- Staff
- #1
Posting this here as I see quite a few of you have this game.
For the third time this year, People playground's workshop was hit by a malware attack. If you have run People Playground between the 20th-23rd of September of this year, you should probably do a malware scan.
If you do not want your PC to be obliterated before you play this again, uninstall all the mods and verify the game files to make sure the patch that disables all workshop content is enabled.
The malware in question was primarily uploaded in the "FPS+++" series of mods but spread across several other mods. Copy pasted from the official reddit:
Detailed assessment: https://www.reddit.com/r/peopleplayground/comments/1wmn16s/fps_new_virus_full_breakdown/
Official announcement:
For the third time this year, People playground's workshop was hit by a malware attack. If you have run People Playground between the 20th-23rd of September of this year, you should probably do a malware scan.
If you do not want your PC to be obliterated before you play this again, uninstall all the mods and verify the game files to make sure the patch that disables all workshop content is enabled.
The malware in question was primarily uploaded in the "FPS+++" series of mods but spread across several other mods. Copy pasted from the official reddit:
It reuploads itself via your account, breaks into your steam account, breaks your steam data, steals password and browser data, and attempts to force a steam community ban on your account by spamming your friends and groups with racist abuse and spoofs error messages that look official, and attempts to force a blue screen of death when you close the game.
- Sets game process priority to high
- Attempts to trigger BSOD on game close
- Deactivates all loaded mods
- Upvotes and favourites the infected mod that triggered all this
- Infects all your mods
- This causes the virus to spread across the workshop, making people more susceptible to subscribing to a mod with the virus and getting impacted by it
- Destroys all PPG stats
- Disables Steam Cloud
- Removes all contraptions
- Removes all steam stats (achievements, etc.)
- Removes all game stats (human kills, etc.)
- Deletes maps folder
- Deletes jukebox folder (containing custom sounds for jukebox)
- Disables "Reject Shady Code" setting
- Resets keybinds
- Resets settings
- Removes logs
- Removes compiled mods
- Removes `resetConfig.bat`
- Removes mods
- Something to do with stats UI? (unsure on this)
- Something to do with `NonSteamStatManager` (unsure on this)
- Destorys all contraptions
- Publishes your data
- Kills Discord process (closes Discord)
- Gets your:
- IP
- UserName
- MachineName
- DeviceModel (motherboard)
- ProcessorType (cpu)
- SystemMemorySize (ram)
- GraphicsDeviceName (gpu)
- GraphicsMemorySize (vram)
- MAC address
- Deletes Discord cache directories
- Includes your Discord data in the data being published
- Includes your Steam config folder
- Removes all of your cookies, only for:
- Chrome
- Edge
- Firefox
- Deletes your pictures and videos
- "Destroys" your Steam apps (games/tools - anything in your Steam library essentially)
- Targets the following games:
- TF2, Dota 2, CS2, GMod, Terraria, Rust, Cities: SKylines, BeamNG.drive, RimWorld, R6 Siege, Hearts of Iron IV, PUBG, S&Box, Cities: Skylines 2, People Playground, Teardown, tModLoader, Arc Raiders, Escape from Tarkov
- Shuts down Steam
- Discovers all of your games
- For each discovered game
- Resets all achievements/stats
- Affects Steam inventory, Steam cloud, matchmaking, and UGC (workshop)
- Deletes the game
- Deletes folders that may match the game in `%LOCALAPPDATA%` and similar folders
- Starts People Playground
- "Destroys" your Steam friends
- Sends a random phrase out of four phrases, all of which contain the N slur
- 50% chance for it to be uppercase
- 50% chance for it to be partially censored (e.g. "1" instead of "i" in the N slur)
- 1 in 5 chance for the first letter to be uppercase
- After 536-1274ms (randomly chosen) of receiving a mesasge from a friend:
- Sends "THIS IS ME," and any of the following phrases:
- "FUCK YOU"
- "I HATE YOU"
- "STFU"
- Sends the N slur x amount of times to all of your Steam clans (groups)
- Repeated a random amount of times, between 1 and 5
- Removes all of your UGC (Steam Workshop) content
- Does not apply to People Playground, though
- Deletes Steam data
- Rewrites all Steam `userdata` directory cache files with random data
- Deletes entire `userdata` directory
- Deletes entire `config` directory
- Attempts to trigger BSOD
- Shows error message on your screen
- Message is randomly chosen:
- 40%: Suspicious activity was noticed. The activity has been rejected, and some functions may be temporarily unavailable. Be patient.
