🔥︱curseforge-support

[copper topaz]

I've been @'d

[waxen sorrel]

ye cuz you'll be able to explain to darkhai better xp

they're asking if they need to change passwords

[copper topaz]

Can't really relay Curseforge's mod team on this

[opal cipher]

#🆘︱current-issues🆘 and #📢︱news

[robust orbit]

Alright let see what to do windows defender offline scan and take my pc off the Internet completely can’t have my data if you can’t receive the data

[robust orbit]

Quick question would windows defender offline scan work

[rich flint]

I don't know the issue on a code level well enough to say one way or the other. Curseforge devs just waking up on their timezone and investigating. updates will be posted in the channels NLK linked above

[robust orbit]

Alright

[rich flint]

it probably doen'st hurt to give your computer a scan anyway 😄 lol

waits for it

[robust orbit]

We’ll of course sounds like a excuse to break into peoples houses and install mcaffee

[tiny valley]

For minecraft server packs on version 1.12 do you usually use java 8 or java 11?

[opal cipher]

!mc-java

[red patio]

Specific Java versions required for running Minecraft

Minecraft requires specific Java versions to run, pick the correct one for the version of Minecraft you are playing!

Java for Minecraft versions 1.16.X and below

Java 8 Windows Installer

Java for Minecraft 1.17.X

Java 16 Windows Installer

Java for Minecraft 1.18.X and 1.19.X

Java 17 Windows Installer

Java for other operating systems

More Java download options

[old nebula]

Sup

HKCU:\Software\Microsoft\Windows\CurrentVersion\Run

So i just went here to check for this registery

What should i be looking for

This is to do with the recent hacking

[stiff dune]

a file named "t" i believe

some dude made a script in one of the articles, and thats the file name it searches for in there

[sharp stream]

Thought curse forge was safe 😔

[opal cipher]

tbh, it's really hard to be 100% safe from anything.

[sharp stream]

True

Being 100% safe online is impossible anyways so was only a matter of time

[bold quest]

Microsoft Edge i believe

its trying to appear legit but (it isnt)

[old nebula]

this is the windows registery

[stiff dune]

huh

[old nebula]

😱

[stiff dune]

wat wat

[old nebula]

a file in the windows registery

[stiff dune]

what did i say wrong?

you mean its there for you?

[old nebula]

I dont think there is files in anyones registery lol

[stiff dune]

oh

then why was there a check for it?

Also check the registry for an entry at HKEY_CURRENT_USER:\Software\Microsoft\Windows\CurrentVersion\Run

Im so confusled

[old nebula]

first time on a puter?

[stiff dune]

no, first time in the registry tho

[old nebula]

i only just got cursed

now its this

[stiff dune]

O_O

[old nebula]

lives up to its name

[stiff dune]

lol

[old nebula]

it looks like im all clean

but who knows

[compact stream]

Will I be fine if I updated the mods but I didn't play on it?

[old nebula]

im not sure

[spring turret]

Was told that curseforge was hacked, is it true?

[old nebula]

yea

https://prismlauncher.org/news/cf-compromised-alert/

here is how you can check

[spring turret]

Thank you

[old nebula]

Id probably delete it for now completely

Dungeons Arise
Sky Villages
Better MC modpack series
Fabuously Optimized (Found to not be compromised)
Dungeonz
Skyblock Core
Vault Integrations
AutoBroadcast
Museum Curator Advanced
Vault Integrations Bug fix
Create Infernal Expansion Plus - Mod removed from curseforge

here is a list of effected mods

[spring turret]

Thanks

Pixelmon wasn't hacked?

suprising

[old nebula]

You can check the mod list from the text file in the mod pack

[spring turret]

wdym?

Ohh

okay

i see

ty

[old nebula]

dont run the games'

[rich flint]

updates when CF has something to say about will be in #📢︱news and #🆘︱current-issues🆘

[old nebula]

are there people currently working on resolving it?

and have the mods been removed from the app?

[spring turret]

how do I enabel this?

or disable sry

i don't see it via view

[rich flint]

yes there are people looking into this right now taking their first sips of morning coffee

[stiff dune]

I need this too

[old nebula]

no rush its only all users computers

[robust orbit]

Cut here to activate firewall

Cat-5 cable

[spring turret]

^

also i dont' see my windows explorer file

or microsft explorer

[sturdy moon]

so i ran the powershell file and it said nothing here am i safe?

[spring turret]

ah wait nvm

i just ran the file

or code ig

[old nebula]

Bru

h

[rich flint]

oof that's all the formatting that thing has?

rough lol

[old nebula]

my god im a schizo im reformatting my machine now

[opal halo]

hi I wanted to ask kindly if someone could help me with this problem that I was presented this morning, where comes this smootstraps that you have to update but tells me that it is impossible to update the native launcher of minecraft, gives me this problem on every modpack , I tried to dinstallare and reinstall curseforge and nothing I would not know what I could do someone can help me thanks.

[old nebula]

dont install anything brudda

[crimson vale]

Would recommend to install nothing atm until the issue is solved

[hidden sinew]

yeah leave it alone until all of this malware stuff is resolved

[old nebula]

There is no warning at all in the launcher

[opal halo]

ok thanks

[vernal holly]

hi i had this issue this morning. Normally there was nothing wrong with modpack i was playing normally. When i click "view crash report" nothing shows up.

here also entire mod pack

[old nebula]

imagine all the children around the country installing modded minecraft onto their parents computers

[knotty charm]

amigos i have a problem with a mod

[old nebula]

owo

[old nebula]

delete

[stiff dune]

all of the ppl who have their accounts leaked...

and all of the ass beatings those kids will get...

[old nebula]

i dont think you got one with it

[old nebula]

also setup a firewall to the server if you arent doing a hard restart

[vernal holly]

i didnt understand

[stiff dune]

wdym a hard restart

[compact stream]

don't mess with any mods rn

[old nebula]

reinstalling the os

[stiff dune]

shiiiii

eh

i ran the check

(s)

im fine!

maybe

[old nebula]

from this list

Dungeons Arise
Sky Villages
Better MC modpack series
Fabuously Optimized (Found to not be compromised)
Dungeonz
Skyblock Core
Vault Integrations
AutoBroadcast
Museum Curator Advanced
Vault Integrations Bug fix
Create Infernal Expansion Plus - Mod removed from curseforge

@vernal holly check you dont have any of these

[vernal holly]

these are malwared mods?

[old nebula]

yea

[vernal holly]

ok thanks

[upper root]

all except the one that is said to not be

[unique plaza]

oh good i don't have any of those

[old nebula]

still check
Windows: %LOCALAPPDATA%\Microsoft Edge\libWebGL64.jar (or ~\AppData\Local\Microsoft Edge\libWebGL64.jar)

Yes, "Microsoft Edge" with a space
Also check the registry for an entry at HKCU:\Software\Microsoft\Windows\CurrentVersion\Run
Or a shortcut in %appdata%\Microsoft\Windows\Start Menu\Programs\Startup

[knotty charm]

wait whats going on

[rugged egret]

there is malware that got put in a few mods on curseforge rn

[knotty charm]

well fuck.

[rugged egret]

1 of them is dungeon's arise like what the fuck

[old nebula]

yea apparently some of the accounts for the administration of curse have been compromised

or the mod owners or something

but there has been another hack like this recently for java idk why they keep attacking minecraft lol

[upper root]

Afaik only one account (the lunpixel mascot account) has been compromised

[keen moat]

the last one was Log4j, which affected a multitude of programs. Minecraft just happened to be one of them

[old nebula]

yea

[keen moat]

still not cool tho

[real scaffold]

Should I have any concerns about CurseForge updating my addons for WoW? A lot of streamers saying I shouldn’t be using it atm.

