponen los pelos de punta, porque nunca esperas que un día, un capullo pueda hacer algo como esto. Genial.

Bueno... por ahora, todas las comunidades de MODs de GTA V están intentando encontrar nuevos malwares para prevenir otro desastre como este. Y a pesar de que la situación sea dura, me parece genial ver a todo el mundo moverse por esta clase de problemas.

Saludos.

Advertising
Latest news