Bannerlord Co-op mod trojan horse.

[das_ubersoldat]

I was trying to download the current Coop mod for Bannerlord, but my antivirus stopped the download. Apparantly it was a "CRdownload file-extension" type file, and according to google a pretty nasty trojan horse:

"CRdownload is a Trojan horse virus, which belongs to the Rovnix variants. This virus is so harmful that if it is once loaded in the system, it can bypass the security scan and come along with other viruses without taking user's permission. This virus generally attacks the systems that have 64-bit Windows"

Dont know if it was just my download or not, but i urge for caution. I´m just trying to spread awareness.

Has anyone else got this?

[FraЗ0ahg2r]

1) most importantly: have you removed the trojan with your anti virus?
2) are you sure you downloaded the mod from the correct site?
3) if it is the correct site try to download it again

[Khamal]

Anti virus your using? website you got it from? generally speaking, it is always better safer than sorry
Scanning the download links/servers 0/70(70 means 70 different anti virus brands) detected
Scanning the download exe file, 1/70 detected as Trojan.Win32.Save.a (file was changed on 3/18)
Company signed file? yes (From moddb)

Im assuming because the file is new and given the type of download installer it is, the anti virus is not sure what the function of said program is, so it marks it as generic virus, because it is not sure, otherwise someone could of hacked the download server

TLDR: Better not to in my opinion, always safer ! and only 5000 or so have downloaded,wait until later or see if their discord will send you the full uncompressed file

[das_ubersoldat]

Originally posted by Fra30ahg2r:

1) most importantly: have you removed the trojan with your anti virus?
2) are you sure you downloaded the mod from the correct site?
3) if it is the correct site try to download it again

1) It supposedly blocked it from being downloaded, it went to 100% and then, immediate stop.
2) I downloaded it from Moddb, i´ve downloaded plenty of Mods from there but this is the first time my antivirus went haywire.
3) Considering the risks, i´d rather not. Playing coop in Mount & Blade is a dream for many, but i aint gonna risk my computer just to play it.

[Morkonan]

Originally posted by das_ubersoldat:

...
3) Considering the risks, i´d rather not. Playing coop in Mount & Blade is a dream for many, but i aint gonna risk my computer just to play it.

^-- This.

The idea of "Bannerlord Co-Op" is a hot-topic right now. There are millions of gamers that have purchased Bannerlord. The current build of the game does not directly support modding, so "work-arounds" have to be used and those who mod the game are very used to overriding their own computer's and anti-virus's security features just to get mods to work. (.dll/harmony)

ALL of that comes together to present a very ripe, if limited, opportunity for a targeted attack. I've seen that happen for at least one other game on Steam that players often mod, but that Steam does not have a workshop for. Why were they selected? Because it's a popularly modded game that doesn't have official mod or mod-hosting/Workshop support, that's why. Gamers who do not protect themselves against such vectors are the ones that are targeted for attack. Bannerlord players routinely override security features to get mods to work... :/

For any really popular game that is often modded by players there are approximately fifty-eleven bogus "mod host" websites filled with malware that hope to catch young, enthusiastic, gamers. That's why seasoned gamers generally restrict themselves to only certain well-known and vetted hosts for their game's mods. Any search on the internet for a popular game that focuses on "mods" will turn up a huge number of scam/malware/bogus websites. Because many gamers routinely override security features to get a tantilizing, exciting, looking mod to "work"... :/

Considering the volume of mods that moddb hosts and the length of time moddb has been doing exactly that, if moddb screams a warning then it's very much worth heeding no matter what chance of a "false positive" there could be due to the necessity of certain file types.

I can't say the mod in question is malware. That's not my call and I have no personal evidence it is. BUT, if moddb is giving a warning, I'd stay far away from it until such a time as a third-party verifies the mod and the reviewed version of it is "safe." (Personally, I wouldn't ever use such a mod or anything like it until and unless TW offers that kind of modding support that is also "secure.")

[8mob8]

avast said it was fine, js

[Otterking]

Its a false positive

[Zennith]

Why dedicate yourself to something as large and demanding as creating Bannerlord Online, just to hurt the people that would enjoy your creation. Hijacking is a thing, but I haven't had any issues with my computer since I've been playing Bannerlord Online for about 20 hours now.

Not to mention the money they're making from the Patreon, of which I am pledged to.

[Ulfkarl]

I downloaded the file and nothing detected, I scanned the .exe with malwarebytes and avast, but when I tried to install the mod windows didnt let me because it didn't have permission or something like that, so I deleted the file, I won't risk too, I will wait to see what happens

[Vega]

Where exactly are you downloading it from? The only source so far is Moddb and it's extremely trustworthy. The download went through, I created an account and everything. I needed to run the installer as admin but that's about it. My version is outdated but that's an easy fix.

Trash whatever antivirus you have, it's garbage.

P.S. Thanks for making this topic, this mod is why I bought this game.

[das_ubersoldat]

Originally posted by Vlood:

Its a false positive

Kinda selective sort of positive then, considering the amount of mods i´ve downloaded from that site. Also, seeing it as a CRdownload file kinda hightens my suspicion.

[das_ubersoldat]

Originally posted by Vega:

Trash whatever antivirus you have, it's garbage

Just good old Avast and Malwarebytes.

[[RL] Pettersson]

I have had my eyes on this mod for awhile, due to it being a coop/MMO mod for Bannerlord. But then there is all this talk about Trojans and malicious files. Guess i have to wait until someone verifies it...

[Vega]

Avast isn't a reliable anti-virus, and Malwarebytes.. eh. It's decent.

Not to be mean, but did you fully research what CRDownload was? There is another search that points to it being something entirely different. A CRDownload extension is a partially downloaded file within Google Chrome.

Your antivirus blocked it due to false positives, and the way unfinished downloads work is that they appear as a .CRDownload until they're finished, then they change to what they should be. This one never did - as it was blocked. That's why the file is what it is.

Try allowing access or remove avast. I don't see how such a successful and promising mod.. with video reviews and hundreds of downloads can result in a virus. This is like the internet/game version of using WebMD to come to the conclusion you're dying after you've sneezed twice.

As for "verifying it". I either didn't install it right or it's been quickly outdated by the ever-so-changing early access patches. It needs to be updated. Regardless, it's no virus - I can assure you of that.

[das_ubersoldat]

Originally posted by Vega:

I don't see how such a successful and promising mod.. with video reviews and hundreds of downloads can result in a virus

Every rose has its thorn. Only because its positive does not give me any reason to let my guard down. It is the internet after all.

[Friendly]

It might be a false positive but if in doubt just don't go ahead. If you're talking about bannerlord online it looks pretty basic atm anyway won't have much to do.