[upper root]

It doesnt seem like WoW is affected rn

only minecraft

[real scaffold]

To be safe, should I just … not?

[rugged egret]

i cut it close with the whole malware thing because in my modpack i downloaded dungeon's arise like a week ago and i deleted right after this stuff was announced

[upper root]

there is always going to be a chance of downloading malware from anywhere on the internet
at the moment i would say that chance isnt much higher than normal for CF hosted WoW addons

[old nebula]

does curseforge not check for malicious code?

or did it get past?

[rich flint]

there is a system for checking. obviously this seems like to be one that got through

[frank yarrow]

does that mean i hav eit?

[stray hawk]

if I already Downloaded mods are they safe

[old nebula]

just copy and paste this into directory

HKCU:\Software\Microsoft\Windows\CurrentVersion\Run

oh wait

nah

[opal cipher]

No, you're safe.

[frank yarrow]

thanks, now to worry about my main machine

[solid mason]

i tried checking if i was compromised or not but after i changed to view hidden files i got the blue screen of death

[rigid charm]

Wait which mods? Also, I noticed a mod I hadnt installed was on there

It was like crystals and end mod or something

Or colorprism or something

[shadow anchor]

It worked, I just have a error on the server but i didn’t have the time to look for it

[tough ridge]

Does the power shell script that scans for the malware automatically scan through hidden files?

[upper root]

it should

[opal cipher]

It does, as it checks specific paths, and that doesn't care about if files are hidden. If there's a file at that path, it will show up in the script.

The hidden flag just makes it harder for people to see it in Explorer, unless they show hidden files

[tough ridge]

Alr thanks

[neat torrent]

Its also marked as a system file, which is a seperate visiblity setting

[old nebula]

Plugins like display entity editor @upper root ?

[upper root]

nope, its improving
no one new should be able to get affected cause the places that host the next stages are down

[digital roost]

W

[pale pecan]

iv tryed useing the unlock thing but is still not working

[upper root]

that is on my list of affected things

[old nebula]

So is that a plugin or mod

[upper root]

plugin

[old nebula]

These are server plugins?

Or like client

[upper root]

some plugins and some mods were uploaded with malware in them

so both

[old nebula]

Well shit what about the servers effected

[digital roost]

Any that have the plugin installed

[pale pecan]

im just going to play none modded minecft for a bit tbh

[sacred lantern]

All of this is happening right after I told my friend curse forge was safe to use also lol. I know it's not their fault but I feel terrible for it

[pale pecan]

xd

[old nebula]

I just installed today lol I didn't trust modded Minecraft before but I decided to do it cause my friend wanted me to

[faint walrus]

i downloaded the CRIF modpack like immediately before this all came out but never actually opened the modpack through curseforge, and i checked my computer for all the malicious files and found nothing. i should be good right?

[pale pecan]

yea you should be if the files not in there

[pale pecan]

just dont use cursefore

for like a while

[faint walrus]

yeah im leaving it alone for a good while

[west needle]

can someone explain me or link me this if not already asked: if I have minecraft mods, do I just dont update them but I can update my WoW addons? I dont quite understand the "This is relevant ONLY to Minecraft users" in news

[digital roost]

its only effected minecraft mods/modpacks as of right now so WoW addons are good

and yes dont update mc mods

[west needle]

coolio

ty

[wooden oriole]

how to get rid of malware?

[sacred lantern]

#🆘︱current-issues🆘

[wooden oriole]

Oh thx

[digital roost]

So It detected a bad path i believe, what action do I take from here?

[digital roost]

the prism one?

yup

so

whatever path it has here -> "bad file found! please delete $path" copy that path and delete

but I would just follow the prism guide

it shows you how to do it that way Idont have to re-explain here lol

[young sedge]

i need help

does modpack mods update by itself?

[upper root]

no

well, there is one that is known to (essential) but it doesnt seem to be compromised

[young sedge]

i have fabolously optimized and kinda scared

[upper root]

FO is fine

it wasnt actually infected

[young sedge]

i downloaded that 2 months ago

[upper root]

doubly fine then

[digital roost]

I dont have a "microsoft edge" folder in my %localappdata% so im good?

[upper root]

should be

[young sedge]

thanks man i almost had a heart attack when i saw the news

i also checked i dont have that either

[digital roost]

says it doesn't recognize the term ' bad '

C:\WINDOWS\system32> ForEach ($Path in $badPaths) {

    if (Test-Path -Path $Path) {
            Write-Host "bad file found! removing $Path..."
            Remove-Item -Force $Path
            $res = $true

This also popped up am I good, I'm so confused. I never do any code things

[sacred lantern]

Make sure to make hidden files visible and for windows also disable Hide protected operating system files

[digital roost]

I have done this

[sacred lantern]

I wonder if Microsoft Edge is two words for you

You should actually have it

[digital roost]

I dont even have that folder at all

not even one word

[sacred lantern]

You know that's odd, I actually don't have it

Or at least can't find it

[digital roost]

I don't have the oneworded one either, but I opened edge todat (Accidentally) but still

today

[sacred lantern]

I have microsoft\edge but no "Microsoft Edge"

[uncut glacier]

so the game isn't safe to play with curse forge mods for a while?

[rich flint]

you can use the script done in a different format that I posted in #🧱︱mc-other-help pins for this purpose

[sacred lantern]

Try %appdata%\Microsoft\Windows\Start Menu\Programs\Startup maybe

Idk if that's supposed to be it

Actually no that's something else

[digital roost]

Tried that did not work, everything spammed red and it refused every line. basically saying valid statement, I might actually be okay IDK though and IDK how I would fix it.

[rich flint]

sounds like your system's powershell and CMD functions are broken

[sacred lantern]

You could try clicking this pc and search for microsoft edge as two seperate words, for me it's loading up but I think I may have found it

[digital roost]

Well that's not good

[sacred lantern]

Actually I didn't

[digital roost]

uh, should I do something do you need me on a call or something?

[cobalt talon]

how do I check if my computer is compromised or not ?

[upper root]

there is a script in the link in #🆘︱current-issues🆘 or one pinned in #🧱︱mc-other-help

[cobalt talon]

thanks

[sinful moss]

if you run the script and you're gucci are you ok to play minecraft?

[upper root]

yes, but it may be worth not doing anything mc related for a day or two till this blows over completely

[sinful moss]

ok, thank you!

[sacred lantern]

So is the bad file just called libWebGL64.jar?

[upper root]

there are a few bad files, but that is one of the main ones

the script in the link in #🆘︱current-issues🆘 and pinned in #🧱︱mc-other-help check for all the known ones

[cobalt talon]

okay when I will be back home I'll test the .BAT

[sacred lantern]

I am finding this one other search software called "everything"

I am just going to go down that list and see if I find it

[sacred lantern]

Honestly, with this all being done, I think it would be worthy to consider adding an update history feature so we can see what mods we updated in what order and when

Then we could also roll back from there

[rich flint]

until that you can sort / view file timestamps in OS file browser (go to profile options > open folder > mods folder)

[sacred lantern]

I thought someone said if you have it that it can try to copy itself places

[upper root]

it is the same place for all launchers, the scripts linked in places check those places

[sacred lantern]

I don't know if Curseforge is a US based platform, but even if it's not I think you can report the malware to the CISA and explain what was going on

I don't know if they would resolve the issue but I think they would try to eventually find out who did it

[upper root]

us is israel based

[sacred lantern]

I wonder if they'd still try anyway, since it has for sure impacted US citizens

I'm sure Israel may have an equivalent if anything

That might be more up to whoever actually owns/runs curseforge though

I am sure they have a better understanding of the situation

[rustic wing]

i expect if such a report is useful microsoft has already done it

[sacred lantern]

If they know about it

If you're talking about getting the criminal charges rolling though it's better to just report to any government organizations you can

Reporting to companies gets it lost in "policies"

[pure prawn]

Does Curse forge auto update minecraft modpacks?

