So I had a headache today and got on my computer about five minutes ago to find that my antivirus had detected a virus. I figured it had to be related to a plug-in thing I had downloaded a few weeks ago (some semi-suspicious looking GameCube controller adapter thing)
(There was a virus in this download, which was detected and removed by my antivirus. I deleted the download afterward.), but was shocked when I saw where it was located.

C:\Program Files (x86)\Steam\steamapps\common\Team Fortress 2\bin\motionmapper.exe

The virus's name was 'TrojWare.Win32.Scar.LSA@348353990'

Did I get hacked while in TF2? Did someone somehow hack my Steam account and install the virus remotely? Has this happened to other people? Honestly it's pretty scary to me, but shout-out to Comodo Free Antivirus for being awesome.

(In happier, or sadder, news, I won Bad Rats)

8 years ago*

Comment has been collapsed.

Sounds like your account was infected twice!

8 years ago
Permalink

Comment has been collapsed.

View attached image.
8 years ago
Permalink

Comment has been collapsed.

did you delete it. if not delete it

8 years ago
Permalink

Comment has been collapsed.

Yes, I deleted it.

8 years ago
Permalink

Comment has been collapsed.

Viruses will install themselves in common locations to make them seem legitimate. You were probably not hacked or compromised through Steam or TF2.

8 years ago
Permalink

Comment has been collapsed.

So you downloaded a 'plug-in thing' that was some 'semi-suspicious looking GameCube controller adapter thing'. And now you have something that might be a virus. And you think that might be because you got hacked while in TF2 and somebody downloaded something remotely rather than because of the suspicious plug-in thing that you downloaded yourself?

Just because it is in a TF2 folder it doesn't mean it got there through TF2. And also you had a headache and did you think that was a symptom of the computer virus or was it just something you randomly wanted to share?

I'm not being sarcastic or anything, just a bit baffled...

8 years ago
Permalink

Comment has been collapsed.

There were no remaining traces of the 'semi-suspicious looking GameCube controller adapter thing' left on my computer. (There was a virus in it which was removed) Also, it was linked on PCGamer, which I thought was a reliable website.

8 years ago*
Permalink

Comment has been collapsed.

Reliable websites sometimes have links to malware. Even if reliable sites check all the links that are posted there, there is still nothing to stop people changing what is being actually linked to after the fact. Which is a surprisingly common problem.

And even if there are no traces of 'semi-suspicious looking GameCube controller adapter thing' left it still doesn't mean it didn't add extra stuff to your computer that is still there. Most likely hidden in a completely unrelated folder that you wouldn't suspect. Which is also a surprisingly common problem.

8 years ago
Permalink

Comment has been collapsed.

Both are true. I think the plug-in itself was legitimate but the virus was downloaded along with it. (The website PCGamer linked to didn't look like one that would be well protected from that)

8 years ago
Permalink

Comment has been collapsed.

That is not uncommon. People do sometimes re-upload legitimate software with added 'bonuses' and then spread links to the modified version.

I'm not saying that is what happened in this case - but either that or a false positive are far more likely than getting hacked while playing TF2.

8 years ago
Permalink

Comment has been collapsed.

TF Virus is a biological weapon created by the sinister Parasol corporation.
It turns the infected into mindless rabid beasts that go "haaaaats!"

8 years ago
Permalink

Comment has been collapsed.

Is it contagious?

8 years ago
Permalink

Comment has been collapsed.

Quite so. More people start craving hats every day when exposed to the TF2 Virus.

8 years ago
Permalink

Comment has been collapsed.

If I shoot the infected in the head, thus as destroying the "hats", will I be capable to render them harmless?

8 years ago
Permalink

Comment has been collapsed.

Yep, aim for the head, that's the only way to be sure.

8 years ago
Permalink

Comment has been collapsed.

you mean like a hatshot?!

8 years ago
Permalink

Comment has been collapsed.

And it already have a mutated version, called CS Virus, similar effect, just sound changed to "skins".

8 years ago
Permalink

Comment has been collapsed.

So, if I flay them, thus destroying the "Skins" they will stop?

8 years ago
Permalink

Comment has been collapsed.

Some, maybe. But most will just replace it with "stickers" :P

8 years ago
Permalink

Comment has been collapsed.

figured it had to be related to a plug-in thing I had downloaded a few weeks ago (some semi-suspicious looking GameCube controller adapter thing)

Seems like someone likes to click on random links and download stuff that they should not,i must assume that is how you got it.I doubt someone hacked you but i suppose it is possible.

Do not download random things,click on random links you will just end up with nasty shit.Use Malwarebytes to help catch that stuff.Funny thing is i have not used a anti-virus in years and have not got one yet.Surprising giving all the porn sites i visit.

