429

Anyone who downloaded the GOG Baldur's Gate 3 release from 1337x, scan with Malwarebytes asap! (kbin.social)

submitted 1 year ago by GeekFTW@kbin.social to c/piracy@lemmy.dbzer0.com

90 comments fedilink hide all child comments

Originally posted over on /r/piracy (https://www.reddit.com/r/Piracy/comments/15itrip/1337x_admins_allowing_bg3_torrent_with_bitcoin/)

It looks like a bitcoin miner was included in the installer, and the admins on 1337x may or may not give a shit apparently. Scanned my pc and my wifes and found the same stuff the others mentioned.

According to the other comments, don't feel the need to uninstall as the miner was installed separate to the game, just give a Malwarebytes scan to get rid of the junk.

top 50 comments

sorted by: hot top controversial new old

[-] fourohfour@lemmy.fmhy.net 125 points 1 year ago

It's even worse apparently. Apparently someone looked at where the coins are going, and the coins are going to the 1337x admins, and the uploader is just getting a cut of those coins. Which explains why the admins are unlikely to really care because they're profiting off their users.

I have severe trust issues with any kind of pirated software so I basically never download it as a result, and shit like this is why. Even private trackers and "trusted" groups aren't enough for me to download most software.

[-] Steeve@lemmy.ca 32 points 1 year ago

Do you have any evidence of that?

[-] rmnfxytumavcfdbpce@lemmy.dbzer0.com 39 points 1 year ago

[-] _comfortablyAverage_@lemmy.ml 29 points 1 year ago

can we get some proof? this is really interesting. I'd like to see how they're tracking stuff

[-] Pulp@lemmy.dbzer0.com 14 points 1 year ago

How did they figure that out?

[-] Shere_Khan@lemmy.dbzer0.com 43 points 1 year ago

Crytpo isn't inherently anonymous. you can easily follow coins.

[-] lemming007@lemm.ee 11 points 1 year ago

You can follow the wallet address , but unles you know who the address belongs to, you can't follow it. So we ask again, where the proof that the coins went to site admins?

[-] deluxeparrot@feddit.uk 99 points 1 year ago

For gog games you can check the digital signature on the installer to make sure it's legit. It should be signed by GOG.

[-] empireOfLove@lemmy.one 95 points 1 year ago

If you aren't scanning every software you download, whether a pirate torrent or normal direct download, that's kinda your own fault

[-] teft@startrek.website 78 points 1 year ago

Motherfuckers out here rawdogging the internet like it's 1998.

[-] crow@beehaw.org 16 points 1 year ago

It just feels better… I can’t feel the bits otherwise.

[-] Piecemakers3Dprints@lemmy.world 8 points 1 year ago

Even in '98, that was fucking stupid.

[-] kniescherz@feddit.de 71 points 1 year ago

To be fair, I cannot remember a software where no anti virus program turned red. Those cracks always look suspicous to the heuristics.

[-] empireOfLove@lemmy.one 23 points 1 year ago

Of course but it's usually pretty easy to filter out the false positives that always appear as a Trojan (because of the file modification payload) vs a crypto miner

[-] Graphy@lemmy.world 10 points 1 year ago

Do you have a guide or anything I can checkout? I usually google what flags show up and use big name uploaders but never know for sure.

[-] Pulp@lemmy.dbzer0.com 5 points 1 year ago

They usually say something generic like HackTool.

load more comments (1 replies)

[-] GeekFTW@kbin.social 18 points 1 year ago

Oh 100%. Was a dumb moment where I didn't expect it and didn't bother, and neither did a lot of other people from the looks of it. Good thing is it was something fixable in less than 5 mins and not a bigger problem.

[-] AceBonobo@lemmy.world 7 points 1 year ago

I would completely reformat all affected machines. AVs are not perfect. Yes it sucks, but imagine the consequences of doing any form of banking on an infected machine.

load more comments (1 replies)

load more comments (3 replies)

[-] HatchetHaro 69 points 1 year ago

Just popping in to say that if you enjoy the game and if you are financially able to, buy the game properly to support the developers, especially Larian Studios.

