FIVEM packed with malware/Trojans.

[Navi ︻デ 一]

Beware, I downloaded Fivem 2 days ago. Noticed my PC being really slow, even with nothing opened.

My background processes show 10+ edge tasks, and have caught fivem or it’s add on sniffing packets and scanning every file in your pc.


I am making a video before you decide to blindly defend fivem, and it’s devs rockstar needs to end this community as it’s a security risk, and they are using rockstars game.


Before you argue with me think of how much exp you have in cyber security in the real world, vs how many times you saw on Reddit it’s safe to download.

Edit: possible evidence of keylogger through third party AC software to.

[Reinhard]

Lmao, what's this cringefest of a thread

[Navi ︻デ 一]

Oprindeligt skrevet af Reinhard:

Lmao, what's this cringefest of a thread

What’s more cringe is people who have never wrote an executable file talking about AV false positives, and how there simply his no hidden stuff. NPC’s on Reddit comment it’s safe so it sure has to be…

Sure explains why every tech thread now if full of monke “I have good pc but bad frames tell me why.” People talking about drivers when their ♥♥♥♥♥ packed with malware, Trojans, A-Z deleter, and a partition destroyer. Hell probably a RAT Backdoor to but their Wendy’s drive though checks aren’t worth stealing. ♥♥♥♥♥ gone before it’s cashed. So without them being a victim they will never hear you out. ♥♥♥♥ they probably don’t even have files worth trolling or deleting. Probably can’t even make a folder.

I guarantee the people saying this ♥♥♥♥ is safe doesn’t have a single icon space left on their home screen.

Once you have apps, windows defender is about the equivalent of throwing a dart through an inflated balloon.

If I recall defender is complex, but in leman terms on scans files for Unicode looking for abnormal file behavior. The whole point of unicode to hide the code from PC’s unless executed. Basically the Mexico border wall.

[Navi ︻デ 一]

Oprindeligt skrevet af Reinhard:

Lmao, what's this cringefest of a thread

LOL it gets better, every comment on Reddit is like disable AV, Run it as admin, only thing missing now is giving it private network control.


I have a server in my house so I take these things a bit more seriously.

[Kensingt0n]

so where debugging evidence? programmer man?

[Navi ︻デ 一]

Oprindeligt skrevet af Frost Bite:

so where debugging evidence? programmer man?

Well that’s where I’m trying to find what’s eating resources. At idle the cpu/memory goes up to 99%. When you check processes it goes back down to regular 1% idle.

I’m currently waiting on a usb stick in the mail to save it before I do a full wipe/fix and install. So that way I can safely load it into VM and waste my time investigating more.

Edge crashing, recovery partition destroyed,http requests lead me to believe it’s dated ransomware.


Most of my virus knowledge comes from some ordinary gamers, yeah I can code but making malicious content isn’t something I do in my free time.

What I’m doing is essentially pen testing but reverse engineering. Not something I typically specialize in.


I really think the server owner, got kids from shady sources or something.

I’m a machine learner, not a typical programming dork.

[Navi ︻デ 一]

Oprindeligt skrevet af Frost Bite:

so where debugging evidence? programmer man?

Either way I mentioned in a comment earlier, I want to make a video once I have my gaming pc under control, and launch the copied OS in VM with limited resources.

I would need someone more god tier to sniff these processes, and understand what processes are being back doored.


Once I can confirm my thoughts I’m willing to make copies and send it off to someone smarter.

[Navi ︻デ 一]

Oprindeligt skrevet af Frost Bite:

so where debugging evidence? programmer man?

So since you want to come at me like a smartass I’ll ask you, what known virus (sends Http, can survive a full windows wipe from system, and can rewrite Itself, while destroying your recovery partition once windows is back up, while causing edge crashes and max cpu memory utilization ) <~~~~~~~ this is where I’m currently at.


So please Mr. Debugger please guide me, or sit in the back while real men work.


Oh so google tells me it’s a worm, which typically ransomware is.

So like monke I am I research worm, way to big for my monke understanding.