[dapper smelt]

when i try to launch curseforge on minecraft i get a "error code 1", i have tried to launch curseforge without mods, and i have tried reinstalling. But nothing seems to work, how do i fix this issue? Could it perhabs be with java or overwolf?

[upper root]

no

[pure prawn]

ok cool thank you

[young sedge]

Does virus only affect modpacks or individual mods too?

[upper root]

its only found in mod jars

but modpacks are made of mod jars

[rustic wing]

it impacts modpacks through infecting mods in the packs.

[digital roost]

SO i did that run command it suggests what am i actually looking for?

[young sedge]

İ installed inventory profile next a week ago

İ didn't find anything related to malware

[rich bronze]

So if you can't find any file your fine right?

I havent booted curseforge for like 2 days now?

[digital roost]

IS this file anything to worry about?

[opal cipher]

Nope.

[dapper smelt]

I have so many of those files

[digital roost]

So the script didn't find anything nor could i find anything by hand, plus I haven't booted curseforge in like 4 weeks, I should be save, I hope

[dapper smelt]

Hi, when i try to launch curseforge i get a "error code 1", i have tried to launch curseforge without mods, and i have tried reinstalling. But nothing seems to work, how do i fix this issue? Could it perhabs be with java or overwolf?

[modest bolt]

I would suggest not touching curseforge for the next while

[solid mason]

would running/launching a modpack still be alr? i havent updated the pack in months

[calm plover]

Hey, pls send a launcherlog in #🧱︱mc-other-help

[calm plover]

Then should be all fine, its also depends on which modpack bec only some mods are affected of the issue

[marble grail]

anyone know if anything in bigchadguys modpack is infected ?

[weary hazel]

Have any shaders been effected?

[calm plover]

better ask the author himself, I can look later in the modlist too but im only on phone right now

[calm plover]

nope

[marble grail]

i can send you screenshots if you want

of the mods

[weary hazel]

Alright thanks, I think I’ve only downloaded shaders in the past few weeks

[solid mason]

valhelsia 5

[rustic wing]

everything that is known is here: https://hackmd.io/@jaskarth4/B1gaTOaU2 the technical info lists items known to be infected. but any mod could be

my advice, if you've downloaded any mods in the past four months, run the check, if it finds anything, wipe your harddrive and do a fresh OS install. if not, don't touch mc for now and keep your eyes out for updates

[calm plover]

uh better ask the author, but its maybe affected

[solid mason]

no clue on how to do the regsitry thing, but as far as the "microsoft Edge" with a space folder, its not there

yes i checked view hidden files n jazz

[calm plover]

When nothing appears it seems to be fine, are you using windows?

[solid mason]

yeap

[calm plover]

Would be nice, but I can only compare it later when im on a pc

[calm plover]

You can also look into the pinned messages, there is a bat script which does the same it is easier to handle

here: #🧱︱mc-other-help message

[small shell]

What is desktop.ini and where did it come from

[calm plover]

its from windows normal invisible file

[small shell]

Alright

[calm plover]

you can google it too

[small shell]

How do I know that that powershell method is trustable

[calm plover]

bec we say its trustable xD

[jolly turtle]

It's just checking for specific files to make sure they don't exist

[calm plover]

also many user already done it^^

[jolly turtle]

The existence of the files means you're infected

[solid mason]

did it, says nothing found

[steep nova]

Not sure if this has been answered, but have there been any sightings of 1.12.2 being affected?

[calm plover]

then you are fine

[solid mason]

cool

[calm plover]

Im general 1.16.5 + is affected known, we dont know any 1.12.2 malware for now

Im also not confident with the issue, but I will make later a list and also try to help a bit more

[steep nova]

Thank you :) Still gonna run checks tho

[restive cairn]

Guys hello, should I uninstall forge completely or just delete the mods I have and check with the script if I have the malware?

[lapis oracle]

announcements says no, just be patient and dont touch minecraft for the time being

[calm plover]

You dont need to uninstall forge, only check the malware with the script and dont update any mods for now.
We (or better named the cf team not me haha) are working for fixes right now

[dark trail]

I know its in the announcement but id still like to be reassured if we are 100% that this only affects MC and not WoW?

[maiden vector]

how does one download the bat script

[steep nova]

you are helping to fix the community chaos, that counts too!

[calm plover]

yep only minecraft mods, no wow - if i have new news I will send them to you

[lapis oracle]

they didnt code it into a bat file... just right click and run in powershell if ur on windows

[maiden vector]

im on java

i mean mac-

[lapis oracle]

im not sure if they are infecting mac users...

[maiden vector]

it said its primarily for java users but im really not sure

[calm plover]

Briar coded it into a bat file I think #🧱︱mc-other-help message

[maiden vector]

theres no file to click or download there

[steep nova]

as far as we know, MAC users are fine

[maiden vector]

hm ok thanks

[calm plover]

yep mac is fine

[marsh sparrow]

so what i need to do

[long thicket]

we still don't have a full understanding of the malware, staying away from mc even on mac might still be a good idea

[rustic wing]

everything that is known is here: https://hackmd.io/@jaskarth4/B1gaTOaU2 the technical info lists items known to be infected. but any mod could be

my advice, if you've downloaded any mods in the past four months, run the check, if it finds anything, wipe your harddrive and do a fresh OS install. if not, don't touch mc for now and keep your eyes out for updates

[whole pasture]

could there be a delay? with the malwearinstall?

i installed a modpack like a few days ago

tho i did the check and it didnt find annything

does the script only look for infected mods?

or does it also check the malware on how and where its installing and stuff?

[digital roost]

the script looks for where the infected mods might inject malware.

[whole pasture]

okay

than back to my first question

could there be a delay?

[rustic wing]

yes

[whole pasture]

so doing the check now does not realy say much?

[rich bronze]

we can at least boot curseforge and look at mods list right?

as long as we dont download anythin we fine?

[digital roost]

there isnt a delay the malware injects itself right when u run the mod or download it iirc.

[whole pasture]

okay

[frozen perch]

there should honestly be a faq

[whole pasture]

than i guess im fine

[whole pasture]

there should yes

maybe there busy making one now

who know

knows*

[jolly turtle]

FAQ:
Q: Are we fucked?
A: Yes.

[whole pasture]

lmao

[digital roost]

its still pretty new so theyre working on it. Its also like the middle of the night early morning on a weekday.

[steep nova]

most people dont read FAQ anyways...

[whole pasture]

its funny but also not funny

[frozen perch]

still better than people asking the same question over and over

[calm plover]

depends on the timezone^^

[whole pasture]

lol people will do it annyway cause people are lazy

[frozen perch]

true tho

[whole pasture]

and just ask the question instead of looking for it

so.... would it be okay to play the modpack?

or no?

🤔

[digital roost]

I would stay away from launching modded mc for the time being until people know for sure whats going on

[frozen perch]

no way to know for sure whether it contains infected mods or not

apparently this malware goes back to April

[long thicket]

from what I read, mac is still targeted, but has more security than windows, making it resist better to the attack,
but the risk still exists

[lost perch]

any new malwares should be suiciding due to the lack of the C&C Server (It's ddosed as of right now)

[long thicket]

if you're on linux, this script allow you to check each jar of a folder https://pastebin.com/T6aQ7C2E
there is no windows equivalent yet afaik

[frozen perch]

still imo don't play any mods until the issue is resolved

[long thicket]

a new C&C could be brought up at any time

[whole pasture]

i was literaly playing a pack wile this came up

😦

[winged chasm]

Guess we've got two different sets of information going around cos on either the hackmd or prism update page for it, can't remember which, it said that mac is unaffected as it seems hardcoded for hitting linux and windows, but that mac MAY be targeted in future

[steep nova]

hackmd

[long thicket]

I got it from here https://hackmd.io/5gqXVri5S4ewZcGaCbsJdQ which is linked in the main hackMD in the technical -> stage3 part

[winged chasm]

Lol I was updating my custom pack when I learned about it 😂 Thankfully though it was also surrounding the create 5.1 update (I've got a bunch of create addons that aren't updated to 5.1 compatible yet so I had to look at the changelogs to see if their newest versions were compatible and thus viable to download for the update)

Mentioned both cos I've read both of them and couldn't remember which it was xD

[calm plover]

trust pls the prism updates and from the cf admins/news - good sources to be informed, some people say not correct informations about the issue right now

[winged chasm]

I didn't say that either one couldn't be trusted 😛 Just wasn't sure which would be the more accurate of the two, cos one would have found out the info and shared it, and the other would have reported said information to boost it

In order of priority though, should we follow the Prism team or HackMD first?

[long thicket]

the prism news say to read the HackMD for updated information

[rustic wing]

hack MD is people who deal with this sort of stuff and is live updated

[fresh tulip]

Hello I have little problem here so I'm working on my files in my modpack so How can I add more mods into the file in curseforge

[sterile kestrel]

You may not be able to right now, as they've paused uploads right now to my knowledge

[fresh tulip]

Yeah it's not true

[sterile kestrel]

?

[whole pasture]

its weird to see tham type wile ur right there lol

[winged chasm]

Last I heard they paused the approval process

[fresh tulip]

because I upload my modpack yesterday I don't think it's paused

[long thicket]

they disabled it around 6h ago

[sterile kestrel]

^^

It was very early this morning. See #📢︱news

But I guess I misread and it's approvals

So maybe not who knows

[agile viper]

So what can be done to block this issue from happening in the future?

[unkempt briar]

any news on when 1.20 fabric mc being added to cf launcher?

[sterile kestrel]

The way this attack was launched was very obfuscated and sophisticated should note that a determined attacker 9 times out of 10 will obtain access. But this has highlighted many flaws in the system, particularly with a lack of code signing

[long thicket]

probably not until fabric 1.20 exists

[agile viper]

This might prompt the modloaders to make code signing mandatory

[restive cairn]

guys do you know if antiviruses like norton360 etc. can check and find the virus?

[long thicket]

as far as we know, no

[agile viper]

Very unlikely

[restive cairn]

ok

[agile viper]

This is malicious code inside of what is otherwise regular-ass mod files

[rustic wing]

they cannot. it takes about 6-12 months at minimum for antivirus software to be able to consistently catch new malware, and that's after the malware is discovered in the first place.

[agile viper]

There is no way for anti-virus to do anything without running into thousands of red herrings

[rustic wing]

everything that is known is here: https://hackmd.io/@jaskarth4/B1gaTOaU2 the technical info lists items known to be infected. but any mod could be

my advice, if you've downloaded any mods in the past four months, run the check, if it finds anything, wipe your harddrive and do a fresh OS install. if not, don't touch mc for now and keep your eyes out for updates

[restive cairn]

how do i run this?
%LOCALAPPDATA%\Microsoft Edge\libWebGL64.jar

[whole pasture]

u need to download the script

thats on the website

[restive cairn]

ok

[winged chasm]

That's one of the things the malware puts on your system

so if that's copied from your computer's windows explorer, you're infected

[tight dagger]

I found some infected mods

Im going to list them rq

[winged chasm]

...

[tight dagger]

Too many?

[restive cairn]

wait wdym

[winged chasm]

that's literally already in the hackmd live file...

[tight dagger]

Didnt see it

[winged chasm]

One of the files the malware creates is that .jar, and it places it in a directory called "\Microsft Edge"

[unkempt briar]

it does

[restive cairn]

i took the path, pasted in files explorer and it auto closed

[unkempt briar]

fabric loader can run on about anything

[random bone]

I think someone thought of that already

[winged chasm]

The path is only for windows so if you're on linux or mac that one doesn't apply to you

[open quest]

HI! someone in my guild just told me to delete any files I have updated in the last 24 hours and do a virus scan but when looking at my addon folder I'm not seeing which files were specifically downloaded/updated last night.. so I need to click on each one of these folders from 6/6/2023 ?

[winged chasm]

anyone currently on mac only is safe

[unkempt briar]

yay

[restive cairn]

i am on win11

[long thicket]

according to their release history, there are release candidate, nothing stable yet

[unkempt briar]

their loader is officially supposed to be mostly version independent and on a blog post it said their loader should work on 1.20

https://fabricmc.net/2023/05/25/120.html

[rustic wing]

everything that is known is here: https://hackmd.io/@jaskarth4/B1gaTOaU2 the technical info lists items known to be infected. but any mod could be

my advice, if you've downloaded any mods in the past four months, run the check, if it finds anything, wipe your harddrive and do a fresh OS install. if not, don't touch mc for now and keep your eyes out for updates

[random bone]

Just delete everything

If you dont use the mods you might aswel delete them

[open quest]

is this limited to minecraft mods atm?

[errant shale]

yes

[random bone]

Yeah, no other mods use .jar

[pale pecan]

so is curseforge safe 2 use?

[rustic wing]

everything that is known is here: https://hackmd.io/@jaskarth4/B1gaTOaU2 the technical info lists items known to be infected. but any mod could be

my advice, if you've downloaded any mods in the past four months, run the check, including the CF detector found at https://support.curseforge.com/en/support/solutions/articles/9000228509-june-2023-infected-mods-detection-tool/ if it finds anything, wipe your harddrive and do a fresh OS install. if not, don't touch mc for now and keep your eyes out for updates

[pale pecan]

I ANT READING ALL THA

[random bone]

No, just wait til they say all is good

[sterile kestrel]

Then what are you asking?

[pale pecan]

is a joke

i am readying it

readding

[sterile kestrel]

Oh ok lol

Text joke hard to see

Playing minecraft when uninfected is fine. If you must download a new mod or modpack, exercise extreme caution

[winged chasm]

Anyone know if adding the tool to a technic modpack you are the creator of would break it in the launcher?

[long thicket]

btw, curseforge detector only detect if you're already infected, it doesn't check if you have a malicious mod on your computer

[winged chasm]

cos I want to be able to add it to my technic packs but I also don't want to brick the packs and render my servers inaccessible to my players lol

[sage reef]

is it safe to launch minecraft now?

[long thicket]

no

[sage reef]

alright thanks

[long thicket]

vanilla is safe

[sterile kestrel]

If you haven't been infected you are fine. It's only if you downloaded it. If you have no evidence of stage 0 on the machine as far as we are aware you should be fine....

[long thicket]

vanilla is the only safe minecraft

[restive cairn]

what are stages 0 to 3?

[sterile kestrel]

Different deployment stages essentially. Each worse than the other

[fathom vessel]

One question. Should I be suspicious if my mod files have a large time gap between modified time and created time?

[sterile kestrel]

That could be a red flag right now

Oh wait yours?

[fathom vessel]

downloaded mod files*

[limber narwhal]

so does the malware onlly affect the ege browser or is that just where it is hiding?