[-] posedexposed@kbin.social 19 points 1 year ago

If a dev studio should be financially incentivized to keep doing what they're doing, it's this one

[-] eagleeyedtiger@lemmy.nz 61 points 1 year ago

You shouldn't trust anything uploaded there by IGGGames. They've been caught before adding miners to their files. I downloaded the rune release somewhere else seeing as they were the uploader on 1337x. I only really use 1337x for fitgirl repacks.

[-] Haveanicedayman@lemmy.ml 18 points 1 year ago

Why not from fitgirl page directly?

[-] eagleeyedtiger@lemmy.nz 10 points 1 year ago

I mean I do grab the torrent link from the fitgirl site, but I find the torrent faster to download than the direct download links.

[-] Hextic@lemmy.world 52 points 1 year ago

LOL idiots BG3 is DRM Free just get the GOG installer, surely people mirror that shit, I've seent it before.

load more comments (1 replies)

[-] Madiator2011@lm.madiator.cloud 34 points 1 year ago

Dont be mad at me but I bought the game from GOG :)

[-] hypna@lemmy.world 40 points 1 year ago* (last edited 1 year ago)

I mean, it's an mtx-free, drm-free, full feature game. If BG3 isn't worth paying for, I don't know what is.

[-] TheMadnessKing@lemmy.world 7 points 1 year ago

Yes. If such developers are not awarded then they will also switch to the dark side.

[-] Flatworm7591@lemmy.dbzer0.com 25 points 1 year ago

I reported it on 1337x earlier today, but they aren't very responsive. Fitgirl has it listed as an upcoming repack, so hopefully not long to wait for a clean copy.

[-] moosetwin@lemmy.world 21 points 1 year ago

I opened this post all scared that I might've accidentally downloaded malware and my fuckin' AV alerted

yeah yeah I know piracy and AVs don't generally mix

load more comments (2 replies)

[-] DrManhattan@lemmy.design 9 points 1 year ago

Has anyone seen anything on the DODI release or is it clean?

[-] harmonea@kbin.social 13 points 1 year ago* (last edited 1 year ago)

The DODI repack is based on the RUNE release which I believe is clean. Another commenter claims a found Trojan but there are others who found nothing, and imo it's probably just the usual crack shenanigans.

Edit: See replies! It seems there are tainted versions of the repack out there, but there are clean ones too. Remember to keep a critical eye on your sites and uploaders in addition to your release groups. There's a useful link in a reply to me below showing what you might see if you've downloaded a bad one.

[-] shottymcb@lemm.ee 8 points 1 year ago

There's no need for a crack on this game, it's available on GOG which is always DRM free.

load more comments (5 replies)

[-] Makeshift@lemmy.dbzer0.com 6 points 1 year ago

There are claims from comments on torrent galaxy that dodis release has the same bitcoin miner:

https://www.reddit.com/r/Piracy/comments/15ivtzk/dodi_verified_release_on_tg_has_crypto_miner/

I hope someone can get to the bottom of this

load more comments (3 replies)

[-] UntouchedWagons@lemmy.ca 6 points 1 year ago

I downloaded the RUNE release from TorrentLeech and Windows Defender found a trojan so yeah I'll believe it. I guess I'll wait for a FitGirls repack.

[-] KitsuneHaiku@ttrpg.network 6 points 1 year ago

I've had false positives from cracks on TL before, several times. I respect your carefulness with a known problem with another release, though.

[-] Elegast@lemmy.ca 6 points 1 year ago

Torrent galaxy rune release. However not seeing any issues? Malwarebytes scans coming up clean. No integritycheck folder in app data. No hidden process running when game running. 🤷‍♂️?

load more comments (7 replies)

[-] altima_neo@lemmy.zip 6 points 1 year ago

isnt malwarebytes kinda crap these days?

[-] godless@lemmy.world 17 points 1 year ago

Nah they do a good job. They are having intrusive popups asking you to subscribe to their paid tier for scheduled searches and real time protection, but if you know what you want/need, the free version is alright.

load more comments (9 replies)

load more comments