- With title: PPG Mod Compiler Protection Service
- 40%: Suspicious activity was noticed. The activity has been rejected, and some functions may be temporarily unavailable. Be patient.
- With title: PPG Mod Compiler Protection
- 10%: It looks like a mod has deleted some of your data. What?
- With title: PPG Mod Compiler Protection Service
- 10%: It looks like a mod has deleted some of your data. What?
- With title: PPG Mod Compiler Protection
- Attempts to trigger BSOD on game close
- Deactivates all loaded mods
- Upvotes and favourites the infected mod that triggered all this
- Infects all your mods
- This causes the virus to spread across the workshop, making people more susceptible to subscribing to a mod with the virus and getting impacted by it
- Destroys all PPG stats
- Disables Steam Cloud
- Removes all contraptions
- Removes all steam stats (achievements, etc.)
- Removes all game stats (human kills, etc.)
- Deletes maps folder
- Deletes jukebox folder (containing custom sounds for jukebox)
- Disables "Reject Shady Code" setting
- Resets keybinds
- Resets settings
- Removes logs
- Removes compiled mods
- Removes `resetConfig.bat`
- Removes mods
- Something to do with stats UI? (unsure on this)
- Something to do with `NonSteamStatManager` (unsure on this)
- Destorys all contraptions
- Publishes your data
- Kills Discord process (closes Discord)
- Gets your:
- IP
- UserName
- MachineName
- DeviceModel (motherboard)
- ProcessorType (cpu)
- SystemMemorySize (ram)
- GraphicsDeviceName (gpu)
- GraphicsMemorySize (vram)
- MAC address
- Deletes Discord cache directories
- Includes your Discord data in the data being published
- Includes your Steam config folder
- Removes all of your cookies, only for:
- Chrome
- Edge
- Firefox
- Deletes your pictures and videos
- "Destroys" your Steam apps (games/tools - anything in your Steam library essentially)
- Targets the following games:
- TF2, Dota 2, CS2, GMod, Terraria, Rust, Cities: SKylines, BeamNG.drive, RimWorld, R6 Siege, Hearts of Iron IV, PUBG, S&Box, Cities: Skylines 2, People Playground, Teardown, tModLoader, Arc Raiders, Escape from Tarkov
- Shuts down Steam
- Discovers all of your games
- For each discovered game
- Resets all achievements/stats
- Affects Steam inventory, Steam cloud, matchmaking, and UGC (workshop)
- Deletes the game
- Deletes folders that may match the game in `%LOCALAPPDATA%` and similar folders
- Starts People Playground
- "Destroys" your Steam friends
- Sends a random phrase out of four phrases, all of which contain the N slur
- 50% chance for it to be uppercase
- 50% chance for it to be partially censored (e.g. "1" instead of "i" in the N slur)
- 1 in 5 chance for the first letter to be uppercase
- After 536-1274ms (randomly chosen) of receiving a mesasge from a friend:
- Sends "THIS IS ME," and any of the following phrases:
- "FUCK YOU"
- "I HATE YOU"
- "STFU"
- Sends the N slur x amount of times to all of your Steam clans (groups)
- Repeated a random amount of times, between 1 and 5
- Removes all of your UGC (Steam Workshop) content
- Does not apply to People Playground, though
- Deletes Steam data
- Rewrites all Steam `userdata` directory cache files with random data
- Deletes entire `userdata` directory
- Deletes entire `config` directory
- Attempts to trigger BSOD
- Shows error message on your screen
- Message is randomly chosen:
- 40%: Suspicious activity was noticed. The activity has been rejected, and some functions may be temporarily unavailable. Be patient.
- With title: PPG Mod Compiler Protection Service
- 40%: Suspicious activity was noticed. The activity has been rejected, and some functions may be temporarily unavailable. Be patient.
- With title: PPG Mod Compiler Protection
- 10%: It looks like a mod has deleted some of your data. What?
- With title: PPG Mod Compiler Protection Service
- 10%: It looks like a mod has deleted some of your data. What?
- With title: PPG Mod Compiler Protection
Detailed assessment: https://www.reddit.com/r/peopleplayground/comments/1wmn16s/fps_new_virus_full_breakdown/
Official announcement:
