Jump to content

Recommended Posts

  • Administrators
Posted
  On 5/4/2022 at 4:51 PM, Buckwild said:

I've been informed that there is ETLegacy installer on Web with virus.

Only download from: https://www.etlegacy.com/

Expand  

 

Not 100% true, always. As saying goes always download from reputable source. 

 

We normally link the download back to original source but not all websites do that. So what happens is counter get broken and stats doesn't get generated correctly. So what folks spread is other sources CAN have virus to caution users. 

 

I take it with grain of salt. Always do your due diligence. 

  • Like 1
  • 100 4
Posted (edited)
  On 5/4/2022 at 5:25 PM, daredevil said:

We normally link the download back to original source but not all websites do that. So what happens is counter get broken and stats doesn't get generated correctly. So what folks spread is other sources CAN have virus to caution users. 

Expand  

 

True this!

 

  On 5/4/2022 at 4:51 PM, Buckwild said:

I've been informed that there is ETLegacy installer on Web with virus.

Expand  

 

 

Example with one of binaries spread on the first page of google page:

 

1566973776_Capturedcran2022-05-04204817.thumb.png.9094927f76f04e486f6db2369837bd34.png

 

 

Always (and only) download from source (or very very very trustful website ... as FA 😛 )

 

 

Edited by GHARIB
  • 100 3
Posted

you guys and ladys don't forget that there are fake ET  downloads out there to ppl have way to much free time lol 

Posted

This happened to me with the real legacy exe. I had to add an exemption through windows security and also remove it from quarantine. 

  • Surprise 1
  • 2 months later...
Posted (edited)

And to clarify something, they are not "FAKE" installers (as said in title), but real installer (the original one) with a malicious payload (injected code)

It will install real ETLegacy, but also malicious code.

 

In these following examples  (for educational purpose only),  that I have "home made" for my own research in my labs, it would give total control of the computer remotely (and when I say total control, it means even more than the computer owner himself 😄 )

Of course, you will not find any details here about the "how to" .

 

This first one is "noisy" and detected by most of security vendors:

 

Capture5.thumb.PNG.6859c9d612fcd6688b82e930646dc80e.PNG

 

 

This second one, it is more sneaky,  and almost not detected

 

 

Capture3.thumb.PNG.a7ceaf534419cfed5fe07c32476b478f.PNG

 

 

And of course, malware can be more hidden again, I have voluntary made them noisy for the example :=)

 

To make it simple, your computer will leak all what you are doing, all your files, passwords, all what you type, even your webcam and micro could be activated remotely!

 

So always check from where you download your files.

 

you can still check that a file doesn't have any payload and is the original one by comparing the checksums :

Capture.thumb.PNG.ea0158c46ccd127f5b299e39be11e955.PNG

 

compare with the hash of the file you have :

 

- on windows (command prompt) :

certutil -hashfile etlegacy-v2.80.2-x86.exe MD5

 

- on linux (i have taken the windows file for the example) :

└─$ md5sum etlegacy-v2.80.2-x86.exe
21117c6dce84ff1d14b92287d6bc05ca  etlegacy-v2.80.2-x86.exe

 

Or online here : https://www.virustotal.com/

Capture.thumb.PNG.c69644c46d756aabf5cc1ea35d422b1f.PNG

 

 

 

If it is different -> 🤢🤢🤢

 

So , once again, always (and only) download from source (or trustful website)

 

 

Edited by GHARIB
  • Thanks 4
  • 100 3
  • 2 months later...
Posted (edited)

I've been using the same couple of installers for each version of ET my entire ET career. Store them on a separate drive and reuse for all reformats or new builds.  Think I still have the original  install and 2.6b files on a CD that the guy who got me into ET gave me.

 

This reminded me of all the newer titles using anticheat software requiring kernel level access.  Yes it works well for detection but game developers aren't always overly concerned with your security, only stopping hackers in their games.  They end up creating something that will stop a lot of cheat software but at the expense of giving people a way of gaining complete access to your system.

Edited by Haruhi Suzumiya
  • Like 2
Posted

So is the etlegacy from the original website sketchy? Should I uninstall it and run vanilla?

Posted
  On 9/28/2022 at 2:44 AM, MaTt0 said:

So is the etlegacy from the original website sketchy? Should I uninstall it and run vanilla?

Expand  

 

You are good to use the original as of right now as I post this.  If you wait 10 minutes I cannot be held responsible.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below.
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.