[scarlet forge]

So if the DetectionTool says "Malware was not detected on your machine", can I open minecraft with the mods I've always used??

[sterile kestrel]

It's hiding in a fake edge folder

[long thicket]

stage 0 : hidden in a mod, download and execute stage 1
stage 1 : download stage 2 and make it execute on startup
stage 2 : download stage 3 and execute it
stage 3 : steal every stealable info

[sterile kestrel]

It would mean it didn't find any evidence of stage 0. Should be fine 🙂

[fathom vessel]

however, might worth note that there's no big time on about other half of mods

[limber narwhal]

ohhh so me not being able to find that folder anywhere is a good thing

[floral dune]

is better mc safe ?

[sterile kestrel]

Correct

[nova crown]

likely

every jar file should be considered unsafe

[floral dune]

what if i downloaded it a while ago & havent launched it in a few days can i get effected?

[nova crown]

better mc is fine currently

[eager sigil]

C&C server was stopped for now (10h ago-ish) so stage 0 first step is all it can do right now.

[twilit parrot]

Hello can you treat the new update of my project: Better-Survival. Because for 3 hours updates have not been released to the public

[long thicket]

C&C may be brought up at any moment, and if it happens will take time to get it down again, better not take unconsiderate risks

[sterile kestrel]

Approvals are paused....

[twilit parrot]

no

[eager sigil]

exactly, treat .jar files like the plague for a while

[winged chasm]

the tool checks all .jars on your computer right?

[sterile kestrel]

It checks known locations and filenames the malware uses

[long thicket]

no, it only check if you're already infected with stage 1 to 3

it doesn't detect stage 0

[tawny moat]

so only minecraft mods? no sims 4 or any other game rn

is that right

[long thicket]

only minecraft

[tawny moat]

mk then

thats not so bad i guess

[marsh sparrow]

vanilla too?

[tawny moat]

vanilla isnt modded lol

its the mods that are dangerous

[long thicket]

vanilla is fine

[sterile kestrel]

It can still affect vanilla though if you played modded

[tawny moat]

lmao

[restive cairn]

vanilla is the only safe version of minecraft you can use

[tawny moat]

wym by that

[sterile kestrel]

But if you never used modded keep using vanilla

[marsh sparrow]

how about mcreator mods

?

[sterile kestrel]

Part of its persistence from the hackmd. It tries to inject itself into all jar files

[tawny moat]

hmm

k i just wont play any minecraft related thing i guess idk

[rustic wing]

@twilit parrot @digital roost everything that is known is here: https://hackmd.io/@jaskarth4/B1gaTOaU2 the technical info lists items known to be infected. but any mod could be

my advice, if you've downloaded any mods in the past four months, run the check, including the CF detector found at https://support.curseforge.com/en/support/solutions/articles/9000228509-june-2023-infected-mods-detection-tool/ if it finds anything, wipe your harddrive and do a fresh OS install. if not, don't touch mc for now and keep your eyes out for updates

[winged chasm]

you have to avoid anything JAVA related lol

[sterile kestrel]

If you've played modded and you don't see those files on the system that's been found you should be fine. Just don't download anything else for now

[tawny moat]

alright

[winged chasm]

.jar is a java file, not a minecraft-specific file

[sterile kestrel]

Honestly. I've been tempted myself to simply spin up a vm completely isolated and see what it does lol. As an infosec major this kind of stuff fascinates me

Bogus email bogus account literally nothing on the system but that

[random bone]

You should, just make sure ur actually safe when doing it

[sterile kestrel]

Absolutely

[random bone]

Just straight up get the stage 3 on the vm

[sterile kestrel]

There appears to be some evidence that it's been found to detect if it's a vm though... the purpose is unknown so I've held off

[fathom vessel]

What's C&C again?

[sterile kestrel]

Command and control

Essentially the server they are using to take control of the infected machines

[fast python]

sorry im sure people have asked already but if the tool didnt find anything then i am safe to continue playing my already existing modpacks via the cursefroge launcher as long as i dont download/upload any mods right?

[random bone]

Just dont download or update any mods. You SHOULD be fine

[fast python]

okey xD ill just run the tool 5 more times over the evening xD

[past lichen]

so from the info ive gathered my linux machine is rather safe since this malware targets windows right?

[random bone]

They target both linux and windows

Not mac tho

[past lichen]

damn

unfortunate

[random bone]

Just run it twice and start trying to change passwords and stuff

[fast python]

changing passwords ? ._.

will the malware get excisted and show itself ?XD

excited *

[sterile kestrel]

Only if you a juicy target 😛

But ya long as it's not found anything you fine

[fast python]

okey ty xD

[sudden reef]

Is Modrinth also infected?

[fast python]

im just lost when it comes to the more difficult tech stuff rather just get confirmation from people who know more then try and research it myself

[steep nova]

so far these are the only four anti-viruses that can

[sudden reef]

Use the detection tool

[random bone]

What stage of the virus is it?

[steep nova]

same as the bat files are checking; not exactly sure about the numbering tbf .-.

[random bone]

Its not a problem of if it can, its a problem of how early it detects it

[fast python]

yepyep just saw multiple platforms mention to just stay away from minecraft but im an addict and need to tend my servers ._. so wanted to check if it was safe or not to just play if the tool didnt detect anything

[rustic wing]

everything that is known is here: https://hackmd.io/@jaskarth4/B1gaTOaU2 the technical info lists items known to be infected. but any mod could be

my advice, if you've downloaded any mods in the past four months, run the check, including the CF detector found at https://support.curseforge.com/en/support/solutions/articles/9000228509-june-2023-infected-mods-detection-tool/ if it finds anything, wipe your harddrive and do a fresh OS install. if not, don't touch mc for now and keep your eyes out for updates

[sterile kestrel]

I admin my own atm8 server lol I know the pain

[sudden reef]

If it didn't detect anything then it is probably safe but don't install and new mods

[restive cairn]

so i used these 3 detection tool, was that right?

[fast python]

got it thanks a lot people ❤️

[sudden reef]

Np

[sterile kestrel]

Essentially have been advising my friends to run the detection tool and if found take appropriate action. If nothing is found then they are safe to play, but to not update/ install until further notice

[random bone]

If it found nothin ur gud

[restive cairn]

perfect

i also uninstalled minecraft and deleted the .minecraft folder just to be sure

[candid needle]

Hey so one question

i have seen that on the mod list that were infected

there is a mod called anti chat report

and i didn't download it

[random bone]

Wat

[candid needle]

but i have a mod called no chat reports

is it the same or different?

[random bone]

Just run detectior lmao

[candid needle]

ye i runned it (even the funky command line on the prism website) tho i want to be 1000% sure

[restive cairn]

@candid needle these are the detectors you should use

[random bone]

Ur 99% safe

[restive cairn]

that 1% won't let ppl sleep lmao

[random bone]

Lmao

[little sail]

Never reported this, and forgot about it, but I got a virus from cursedforge back in September.

[restive cairn]

run the detector to be sure its not the same virus (very unlikely)

[random bone]

Mehh it should be fine now. Just ignore it unless you remember what you downloaded

[little sail]

Ok, I'm not home so I can't check.

[random bone]

If its actually the same virus you should report it

[restive cairn]

and i suggest cleaning your pc just to be 1000% sure

if its the same virus, maybe its the old version of it and its not connected to the C&C anymore, since you said you got it in sept

[little sail]

It was some crypto mining virus, just started up once I started minecraft after getting an updated mod, but I already cleaned my pc 3 trimes.

