PSA regarding malicious mods :: RimWorld General Discussions

Store Page

RimWorld

All Discussions Screenshots Artwork Broadcasts Videos Workshop News Guides Reviews

RimWorld > General Discussions > Topic Details

This topic has been pinned, so it's probably important

someonesneaky

May 25 @ 7:15pm

PSA regarding malicious mods

Hello, everyone. This is me not as moderator-Sneaks, but as community manager-Sneaks.
I just want to give a warning to everyone. There's currently a user on the workshop that keeps making new accounts, steals mods from other creators, and modifies them to bypass the user's protections to download malware.

There's been at least two so far that have been removed:

CameraSettingsMod
Mad Skills Rewritten

For now, it's difficult to tell if a mod's doing these shady things until it's downloaded and the code is checked. With both of these, though, it's been:

1. The scammer's *only* mod on the workshop

2. The mod is a reupload / stolen version

3. The scammer's profile has 0 levels

4. The scammer's profile is set to private.

However, these are not 100% indicators that the mod is malicious. **Please do not use it as a reason to go harass modmakers** - There are always new players, new modders. But it's enough to say take it with a grain of salt, double-check to make sure the mod isn't a reupload.

For now, please take the time to do a check of your own computer, make sure you're clean, *especially* if you used either of those two mods mentioned above.

If you spot any others, *please* let us know so they can be removed. You can contact me here on Steam, find me on Discord also as someonesneaky, or on Reddit as OneTrueSneaks.
Keep yourselves safe out there, colonists.

Last edited by someonesneaky; May 25 @ 7:24pm

< >

Showing 1-15 of 112 comments

sHi0nEcKi

May 26 @ 9:07pm

Hi! I saw your reddit post and I've found weird files that showed up around the time I played with the mod (Mad Skills Rewritten) both in the windows registry, and appdata and startup folders.

Virus scans didn't see these files, but I'm not an expert. I used Windows Defender to scan for them, including the offline scan. Whenever I restarted my computer I noticed weird command prompt windows opening so after some google sleuthing I figured out where and how to look.

In the registry, it was under hkey_current_user\software\microsoft\windows\currentversion\run and there were 3 .bat files. Those were linked to files located in the users\...\appdata\roaming folder. There were also files in the programdata\microsoft\windows\start menu\programs\startup that didn't have digital signatures, (windowsupdatehelper.vbs, windowsupdatehelper, and ovd_3acdf4a16ff0.exe).

I hope this helps someone clean their computers up!

Edit: Oh, I forgot to mention that I started looking for all this after I noticed my steam account being logged out of and asking me to log back in. After the second time a game was purchased on my account and another game was ran.

Edit 2: OH, I forgot to mention (again), I looked into the Windows Defender exceptions since I saw a popup, and it showed a BUNCH of folders marked for exception, including important ones like C:, C:\Windows, etc etc. I thought it was super weird so I deleted all of the exceptions and ran a scan again and it picked something up. I completely forgot what it was called though...

Last edited by sHi0nEcKi; May 26 @ 9:15pm

someonesneaky

May 26 @ 9:08pm

Thank you!

TcT Goth98 has RimWorld

May 26 @ 11:58pm

Bad people always wanna ruin the fun, don't they?

sHi0nEcKi

May 27 @ 5:01am

Okay, so I got a notification from a comment and apparently whoever hacked my account using these malicious mods posted another mod from my account. It was called Pace Control 1.6 or whatever. I deleted it as soon as soon as I saw it, but I put a comment on the account to not download the mod before I did. Whoever downloaded that please check your computer! It seems that they're using accounts that got hacked to post more of those mods. So far it seems like they're posting "updated" or "rewritten" for 1.6.

Rivunami

May 27 @ 10:25am

I can confirm I got affected by this from the Mad Skills Rewritten for sure, that explains how I got the trojan and such... Just saw this post, will edit my earlier post.

It needs to be stated that everything bbic said is accurate, and the hacker will unsub you from all your mods and uploads another fake mod on your account. As I stated in my post they are using Overlord RAT to remotely connect to your PC. They also did the same thing to me buying a game on steam using my own money, unsure why, maybe to be funny.

Last edited by Rivunami; May 27 @ 11:06am

ΕΙ ΖаІΧxuz has RimWorld

May 27 @ 10:46am

Originally posted by Rivunami:
Just saw this post, will edit my earlier post.

Someone should most definitely repost this thread in Workshop discussions so it gets more attention.

The Frogless Horror of the West has RimWorld

May 27 @ 6:24pm

It's odd how people make malware and just spread it around for fun, though I'm thankful for steam workshop being able to weed out most of these mods it's still incredibly sad to see even happen, though that does remind me I might need to check and see if I've got anything

Take care and stay safe people

TcT Goth98 has RimWorld

May 28 @ 9:15pm

Anyone find any new hits?

Geojak

May 29 @ 4:58am

What game is the hacker buying with hacked steam accounts? Is it always the same game? Could be in some way linked to it?

Rivunami

May 29 @ 6:27am

Originally posted by Geojak:
What game is the hacker buying with hacked steam accounts? Is it always the same game? Could be in some way linked to it?

In my case at least they purchased Mount and Blade 2, but they didn't even install it or upload anything workshop related for it.

#10

sHi0nEcKi

May 29 @ 12:34pm

They purchased Teardown for me. And they ran Terraria and its Mod Loader for a minute.

#11

Powerpoint 2013 has RimWorld

May 29 @ 12:44pm

Originally posted by bbic:
In the registry, it was under hkey_current_user\software\microsoft\windows\currentversion\run and there were 3 .bat files. Those were linked to files located in the users\...\appdata\roaming folder. There were also files in the programdata\microsoft\windows\start menu\programs\startup that didn't have digital signatures, (windowsupdatehelper.vbs, windowsupdatehelper, and ovd_3acdf4a16ff0.exe).

These are all in the registery right? Leaving no stone unturned here.

#12

centurese

May 31 @ 4:35pm

Anymore information on this or any new mods that have been uncovered? Would any existing mods be affected?

#13

Cinemax

May 31 @ 11:50pm

Originally posted by bbic:
Hi! I saw your reddit post and I've found weird files that showed up around the time I played with the mod (Mad Skills Rewritten) both in the windows registry, and appdata and startup folders.

Virus scans didn't see these files, but I'm not an expert. I used Windows Defender to scan for them, including the offline scan. Whenever I restarted my computer I noticed weird command prompt windows opening so after some google sleuthing I figured out where and how to look.

In the registry, it was under hkey_current_user\software\microsoft\windows\currentversion\run and there were 3 .bat files. Those were linked to files located in the users\...\appdata\roaming folder. There were also files in the programdata\microsoft\windows\start menu\programs\startup that didn't have digital signatures, (windowsupdatehelper.vbs, windowsupdatehelper, and ovd_3acdf4a16ff0.exe).

I hope this helps someone clean their computers up!

Edit: Oh, I forgot to mention that I started looking for all this after I noticed my steam account being logged out of and asking me to log back in. After the second time a game was purchased on my account and another game was ran.

Edit 2: OH, I forgot to mention (again), I looked into the Windows Defender exceptions since I saw a popup, and it showed a BUNCH of folders marked for exception, including important ones like C:, C:\Windows, etc etc. I thought it was super weird so I deleted all of the exceptions and ran a scan again and it picked something up. I completely forgot what it was called though...

That is some amateur hour ♥♥♥♥. I am growing increasingly concerned about Steam's laziness on policing uploads.

#14