On top of this I literally watched the discord members who were active, start dropping in numbers when I was bringing this up in their general chat. So it makes me weary that people may have gotten viruses before and suspect is was from fivem.


I’ll cut you even a deal if you can guide me to what you think is being back doored I’ll give you my csgo AK on this account. I ain’t a bser.

[Strawberry {JESUS IS LORD}]

what is 5m is it like 3m scotch tape or something

[SqueakyTweaky]

Oprindeligt skrevet af Money Grow Slow:

Oprindeligt skrevet af Frost Bite:

so where debugging evidence? programmer man?

Well that’s where I’m trying to find what’s eating resources. At idle the cpu/memory goes up to 99%. When you check processes it goes back down to regular 1% idle.

I’m currently waiting on a usb stick in the mail to save it before I do a full wipe/fix and install. So that way I can safely load it into VM and waste my time investigating more.

Edge crashing, recovery partition destroyed,http requests lead me to believe it’s dated ransomware.


Most of my virus knowledge comes from some ordinary gamers, yeah I can code but making malicious content isn’t something I do in my free time.

What I’m doing is essentially pen testing but reverse engineering. Not something I typically specialize in.


I really think the server owner, got kids from shady sources or something.

I’m a machine learner, not a typical programming dork.

You do know VM is resource intensive? It will load your CPU & RAM usage more than using regular Windows to play , my cpu is hovering around 50-75% & GPU is @ 80% tabbing back to desktop lowers it a bit beacause it doest have to display the game anymore.

I installed 5M yesterday myself to just try some random servers and I haven't encountered anything like you have listed in this thread so far, only thing that I did notice is five M validating your licence so you don't use a pirated version of the game, other than that not a single torjan/malware notice with bitdefender.

I really hope you can provide evidence for your finding and claims beacause if you don't then in will be pointless as people claiming they are being banned for no reason in this game for years.

[Navi ︻デ 一]

Oprindeligt skrevet af SqueakyTweaky:

Oprindeligt skrevet af Money Grow Slow:

Well that’s where I’m trying to find what’s eating resources. At idle the cpu/memory goes up to 99%. When you check processes it goes back down to regular 1% idle.

I’m currently waiting on a usb stick in the mail to save it before I do a full wipe/fix and install. So that way I can safely load it into VM and waste my time investigating more.

Edge crashing, recovery partition destroyed,http requests lead me to believe it’s dated ransomware.


Most of my virus knowledge comes from some ordinary gamers, yeah I can code but making malicious content isn’t something I do in my free time.

What I’m doing is essentially pen testing but reverse engineering. Not something I typically specialize in.


I really think the server owner, got kids from shady sources or something.

I’m a machine learner, not a typical programming dork.

You do know VM is resource intensive? It will load your CPU & RAM usage more than using regular Windows to play , my cpu is hovering around 50-75% & GPU is @ 80% tabbing back to desktop lowers it a bit beacause it doest have to display the game anymore.

I installed 5M yesterday myself to just try some random servers and I haven't encountered anything like you have listed in this thread so far, only thing that I did notice is five M validating your licence so you don't use a pirated version of the game, other than that not a single torjan/malware notice with bitdefender.

I really hope you can provide evidence for your finding and claims beacause if you don't then in will be pointless as people claiming they are being banned for no reason in this game for years.

I have now been in touch with server developers. I have confirmed mods from shady sources can be executed.

It still doesn’t resolve fivem

I’m very concerned now it could be a dormant worm hiding in the physical optimization partitions in the memory itself.

Hard wiping and local reinstall will usually clear most basic viruses, I did that and within 15 minutes it rewrote itself but the problems are now worse.

I’m almost down to take it to a local pc shop to see if they have any expertise in memory.

I’m a self taught dev for the most part, I’ve skipped memory reading of machines entirely.


So from my investigative stand point, whoever developed these viruses has a very niche skill set. I really doubt they are even devs, but maybe a group of malicious nerds.