[random bone]

Oh, lmao. Ur fine i suppose

[grand fox]

what file do i use to run the detector

[restive cairn]

@grand fox

[scarlet forge]

So I now have modded minecraft open (yes I know it was risky), and the tool keeps saying "Malware was not detected on your machine", can I play safely with this modpack I made? obviously without installing or updating mc. Also does the detection tool work 100%?

[restive cairn]

the first .bat file is in pinned messages in #🧱︱mc-other-help

just run it and check if you have the malware

[grand fox]

these are the files i have

[restive cairn]

the second one is the script from https://prismlauncher.org/news/cf-compromised-alert/#automated-script

[sterile kestrel]

It detects the known locations that the malware is known to reside once it hits stage 1

If it doesn't detect anything after you have run minecraft, then it should be fine, just do not update until further notice

[restive cairn]

the third one is from cf support

[sudden reef]

What about seperately downloading mods from authors on curseforge website?

Is there a chance I am infected?

[grand fox]

is it safe to download better MC yet?

[random bone]

You shouldnt have any issues

[random bone]

I dont think so

[digital roost]

Curseforge was hacked?

[calm plover]

wdym? If you downloaded mods during the time when the problem occurred, there is a possibility of getting the malware - now its almost impossible to get it on curseforge

[calm plover]

nope, maybe read #🆘︱current-issues🆘

[versed dew]

DEVs will for shure make an announcement if its all save

[sterile kestrel]

Right now all projects are being reviewed

Until that time no mod or modpack should be treated as safe

If you MUST download again exercise extreme caution

[hard patrol]

does the curse forge detection tool check your installed mod packs? if its all good and clear, can we continue to play?

[random bone]

It doesnt check mods, it check if the virus ran stage 1

[restive cairn]

you shoud stay away from everything mod-related, till further notice.

[grand fox]

it checks the files that the mod inserts itself into

[deft wolf]

are older packs ok or are they unsafe too

[hard patrol]

got it , ty

[grand fox]

also unsafe

[restive cairn]

unsafe too

[deft wolf]

damn, i'd rather just wait it out then

[sleek nova]

So was RLCRAFT one of the hacked mods? i see it suddenly has an update

[random bone]

Dont update

Just dont.

Its not in the list but just dont

[safe panther]

If the detector says you are clear them you are safe to play existing downloads, just avoid downloading for now

[restive cairn]

best choice you can make

[sterile kestrel]

The list is living. It may or not be. We don't know the full scope yet

Thus why we say don't update

[calm plover]

Ask better on the Rl craft discord for this, always ask the author/team behind the pack

[sleek nova]

Is it safe to play if i don't update?

[deft wolf]

before i knew about it i had downloaded enigmatica 2 expert at like 1 am or sum today but i didnt see anything on my pc after the check

[sterile kestrel]

So long as stage 1 was not run(detector doesn't find it) then yes

[random bone]

The problem is that even if the detector finds nothing ur still not safe

Its possible for the virus creator to somehow get the dormant stage 0 virus active again and infect your system. But it will most likely be announced

[sleek nova]

is there a list of actual modpacks that have been infected? like pixelmon or BigChadGuys Plus

[sterile kestrel]

Check hackmd

[random bone]

All mods are assumed to be infected due to how the virus works.

Assume the worst

[sleek nova]

how do I check hackmd?

[candid needle]

wait so if it runned stage one, it could've run stage 3? (ik this might sound dumb but maybe it deleted the stage one files or stuff)

[random bone]

Huh

Just check the website

[candid needle]

which one

hackmd

curseforge support thing

or prism

[random bone]

@candid needle https://hackmd.io/B46EYzKXSfWSF35DeCZz9A#Credits

[candid needle]

aight thx

[gray mural]

I downloaded allthemodium and it was having a problem is this because of forge?

[sleek nova]

bro- you might wanna run the malware scanner in our discord.

[gray mural]

compatibility error

[grand fox]

if the CF checker doesnt detect anything are we 100% safe

[uneven folio]

i dont think so

[main tree]

what does "check for an entry "mean

what am I looking for here

like it says look for an entry but thats not very specific

[dapper smelt]

Why cant i go to curseforge without getting "error code 1"? i have tried running it without mods too

[carmine gale]

Paste created of latest.log, uploaded by Null.

[main tree]

I dont exactly know what an entry is

[restive cairn]

so guys if the detector says im all good, am i 100% safe or it doesn't check stage-0 and my pc can be infected later on?

[hard patrol]

an entry is anything on the right hand side

[main tree]

nah I think you're good

for now

[hard patrol]

you should be looking for stuff you don't know i suppose

[restive cairn]

wdym for now lmao

[lost perch]

It appears that most of the big ISPs now have the malicious ip sinkholed

[hard patrol]

you could have mods that are infected, the checker doesnt check the mods

[restive cairn]

i deleted all my mods

everything related to mc

[main tree]

Sorry I dont understand what you mean, but you mean data?

[restive cairn]

i deleted my .minecraft folder, all .jar mc-related files ecc.

[hard patrol]

https://i.imgur.com/REItHLY.png

this is an entry

[main tree]

So the name

in simple terms

[hard patrol]

sure

[main tree]

or are you referring to the red

[hard patrol]

anything on the right hand side, that has a name and a data entry, is an entry

so check those for things you dont know the name of

[main tree]

Might be on the right for you but for me it's on the left which im sure doesnt matter

[hard patrol]

i dont know why they didnt say what to look for specifically

oh really , didnt know you could move that around lol

[main tree]

check familiar things?

Only thing I dont know is this

Is "Spool" related to a fabric plugin?

[hard patrol]

do you use a espon printer

[main tree]

oh no wait this

yes

that ok yeah thats fine

[restive cairn]

am i safe?

[main tree]

Well you checked right

[restive cairn]

or just for now

[main tree]

and you deleted everything

[restive cairn]

yes

i checked multiple times

[main tree]

well here's the thing what theyre saying is that phase 3 hasnt activated

because their server went down or something

theyre saying it's really bad if it did happen but I think you're good

[restive cairn]

just phase 3? I saw that they check phase 1 too

[main tree]

just manually check the 3 spots

[restive cairn]

wdym how

[main tree]

https://hackmd.io/B46EYzKXSfWSF35DeCZz9A#If-your-browser-is-lagging-go-here-instead Phase 1 leaves 3 spots

[hard patrol]

https://i.imgur.com/rceYPUX.png

the curse forge detection tool does this for you if u used that

[restive cairn]

how do i check the first one

manually

[main tree]

linux or windows

[restive cairn]

win

[main tree]

I would just do local app data

see if theres a microsoft edge folder WITH a space like "Microsoft Edge"

thats a fake one

[restive cairn]

how do u do that?

[main tree]

do %LOCALAPPDATA%

[restive cairn]

in win+R?

[main tree]

nah just file explorer

[lost perch]

both works

[restive cairn]

ok

[main tree]

in the little black par near the top

search it up

see if theres the fake folder

if not you're good

[restive cairn]

i dont have the microsoft edgebut i have this

[grand fox]

most of those spots dont even exist for me, I dont have a Microsoft Edge folder anywhere, should i be fine?

[sleek nova]

For example I have Microsoft and MicrosoftEdge, not a 3rd one

[main tree]

No folder means you're good

[restive cairn]

what are these?

[main tree]

for the third option you just need to see if theres any kind of shortcut

[restive cairn]

how do it do that?

