How to Get Rid of the Fractureiser Virus Infecting Minecraft Mods
On June 6, 2023, developers identified a virus spreading through Minecraft modpacks. Both the CurseForge and CraftBukkit modding communities were immediately forced to investigate and respond to the issue as the virus, named Fractureiser, continued to proliferate through new uploads.
So how do you know if you have the Fractureiser virus? How can you check your files for the Fractureiser virus and remove it?
What Is the Fractureiser Virus?
The Fractureiser virus is a malicious mod that spread throughplatforms such as CraftBukkit and CurseForge. Numerous single-use accounts uploaded malware-laced files as updates to popular modpacks, mods, and Bukkit plugins. As a result, the virus was able to infect anyone who updated their copy of an affected mod.
While the scope of infection was initially small, it was eventually discovered that the Fractureiser virus had infected several dozen popular projects.CurseForgeoffers an actively maintained list of mods infected by Fractureiser. Unfortunately, several thousand downloads of infected files took place before anyone noticed the problem.
The infection advances once a player downloads infected mods and launches their compromised copy of Minecraft. After Minecraft starts up and the virus executes, Fractureiser quickly scours the system, infects any .jar files it finds, and attempts tosteal data, like cryptocurrency-related information, Microsoft/Xbox Live logins, Discord user information, and Minecraft logins.
The virus relies on remote servers to activate its full payload. Though investigators have since determined that these servers have gone offline, the active risk that the servers will reactivate and that the Fractureiser virus will continue to steal data remains. For this reason, it’s vital that you determine whether your system is infected and remove the virus as soon as possible.
Do I Have the Fractureiser Virus?
If you use CurseForge or CraftBukkit mods, you need to check your system for problems as soon as possible. This is important even if you haven’t recently updated your mods, as some developers have reported finding malicious files that dated back as early as mid-April. Windows and Linux systems are particularly vulnerable to Fractureiser and should be thoroughly scanned.
The simplest way to check your system for the Fractureiser virus is to use the system-checking script published byPrism Launcher. The service offers a script for both Windows and Linux, and provides a detailed explanation of how to run the script—as well as plenty of technical documentation on the virus itself. If Fractureiser is found on your system, you will need to download MCRcortex’s Neko Detector fromGitHubto inspect your system for other infected .jar files.
You can also use the Fractureiser Web Scanner onGitHubto check mods that you’re interested in before downloading them. While it isn’t completely accurate, the web scanner is thorough in checking for bytecode sequences associated with Fractureiser. It can provide a considerable level of protection from infection when used proactively.
How to Remove the Fractureiser Virus
If you’ve found the Fractureiser virus on your computer, you should assume that all the data on your system is compromised. Ideally, you should back up all of your files onto an external device and reinstall your operating system. You should use the Neko Detector to check if the external device with your backup files contains any infected .jar files; otherwise, when you reload your backup, you’ll be reinstalling the virus too.
You should also change all of your passwords on a separate device, starting with your most sensitive accounts. Since the virus looks for sensitive login information and cookies, you can’t be certain that your accounts are safe until all of your passwords are changed. You should further check the sessions in any accounts you saved the password to in your browser to see if any suspicious logins have taken place.
Finally, ensure you update your antivirus software. Anup-to-date Windows Defenderis already able to identify many of the malicious files associated with Fractureiser, and other antivirus applications likely aren’t far behind. Aside from using common sense on the web, keeping your antivirus updated is one of the most important things you can do to protect your system.
Stay Safe When Downloading Mods
While investigators believe that it is once again safe to download mods from CurseForge and CraftBukkit, proactively protecting your data is one of the most important things you can do. Improving your online security is fortunately an easy process with the right guide.
By slightly tweaking your online behavior, you can keep yourself safe from scammers and hackers. It’s easier than it sounds.
Don’t let someone else take over your phone number.
If an AI can roast you, it can also prep you for emergencies.
Tor spoiled me forever.
Windows is great, but adding this makes it unstoppable.
Your phone’s camera app doesn’t show this, so it’s easy to miss.