The skill set to back door requires way too much free time, or they are employed as pen testers while doing illegal stuff.

Being that the ransomware is now broken. I suspect it’s a copy and paste of blue origin, but written by dorks who don’t fully understand worms/backdooring like myself. I suspect teenagers.

No way an educated adult, or single hacker man would deploy such a useless none working virus, in an environment even seasoned developers let their guard down.


This is the sole reason my gaming/dev pc is not used at all for anything financial. Most educated devs are 2 steps ahead of the hacker nerds.

They could have access to my emails, there’s nothing important lost.

[Navi ︻デ 一]

Oprindeligt skrevet af SqueakyTweaky:

Oprindeligt skrevet af Money Grow Slow:

Well that’s where I’m trying to find what’s eating resources. At idle the cpu/memory goes up to 99%. When you check processes it goes back down to regular 1% idle.

I’m currently waiting on a usb stick in the mail to save it before I do a full wipe/fix and install. So that way I can safely load it into VM and waste my time investigating more.

Edge crashing, recovery partition destroyed,http requests lead me to believe it’s dated ransomware.


Most of my virus knowledge comes from some ordinary gamers, yeah I can code but making malicious content isn’t something I do in my free time.

What I’m doing is essentially pen testing but reverse engineering. Not something I typically specialize in.


I really think the server owner, got kids from shady sources or something.

I’m a machine learner, not a typical programming dork.

You do know VM is resource intensive? It will load your CPU & RAM usage more than using regular Windows to play , my cpu is hovering around 50-75% & GPU is @ 80% tabbing back to desktop lowers it a bit beacause it doest have to display the game anymore.

I installed 5M yesterday myself to just try some random servers and I haven't encountered anything like you have listed in this thread so far, only thing that I did notice is five M validating your licence so you don't use a pirated version of the game, other than that not a single torjan/malware notice with bitdefender.

I really hope you can provide evidence for your finding and claims beacause if you don't then in will be pointless as people claiming they are being banned for no reason in this game for years.

Also I want to include you most definitely can limit resource usage in vm, most people skip past the reqs section of setting up vm.

I do not have the best gaming pc, it’s just super OC’d for 1080. I have to limit my resources before I start my day if I want to game and work.

VSC with plug ins is a ram and memory destroyer lol. I run VSC in VM so I’m not getting run away AI code. You can kill the VSC task but plug ins still run away. VM’s prevent you from doing 5 restarts a day.

You need to mess with your bios also, in the cpu section. AMD Gigabyte is quite easy. If you’re on Intel, and different board you’re gonna have to research.

[DiaCrusher]

I honestly have a strong suspicion you downloaded it from some random site already packed with something. That said, the edge tasks in background might be edge webview2 runtime which is used by some launchers.

[Navi ︻デ 一]

Oprindeligt skrevet af DiaCrusher:

I honestly have a strong suspicion you downloaded it from some random site already packed with something. That said, the edge tasks in background might be edge webview2 runtime which is used by some launchers.

Dude lol last thing I downloaded was fivem and some mods for servers. I don’t download random stuff online. I hardly get to game much anyways anymore atm.

[Strawberry {JESUS IS LORD}]

hmm i have fivem on lappy for messing around in rp servers my malwarebytes didnt detect any malware

[Navi ︻デ 一]

Oprindeligt skrevet af Strawberry {JESUS IS LORD}:

hmm i have fivem on lappy for messing around in rp servers my malwarebytes didnt detect any malware

Com surrogate was the process being back doored. I opted to update to WIN 11, and as of now 15 minutes after updating, I have an external power monitor software. I’m not seeing weird CPU or memory 99% pegs.

Currently making a win 11 iso and reinstalling win 11.


I read online if you try to local reinstall com surrogate malware, it will attack your boot recovery partitions.

So as of now I’m fairly lucky I didn’t Brick the pc. So it’s dated malware/ransomware.


It’s a malware once you try to destroy, activates a worm that essentially turns it to ransomware, but bricks your pc. There is no ransom. It’s quite literally a toxic virus.