[main tree]

Focus on the first one first

i have no idea what those are

but do you have the microsoft edge folder with a space

[restive cairn]

i did it, there's no microsoft edge

[main tree]

Good

[restive cairn]

ok

ty btw

[main tree]

are you in the startup folder

np

[restive cairn]

nope

[main tree]

oh same thing as first except just type in the full folder location

%appdata%\Microsoft\Windows\Start Menu\Programs\Startup

[restive cairn]

ok just a sec

[main tree]

if there is a shortcut file that is bad

[restive cairn]

ok the folder is empty, there are no shortcuts

[main tree]

oh good

2nd method is a little complicated

[sleek nova]

im so safe i aint even got a start menu folder for microsoft

[restive cairn]

for the registry, step 2, what do i do?

[restive cairn]

lmao

[candid needle]

wait im confused af, i runned with windows+r %LOCALAPPDATA%\Microsoft Edge, and it opened me to C:\Users\user\AppData\Local\Microsoft

so it means im safe or im dumb

[main tree]

what the hell how dont you have one

[sleek nova]

idk

[main tree]

Local app data is just like a short way to say it

[sleek nova]

my defenses are unbeatable

[main tree]

it's completely normal

its if you want to go to your local data without having to click all folders

[main tree]

Go

[restive cairn]

ok

[candid needle]

the weird thing is, i don't see that microsoft folder if i try to open it from local

[main tree]

microsoft Edge?

[candid needle]

and i have hidden files turned on

[main tree]

with a spacebar

Microsoft Edge

[candid needle]

ye i checked it already and i don't have it

[main tree]

Good

thats a fake folder created by the virus

[restive cairn]

when i hit enter its just the same

[main tree]

wdym

try clicking on hkey current user

expand the list

and click on software

[restive cairn]

ok

[stuck hinge]

What file do i run to run the detectoon tool?

[main tree]

the .exe I think

[restive cairn]

and

[main tree]

microsoft

then windows

then current version

then run

tell me once you're there

[restive cairn]

I am there

[stuck hinge]

Theres no .exe

[main tree]

https://github.com/overwolf/detection-tool

[cunning path]

Did you ever figure this out? Lmao

[main tree]

Oh where'd it go

idk where the exe is

[main tree]

Hell no this is so stupid

what language do you speak pheonix

not an insult but for info

[restive cairn]

italian

[cunning path]

https://github.com/overwolf/detection-tool/releases/download/0.0.1/DetectionTool-0.0.1.exe This is the exe link

[restive cairn]

yeah ik sorry

[stuck hinge]

The filder has no .exe file

[candid needle]

i might have an idea for it

[cunning path]

Gotcha. Only ones on mine that seemed sus are the AutoLaunchers. But they appear legit from a quick search

[main tree]

Then you're good

[restive cairn]

wdym lmao

[main tree]

was wondering about the (predefinito)file

[restive cairn]

it means default

[acoustic cedar]

uhm the virus what to do

[main tree]

yeah thats default in italian i have it too

[cunning path]

I think its just the default path for a registry

[limber narwhal]

what are you checking in the registry for? I have an overwolf entry in HKEY_CURRENT_USER\software\Microsoft\Windows\CurrentVersion\Run

[main tree]

but in english

[restive cairn]

ohhh r u italian

[main tree]

no I mean I have the same file just diff language lol

[restive cairn]

oh yeah ok

[main tree]

Had the same question

it's not stated

[cunning path]

Not sure, I presume it'd be something either mentioning "Microsoft Edge" with a space, or something that none of your installed apps correspond to

[main tree]

I dont know

I was told to check for anything you dont recognize

[stuck hinge]

I just ran the visual studio file and it seems to work

Luckily im not infected

[restive cairn]

i have 3 .exe files in here

its chrome.exe

[cunning path]

I'll be honest I don't dip into the registries on the regular so I don't recognise any of it

[candid needle]

i think it's to check if there is some unknown one, like with file address going to the virus

[restive cairn]

msedge.exe

[main tree]

Yeah

probably for that reason

[main tree]

Based on the names you should know some

[restive cairn]

and like onedrive.exe

am i good

[main tree]

see if there are any abnormal locations

[restive cairn]

there arent any

[main tree]

I think, only concern is the microsoft edge

idk if thats real or not

check its location

[restive cairn]

ye

[main tree]

if its real you're good

[restive cairn]

ok

[main tree]

https://github.com/overwolf/detection-tool/releases/tag/0.0.1 is it this?

[cunning path]

Oh yeah for sure. But it'd be hard for me to check if the virus was disguised as, idk, the docker desktop registry

[main tree]

I would check the file locations

[restive cairn]

ty @main tree

[main tree]

my reason for asking this is the fact that the dude who made it has only made one contribution in 2021

np

oh wait no its fine the links are the same

its trustworthy

ok i gtg now

[cunning path]

Yeah, my only noticable thing there is that chromium (which I could've sworn I uninstalled but hey maybe this is a remnant) is using a lower case path.

[candid needle]

probably looking like this (mockup)

[cunning path]

Where's this screenshot from?

[candid needle]

me, edited in paint just to make a mockup of what it could look like

[pale pecan]

so how is it going anyone know how long till i can use it?

[main tree]

oh yeah that is definitely suspicious

[main tree]

would wait a day or 2 or change launchers entirely depending on how it goes

all depends on how it spreads

[pale pecan]

im useing ATlauncher atm

but curseforge

is ez

for servers

[main tree]

very easy yeah

I would keep your server down and not install any mods until they have a full list of mods that have virus

[pale pecan]

yea

[umbral hedge]

what do i do when this appears?

just discovered about the curseforge breach

[hoary ridge]

why u on paint

[umbral hedge]

to zoom

[grand fox]

Is it best to just stay away from modded Mc rn until further notice?

[hoary ridge]

$appData = "$HOME\AppData"
$edgePath = "$appData\Local\Microsoft Edge"

$badPaths = @(
        "$edgePath\.ref",
        "$edgePath\client.jar"
        "$edgePath\lib.dll",
        "$edgePath\libWebGL64.jar",
        "$edgePath\run.bat",
        "$appData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\run.bat",
        "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\t"
)

$res = $false

ForEach ($Path in $badPaths) {
        if (Test-Path -Path $Path) {
                Write-Host "bad file found! removing $Path..."
                Remove-Item -Force $Path
                $res = $true
        }
}

if (!($res)) {
                Write-Host "nothing found! :)"
}

Read-Host -Prompt "press any button to exit"

Just run it if it does say it then you gotta delete your curseforge or smth and reinstall windows thats what i heard people were doing i think it also auto removes

the bad files

[cunning path]

Probably easiest. Curseforge are checking all the mods and have removed the known bad ones. Modrinth are checking their mods too, so there should be an answer pretty fast.

[grand fox]

Ig imma just enjoy the new update then lol

[hoary ridge]

@umbral hedge if u have it run this this is by curse forge themselves

[grand fox]

Where do I run Prisms detection script? It doesn’t work in command prompt

[hoary ridge]

run in terminal

not command prompt

[candid needle]

powershell

[hoary ridge]

terminal or powershell

[hoary ridge]

thenn u got no malware i advised just deleting curse forge for now and all the mods

i did that idk if u want to do that

[candid needle]

delete the app?

[umbral hedge]

well guess its for the best, even though i have an huge scp foundation

[candid needle]

cuz i saw that it's recommended to not delete

[hoary ridge]

idk i just delete it for saftey issues i really don't want my account to get compromise most importantly my pc kinda stopped playing mc i just heard about this and now im abit worried

[umbral hedge]

actually its better not to play modded minecraft. i don't find an reason to delete curseforge as a whole

[hoary ridge]

yeah alr

[cunning path]

Curseforge itself is fine and hasn't been compromised. The mods have

[umbral hedge]

atleast 1.20 will release today

[cunning path]

So just don't launch any modpacks to be safe

[lament hearth]

Yeah, I deleted all the modpacks just to be safe.

