Theme editor

  • RequestStream Movies, TV shows and anime streaming • 1 week trial

Virus in AVN games

I got one for Miho adventures and back alley taboo, from the other site
 
You must be registered to see media
 
You must be registered to see media
Worth noting, mediafire is horrible for downloading garbage like this. Sometimes its in a pop up but I've had one show up with the game zip. Another link that sometime give trouble is anonfiles.
 
Running Vn's in a sandbox (such as sandboxie) without internet is the safest way if you are concerned.
Safe link for Sandboxie? Too many links to tell the safe one from the scams.
 
Here you have >>>
This is from github btw
Thanks. I'm not super familiar with how Github works. Is (Sandboxie-Classicx64v5.71.2.exe) the only file we need?
I hoped that would link to a dl page but it is a direct instant dl. My bad.
 
Thanks. I'm not super familiar with how Github works. Is (Sandboxie-Classicx64v5.71.2.exe) the only file we need?
I hoped that would link to a dl page but it is a direct instant dl. My bad.
That depends of which version you want/need but yeah its one file cause its installation exe. It will either install in directory you want or it can make portable version which you can have on a go like usb drive etc. I have sandboxie plus installed on my pc.
 
That depends of which version you want/need but yeah its one file cause its installation exe. It will either install in directory you want or it can make portable version which you can have on a go like usb drive etc. I have sandboxie plus installed on my pc.
Which links are which?
Is Plus a paid version?
 
Which links are which?
Is Plus a paid version?
No it isn t paid although they have like premium patreon version or something.
On my link you have assets below on page click on download and install. That s it.
 
McAfee huh, well you got nothing to worry about than #sarcasm
Quick question : do I have to worry when running Bitdefender (AV + Firewall (payed)) and proton VPN? (i know noob question but there are more noobs then specialists :p)
 
Quick question : do I have to worry when running Bitdefender (AV + Firewall (payed)) and proton VPN? (i know noob question but there are more noobs then specialists :p)
No you shouldn t but its always better to use sandboxie if you re not sure
 
Just so people dont panic too much, im sure that all games that are uploaded are scanned (i will do the same when i upload) but just be careful cuz sometimes things can slip by, just double check any flags, some can be faulse positives but if you get one of those be sure to check yourself especially bigger downloads. last thing you need is something like the Great Discover Virus, that one sucks to get rid of. basically if your unsure about a file dont be scared to ask someone
and i'm sure that scanning this type of games especially on Renpy or RPGM will not find a "virus". you should better learn about this trojan also known as Lumma Stealer which is distributed through such games before jumping to conclusions and recommending useless methods. as was written earlier the trojan is not in the game files themselves so your scanning will not lead to anything and will only give a false sense of security.
 
No you shouldn t but its always better to use sandboxie if you re not sure
I suppose I am not the only one who doesn't know something like 'sandboxie' ... I will take a look at it, but maybe someone could make a small manual with some trustworthy links to get it? (just asking)
 
Quick question : do I have to worry when running Bitdefender (AV + Firewall (payed)) and proton VPN? (i know noob question but there are more noobs then specialists :p)
to be completely honest, i do not use any AV / AM detection programs
the last time i had a virus was 9 or 11 years ago.
(which, while i was out. changed the names of every file on my computer to something random with no file extension & encrypted everything)

if i have suspicions they have one time online scanners.

if you are going to put false trust in a company that's mining your data you need to check what type of trust you value.
i value my own trust, its served me well, i wont lie to me, i won't steal my stuff, i wont use up 50% of my resources when I'm busy killing cows LOL
Mooooooooo


You must be registered to see attachments
 

Attachments

You must be registered for see attachments list
I recently found I had downloaded (but not executed) the an infected version of Halfway House from F.95. In turn that also meant I had a sample I could investigate. For this game, the clean zip has a SHA1 of 6dab0b494a06cad97a9d3e5ab602e11bda5be953.

For HH specifically, I found that EP11BonusScene.exe and lib/py3-windows-x86_64/pythonw.exe were both modified compared to the clean version. Many cache files were also changed, however I think that is likely just a result of the python modifications and not a part of the malware itself.

Notably, EP11BonusScene.exe has a different modification time than the .py and .sh files, which I think makes for a rather simple suspicious check.

You must be registered to see attachments


Note: Since the malware that was used for this game only seems to affect Windows (both the fact only the Windows files changed, and corroborated by the F.95 thread), other malware strains (which presumably affect every OS) may not modify the exes at all, so checking the modification times is NOT foolproof.


My suggestion is to run games in sandboxes, like @BeowulfKnight suggested. I doubt there is any 100% reliable detection method, and even if there were one the malware author(s) could then tweak their strains to no longer be detected. Switching to Mac or Linux is not 100% foolproof as malware can still be written for them too. It is only because Mac and Linux are minorities that malware for them is rare.


Since posting, I have decompiled the two modified exes and found no changes to the code. The changes only appear to have been adding the game's icon to them (the legitimate Halfway House does not use custom icons for the files). Maybe I am just doing everything wrong, but bindiff ( ) shown zero changes.

