PSA: Malware detected from member's upload

[Scar17]

Hi! Thank you so much to everyone who's answering questions and contributing. It's a shame these things happen :(

I have a question, is the list of infected games final? Or is it still possible that more infected games will be found?

 

[Checkmate]

I have a question, is the list of infected games final? Or is it still possible that more infected games will be found?

The list is from what the member posted on ASF. For new member to post on ASF, they are subjected to throttling such as 1 thread per hour, all thread is held in the approval queue. Therefore, the member coudn't post many in the span of 1 month.

If you download your game from sources like Tokyo Toshokan or Nyaa Torrents, the same member may have shared more content since they aren't subject to the same throttling.

Unfortunately it's hard to say whether other Uploader/Contributor redownload somewhere else as well.

 

[bidlocat0]

Add [RJ01524403] to this list, it was also most likely distributed by the well-known jekson5865/hentaigamer**
But I can't vouch for the game uploaded here. It was originally posted on a popular anime tracker similar to nyaa, and this torrent is also indexed by TokyoToshokan. (A hint to the site, because I'm not sure if it's allowed to mention/write names websites)

Why so many worries, just use Free antivirus tools. Many years, use CureIt, from Cd -> Dvd -> Flash.
https://free.drweb.ru/download+cureit+free/
ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe
Kaspersky Virus Removal Tool
https://www.kaspersky.ru/downloads/free-virus-removal-tool?ysclid=mjviudgnex23020704
If, you still worry, just install Full version, any Antivirus, you get 30 days free, for test.
https://www.av-test.org/en/
P.S If, you have Virus, (more important Troyan) , they can ease change, file name, regname. If, they already inside.

If you read the article published by Huorong and uploaded the infected files (if you had any, for example), you'd realize that currently only two antivirus programs detect them: Huorong and Rising, and nothing else. I got infected myself, and the first thing I did was, as an experiment, scan my computer for viruses using AV scanners (KVRT, Cureit, Minersearch), and they found nothing. The most CureIT could find was a modified line in REGEDIT, and that was it. As for the miner itself, it wasn't found.

 

[PhantomMemos]

Is it known for how long had this user been sharing infected files?

 

[Checkmate]

I'm not sure if it's allowed to mention/write names websites)

ASF does not forbid mentioning of other sites, blogs or forums unless spamming.

Is it known for how long had this user been sharing infected files?

First post here is around December 10

 

[bidlocat0]

By the way, this might sound pretty crazy to some, but one of the games on the list, namely — RJ01524136, was initially infected with a cryptominer (libegl.dll, cacheapp, etc.) and sold with it on DLsite.
How could this have happened? Who knows, most likely the developer was infected too, and the infected files "migrated" to their game. But that's just my theory. On one of the content sharing forums, a user posted a screenshot of this game purchased from them, and it was the game they bought that infected them.

 

[Checkmate]

To be fair I did mention there is nothing such 100% safety. Even if one buy it from DLSite, it will be lowest risk but not absolute.

Stay safe, we are stronger together.

I am looking into that possibility at the moment but it is the holiday...

 

[figma1356]

By the way, this might sound pretty crazy to some, but one of the games on the list, namely — RJ01524136, was initially infected with a cryptominer (libegl.dll, cacheapp, etc.) and sold with it on DLsite.
How could this have happened? Who knows, most likely the developer was infected too, and the infected files "migrated" to their game. But that's just my theory. On one of the content sharing forums, a user posted a screenshot of this game purchased from them, and it was the game they bought that infected them.

View attachment 85785

In that case, I find it strange if all ddl hentai game sites are not infected.
I downloaded the same thing from ryuugames and scanned libEGL.dll with virustotal, but Huorong did not detect it as
TrojanDropper/CoinMiner.d.
I cannot say for sure as I have not performed dynamic analysis, but since there is antivm, I cannot scan it without a sub-PC.

 

[4yvak]

Add [RJ01524403] to this list, it was also most likely distributed by the well-known jekson5865/hentaigamer**
But I can't vouch for the game uploaded here. It was originally posted on a popular anime tracker similar to nyaa, and this torrent is also indexed by TokyoToshokan. (A hint to the site, because I'm not sure if it's allowed to mention/write names websites)

If you read the article published by Huorong and uploaded the infected files (if you had any, for example), you'd realize that currently only two antivirus programs detect them: Huorong and Rising, and nothing else. I got infected myself, and the first thing I did was, as an experiment, scan my computer for viruses using AV scanners (KVRT, Cureit, Minersearch), and they found nothing. The most CureIT could find was a modified line in REGEDIT, and that was it. As for the miner itself, it wasn't found.

My, Kaspersky Premium perfectly find, 3 days ago, when i try run game. Database Update, several times every day, for all Antivirus. Your, Old database, cant find, okay, that normal. Second need Activate, All check, not a light check, in side config, your Antivirus. And, i don`t remember, i write it help imideatly 100%, if you find, when i write it, give me. Or, you think, i need search load and check my self, virus <-> against antivirus.
-
when i check again (Reg) right now, i find only link to C:Users\''YourUsedName''\AppData\Local\Scacheapp
nothing more, no file no other changes, Kaspersky delete body virus, and folder, but automatic (Reg(Windows) create link, in Last used folder, anyway.
-
Windows Reg creat big ammount of garbage, need Clean, and Clean. Every month.