[umbral hedge]

guess its time to say goodbie to all my beloved modpacks. goodbye scp foundation that took months for me to build, guess it will be fun to build other

goodbye i mean

[cunning path]

You should be able to save the world

[candid needle]

you can always put it into a cloud or smth

[cunning path]

Just, remove the mods for now

[umbral hedge]

so i will create an backup real quick

[cunning path]

Just create a backup without the mods yeah

[rancid plover]

phew, no Edge folder with space here, just the normal edge that was last changed in 2018 lol

[lament hearth]

Yeah, I searched for that file with no luck, so i should be clear.

[uncut glacier]

yeah im not gonna delete my huge world with create i have spent the last 6 months building ill just wait for all of this stuff to get sorted out and go back on my mod pack when everything has been sorted

[cunning path]

Though that seems to only be created when you run minecraft. You could still have infected mods installed

Hence why it may be better to do a fresh mod install after this whole thing afaik

[uncut glacier]

it's just modded

[umbral hedge]

bro this hackmd.io takes years to load. i need to check if there is this edge folder with an space

[sterile kestrel]

Use the click here link at the top. Takes to an alt page

I had to as well

[unborn bloom]

Is there any possibility of a database leak or a account vulnerability? Or has this not been comfirmed or denied?

[umbral hedge]

thanks, i didn't realize it

[unborn bloom]

It seems suspicious multiple maybe more were breached and there wasn't a investigation done

[umbral hedge]

in my %LOCALAPPDATA%\Microsoft Edge\libWebGL64.jar files it only says EDGE. am i safe?

[rancid plover]

they say only newer mods are affected? Is this confirmed?

[umbral hedge]

instead of microsoft edge its edge i mean

[rancid plover]

I'm still a 1.12 boomer

[grand fox]

im so confused on how to run it

[rancid plover]

you should not have a folder with a space

[candid needle]

wait what

ye

[umbral hedge]

there is no space, just edge

[candid needle]

try running %LOCALAPPDATA%\Microsoft Edge\ on windows+r

[umbral hedge]

not even microsoft in it

[candid needle]

and tell us what folder r u in

[rancid plover]

legit microsoft edge folder looks like this:

[umbral hedge]

this is what mine looks like

[rich flint]

See the article in #📢︱news for a link to an easy to use detection tool made by curseforge

[rancid plover]

that looks okay? but don't trust me

[candid needle]

weird, what's inside it?

[faint walrus]

i also only had a folder named Edge and no MicrosoftEdge or Microsoft Edge, and as far as i can tell by running the tools and manually searching for the malicious files im fine

[umbral hedge]

i will send 3 images to show what's inside it

[proper zodiac]

hey does it affet a modpack that have not been updated?

[candid needle]

lol i don't have neither, no edge no microsoftedge and no microsoft edge

[candid needle]

i would say it's legit

[umbral hedge]

no weird libwebgl64 file found, i'm happy with that

[hearty loom]

so after using the dection tool and it says no thats it im good im safe or no cause i been hearing that left and right

[trail tundra]

so i ran %LOCALAPPDATA%\Microsoft Edge\libWebGL64.jar thru win+r and it landed me here.... im no tech savvy so i have no clue

[candid needle]

its good

i have the same

[unkempt briar]

1.20 is not in the CF Launcher

[rich flint]

See #📢︱news for a tool to automatically do what you are looking for

[trail tundra]

alr thankyou

[rich flint]

It's not automated to be added. Give it time. Also very few if any mods would even be available by authors yet. Forge will take awhile to publish a version anyway. So it will be fabric and quilt for a bit because they are made with vanilla code that was already mostly published in pre releases

[unkempt briar]

ok

[rich flint]

I'm hyped for it though

[indigo carbon]

is this the infected entry or a normal one?

[unkempt briar]

ya i want to be 1st modpack in cf for 1.20

[proper zodiac]

is this good?(i just want to play moded)

[rancid plover]

it ran your command up to that space character

[rich flint]

Use the scan tool in #📢︱news

A list of effected mods is also published

[rancid plover]

so you landed in the microsoft folder

[cunning path]

Run the program in #📢︱news to see if you have the virus. And running modded atm is somewhat risky, but no one can stop you

[unkempt briar]

will the removed mods be restored after the hacking?

[rich flint]

No. Mod authors with removed files will publish new ones if that's the case

[unkempt briar]

ya but the pages themselves

[near fjord]

Is cursemaven affected by the compromising?

[proper zodiac]

how to make it work?

[unkempt briar]

anything with api

[near fjord]

https://www.cursemaven.com/

[candid needle]

might be

i think it was mentioned in the hacksomething article

[rich flint]

Read #📢︱news
The issue was with published infected mod files. No curseforge internal systems were hacked

[cunning path]

you just... download it and run it

[unkempt briar]

Also do you know how to upload mods without specifying loader any more? i used to do that for unsupported loaders like LiteLoader and others but it dont let me anymore

[cunning path]

Like its remarkably simple

[prisma girder]

do some one no why wenn y try to launche mincraft with forge-40.2.9 it put me dat "sorry impossible to launche Mincraft"

[digital roost]

One question. When I ran your script and it says that I'm not infected. Am I save to start Curseforge and run a Modpack without updating it?

[candid needle]

i think you could be fine, but i would suggest just not play modded mc

[lament hearth]

Personally, I wouldn't run any of the modpacks. Right now, the malware could just be sitting dormant and activates once you run MC.

[candid needle]

ye

[digital roost]

ok thanks, but can I build mods from github and play them safe?

[lament hearth]

I don't think that is the best play. Maybe it is safer, but we should be careful regardless of origin.

[digital roost]

ok

[rich flint]

read #📢︱news for a list of mod projects that had uploaded malware mod files

[jovial wagon]

honestly if i were you i'd refrain from playing minecraft and especially modded until they push out patches

[digital roost]

can I pull a server pack (fabric) from my server (downloaded May 12) and start it with the Fabric launcher without running any risks?

[jovial wagon]

really sucks especially with 1.20 having just come out but better safe than sorry

[lament hearth]

Honestly, I don't think it affects the main MC launcher, so if you got that, it should be fine. I still recommend doing a virus and detection afterwards to ensure the file is not in an active state afterwards.

Still, Engi is right. Probably safer this way.

[quick pelican]

https://prismlauncher.org/news/cf-compromised-alert/ ?

[jovial wagon]

good news is with something this dire they likely won't take too long to release said patches

[rich flint]

see the article and scan tool in #📢︱news

[jovial wagon]

and if you really want to play 1.20 we do all have bedrock edition now

not ideal but i'll probably do it for feature experimentation

[woven cloud]

I think I'll wait on playing 1.20.

[candid needle]

did you do %LOCALAPPDATA%\Microsoft Edge\ in windows + r?

[sage shore]

Yeah

[candid needle]

then you good

tho try the scanner in the #📢︱news

it could always be in start

[winged goblet]

Hi I had a question regarding the detector tool, if the mod was downloaded from the website instead of the overwolf client can it still be detected by the tool?

[candid needle]

it's not searching for mods

it's searching for malware outside .minecraft

especially %LOCALAPPDATA%\Microsoft Edge\ and in startup folder

[winged goblet]

Ok thank you!
sorry for the dumb question

[lament hearth]

No dumb questions when it comes to cybersecurity, mate. Not dumb at all.

[sage shore]

I just tried it now... and it said that it detected no malware!

[candid needle]

then you should be fine

[sage shore]

Thank you for telling me

[sterile kestrel]

As an infosec major I concur with this statement lol