ET Fake ETLegacy Installer

[Buckwild]

I've been informed that there is ETLegacy installer on Web with virus.

Only download from: https://www.etlegacy.com/

[daredevil]

31 minutes ago, Buckwild said:

I've been informed that there is ETLegacy installer on Web with virus.

Only download from: https://www.etlegacy.com/

 

Not 100% true, always. As saying goes always download from reputable source. 

 

We normally link the download back to original source but not all websites do that. So what happens is counter get broken and stats doesn't get generated correctly. So what folks spread is other sources CAN have virus to caution users. 

 

I take it with grain of salt. Always do your due diligence. 

[GHARIB]

1 hour ago, daredevil said:

We normally link the download back to original source but not all websites do that. So what happens is counter get broken and stats doesn't get generated correctly. So what folks spread is other sources CAN have virus to caution users. 

 

True this!

 

2 hours ago, Buckwild said:

I've been informed that there is ETLegacy installer on Web with virus.

 

 

Example with one of binaries spread on the first page of google page:

 

 

 

Always (and only) download from source (or very very very trustful website ... as FA 😛 )

 

 

Edited May 4, 2022 by GHARIB

[*Kiba*]

you guys and ladys don't forget that there are fake ET  downloads out there to ppl have way to much free time lol 

[MaTt0]

This happened to me with the real legacy exe. I had to add an exemption through windows security and also remove it from quarantine. 

[GHARIB]

And to clarify something, they are not "FAKE" installers (as said in title), but real installer (the original one) with a malicious payload (injected code)

It will install real ETLegacy, but also malicious code.

 

In these following examples  (for educational purpose only),  that I have "home made" for my own research in my labs, it would give total control of the computer remotely (and when I say total control, it means even more than the computer owner himself 😄 )

Of course, you will not find any details here about the "how to" .

 

This first one is "noisy" and detected by most of security vendors:

 

 

 

This second one, it is more sneaky,  and almost not detected

 

 

 

 

And of course, malware can be more hidden again, I have voluntary made them noisy for the example :=)

 

To make it simple, your computer will leak all what you are doing, all your files, passwords, all what you type, even your webcam and micro could be activated remotely!

 

So always check from where you download your files.

 

you can still check that a file doesn't have any payload and is the original one by comparing the checksums :

 

compare with the hash of the file you have :

 

- on windows (command prompt) :

certutil -hashfile etlegacy-v2.80.2-x86.exe MD5

 

- on linux (i have taken the windows file for the example) :

└─$ md5sum etlegacy-v2.80.2-x86.exe
21117c6dce84ff1d14b92287d6bc05ca  etlegacy-v2.80.2-x86.exe

 

Or online here : https://www.virustotal.com/

 

 

 

If it is different -> 🤢🤢🤢

 

So , once again, always (and only) download from source (or trustful website)

 

 

Edited July 12, 2022 by GHARIB

[Haruhi Suzumiya]

I've been using the same couple of installers for each version of ET my entire ET career. Store them on a separate drive and reuse for all reformats or new builds.  Think I still have the original  install and 2.6b files on a CD that the guy who got me into ET gave me.

 

This reminded me of all the newer titles using anticheat software requiring kernel level access.  Yes it works well for detection but game developers aren't always overly concerned with your security, only stopping hackers in their games.  They end up creating something that will stop a lot of cheat software but at the expense of giving people a way of gaining complete access to your system.

Edited September 28, 2022 by Haruhi Suzumiya

[MaTt0]

So is the etlegacy from the original website sketchy? Should I uninstall it and run vanilla?

[Haruhi Suzumiya]

16 minutes ago, MaTt0 said:

So is the etlegacy from the original website sketchy? Should I uninstall it and run vanilla?

 

You are good to use the original as of right now as I post this.  If you wait 10 minutes I cannot be held responsible.