It is possible that malware is hiding in some cache file. This, however, is more difficult to investigate as almost every cache file (pyc, rpyc, rpymc, ...) has been regenerated when the infected version was built and I am not aware of any tools to inspect these files.

Further investigation would likely require I create a custom tool, and while doing so is within my capabilities, I do not currently plan to invest the time into that.

If you have a zip not matching the clean hash above, DO NOT assume the game is safe just because I could not find malware. Redownload a clean file and consider sandboxing applications as others have described.
 

Attachments

You must be registered for see attachments list
Last edited:
I suppose I am not the only one who doesn't know something like 'sandboxie' ... I will take a look at it, but maybe someone could make a small manual with some trustworthy links to get it? (just asking)

I always go to the actual website to download




When the sandboxie is working you will get a yellow box around browser or whatever is ran in it.

You must be registered to see attachments



When done with sandboxie make sure the contents inside of it are deleted.

You must be registered to see attachments



How I use Sandboxie on games.

Game NoMoreMoney downloaded on Lewdcorner

Step 1

Sandboxie the entire folder that the game is in.
Highlight the whole folder, left click menu pops up, may have to click
show more options, find "Run Sandboxed" and left click





That entire folder will now popup in the yellow sandboxed browser.


Now simply click the game, here it's NoMoreMoney.exe

However if you save the game when sandboxed and close the game and delete the contents of
the sandbox and try to play later, no saved game. So here is a work around.
After you have clicked on your game screen saving progress in the game, while game is still running, Go to the
save folder in the sandboxed browser, highlight the SAVE folder and click copy




Now go on your desktop or somewhere not sandboxed and press CTRL + V [and it will paste the save folder
outside of the sandboxie] And now go into the save folder you made/pasted


Open it up and Press CTRL + a to highlight it all


Then press CTRL + c to copy

Then go into the folder with the original SAVE folder and paste your saves inside
the game folder, and play game again Sandboxed and you will be playing from
your previous sandboxed saved files. Rinse, cycle, repeat.
 

Attachments

You must be registered for see attachments list
I always go to the actual website to download




When the sandboxie is working you will get a yellow box around browser or whatever is ran in it.

You must be registered to see attachments



When done with sandboxie make sure the contents inside of it are deleted.

You must be registered to see attachments



How I use Sandboxie on games.

Game NoMoreMoney downloaded on Lewdcorner

Step 1

Sandboxie the entire folder that the game is in.
Highlight the whole folder, left click menu pops up, may have to click
show more options, find "Run Sandboxed" and left click





That entire folder will now popup in the yellow sandboxed browser.


Now simply click the game, here it's NoMoreMoney.exe

However if you save the game when sandboxed and close the game and delete the contents of
the sandbox and try to play later, no saved game. So here is a work around.
After you have clicked on your game screen saving progress in the game, while game is still running, Go to the
save folder in the sandboxed browser, highlight the SAVE folder and click copy




Now go on your desktop or somewhere not sandboxed and press CTRL + V [and it will paste the save folder
outside of the sandboxie] And now go into the save folder you made/pasted


Open it up and Press CTRL + a to highlight it all


Then press CTRL + c to copy

Then go into the folder with the original SAVE folder and paste your saves inside
the game folder, and play game again Sandboxed and you will be playing from
your previous sandboxed saved files. Rinse, cycle, repeat.
Hey nice!
Thanks for that info for sure :)
Mind if I make a link to it in the OP?
 
a year from now you'll need to take a $39.99 course to play games safely
this will be the new multi-billion dollar industry, evil devs will be infectint their own games & selling you courses just to maximize profits.

I recently found I had downloaded (but not executed) the an infected version of Halfway House from F.95. In turn that also meant I had a sample I could investigate. For this game, the clean zip has a SHA1 of 6dab0b494a06cad97a9d3e5ab602e11bda5be953.

For HH specifically, I found that EP11BonusScene.exe and lib/py3-windows-x86_64/pythonw.exe were both modified compared to the clean version. Many cache files were also changed, however I think that is likely just a result of the python modifications and not a part of the malware itself.

Notably, EP11BonusScene.exe has a different modification time than the .py and .sh files, which I think makes for a rather simple suspicious check.

You must be registered to see attachments


Note: Since the malware that was used for this game only seems to affect Windows (both the fact only the Windows files changed, and corroborated by the F.95 thread), other malware strains (which presumably affect every OS) may not modify the exes at all, so checking the modification times is NOT foolproof.


My suggestion is to run games in sandboxes, like @BeowulfKnight suggested. I doubt there is any 100% reliable detection method, and even if there were one the malware author(s) could then tweak their strains to no longer be detected. Switching to Mac or Linux is not 100% foolproof as malware can still be written for them too. It is only because Mac and Linux are minorities that malware for them is rare.
off-topic glad to see someone else has a "celebrity crush" on Faye too :)
she's in my spoiler
 
Last edited:
Back
Top Bottom