8 years ago
Permalink

Comment has been collapsed.

Again, I NEVER install "random" things from links. It was a download on PCGamer, so I assumed it was safe.

8 years ago
Permalink

Comment has been collapsed.

Well why would you admit to downloading something that "suspicious" then get all defensive when someone says do not do it and deny you did it?

You got it some how and it was not from some random dude hacking you.it was from some link you clicked on,or someone you know and infected you with it.In the end it still leads down the same road.

If you have a friend who clicked on an infected link and then they got hijacked and you clicked on something from them that you thought was legit,bam you got it.

Bottom line is you got infected by clicking on something,it just does not magically appear,shit happens.You did not get hacked while playing TF2.Even if you got it from PC Gamer by chance you still clicked on a random link or downloaded something you thought might be "suspicious" again,do not click on random links or stuff your nut sure is safe.

Also it could just be a false reading.As what you downloaded might act or do the same thing as a trojan does.

8 years ago*
Permalink

Comment has been collapsed.

"Seems like someone likes to click on random links and download stuff that they should not,i must assume that is how you got it.I doubt someone hacked you but i suppose it is possible."

I'm denying that I never click on random links and download things. This was something I thought was real, and that I was looking specifically for. I now know that just seeing the website it was on should have been an immediate red light.

The software I downloaded downloaded a virus which was detected and deleted by my antivirus, so I assumed the virus it found today was a continuation of that.

8 years ago
Permalink

Comment has been collapsed.

Well it is good that you caught it,in short just be very careful even with trusted sites,as sometimes even they miss stuff,and sometimes people do hack them and spread viruses that way,i am not saying that is what happen there.

I usually only download stuff i feel is pretty safe but i know it is always a risk as you can never be 100% safe.I was not trying to come off as being a dick either just you said you thought might not be so safe,and when i point out that is what happens when you click on random links or download stuff your not sure is safe.Either way glad you fixed it.Luckily i never got any viruses but i have got other annoying shit,i try and avoid most things free anymore as they tend to at the least usually have bloatware hidden in it.

In the end it does not change the fact you did download something you should have not no matter what site it was or where it came from.

8 years ago
Permalink

Comment has been collapsed.

No, I admit I did sounded somewhat rude. I'm sorry.

And yes, I should not have downloaded that thing in the first place, I know. :-/
(I just hope this new thing isn't related to it, otherwise this could get pretty annoying.)

8 years ago
Permalink

Comment has been collapsed.

I hope that is not the case i know some things can root themselves pretty deep and sometimes it is better to just do a fresh install.

I will also say i would have not said looks like someone downloads and clicks on random stuff but at the time you did not mention it was from pc gamer so yeah from what you posted it did look like you did.

Even careful people sometimes make a mistake or download something from a trusted place and get something,it happened with PC Gamer and GTA V mods,it slipped through there checks a long with other trusted sites.

As i said you might be better off just starting from scratch,i keep all my steam games on its own HD just in case something happens,and the ones that can not be put on another drive i keep backups of.

8 years ago
Permalink

Comment has been collapsed.

I think for now I'm probably safe given that this has been confirmed as a false-positive. :-)

8 years ago
Permalink

Comment has been collapsed.

Deleted

This comment was deleted 5 years ago.

8 years ago
Permalink

Comment has been collapsed.

No problems with the PC whatsoever.

8 years ago
Permalink

Comment has been collapsed.

You do get false positives with Steam sometimes.

8 years ago
Permalink

Comment has been collapsed.

did it give you some nice hats?

sorry about bad rats, that's terrible news.

8 years ago
Permalink

Comment has been collapsed.

At least it wasn't notavirus!

8 years ago
Permalink

Comment has been collapsed.

Some people encountered the same problem. This thread was created 4 hours ago, at the same time you created your thread. It might be a false positive; motionmapper.exe was modified in the latest patch

8 years ago
Permalink

Comment has been collapsed.

Thanks! Good to know it wasn't just me.

8 years ago
Permalink

Comment has been collapsed.

Achievement unlocked: Virus Hat. Welcome to the TF2 economy.

8 years ago
Permalink

Comment has been collapsed.

Hmm, weird. Thanks.

8 years ago
Permalink

Comment has been collapsed.

I also have that file, motionmapper.exe, created 19th june 2014, modified and accessed 4th april 2015, size 244 KB, but Bitdefender doesn't detect it as a threat.
apparently its supposed to be there https://wiki.teamfortress.com/wiki/May_18,_2015_Patch

8 years ago
Permalink

Comment has been collapsed.

According to Willi (above), only my antivirus, Comodo, recognizes it as a false-positive, and checking their website, it has been fixed.

8 years ago
Permalink

Comment has been collapsed.

Sign in through Steam to add a comment.