Warning: New PSP Virus on the Loose! Be Aware!!!

[PSPdemon]

We have just been informed of a new PSP Virus on the loose.

I have recieved the file and checked it for viruses, and shows as being positive. We have already heard reports of 2 bricks from this virus.

Be VERY careful of this....we dont want any one to end up with bricks... ( and yes we know of the custom firmware mods, but we dont know as of yet if it will fix what this virus does. )

As of the file I receieved.... its dressed up as a usb kxploit... but it can be changed easily to somthing else.

The folder names are SDL-TEST-5 and SDL-TEST-5%. ( though the folder names can be changed as well )

As for size of this file (the one I got sent), its % eboot is 65kb and the other ( non % ) eboot is 10 kb

or in combined total 74 kb

There is a virus checker that can check for suspicious flash acessing. This program can be found here (http://www.dcemu.co.uk/vbulletin/showthread.php?t=11920)

Please, do be careful. We don't want to see people getting brick's.

[gamehunter101]

dam nooooo

[BL4Z3D247]

thanx for the warning PSPdemon

[bronxbomber92]

:(.... I onw't be downloading anything

[pibs]

I was afraid this was gona happen :(

[dagger89]

Its easy to check if its a bricker or not.... run it under an emulated (devhooked) firmware first...

[Sterist]

ooo nice release 8) wheres the link?

[**1_Man_Matrix**]

ooo nice release 8) wheres the link?

Heh, funny :)

Atleast we can trust DCEmu to actually give us a warning, and go out of their way to help us not end up with very pretty paperweights. Nice work :D

[tuta]

Damn those people who try to spoil our psp go get a life get a psp lol

[ExcruciationX]

Great! I was wondering when this was going to happen. :(

[dagger89]

Question: How does the "virus" work? If the trojan (in this case its a trojan, as it doesn't replicate itself-- at least to my knowledge) doesn't touch any system criticial files (.prx, etc) it should be able to be recovered from

[gamehunter101]

Question: How does the "virus" work? If the trojan (in this case its a trojan, as it doesn't replicate itself-- at least to my knowledge) doesn't touch any system criticial files (.prx, etc) it should be able to be recovered from

it wipes everything off

[ACID]

That really sucks when people try to do things like this.

[gunntims0103]

why would someone go and code a virus and intentionally dress it up as a e-boot for a app or program........... i think its SONY

[kiore]

*******s!!!!!!!!!!!

[kiore]

b a s t a r d s!!!!!!!!!!!

[Kvonx]

I would never say sony tried this...............oops!!!:0 but seriously who would try sumting like this

[ACID]

I would never say sony tried this...............oops!!!:0 but seriously who would try sumting like this
Thats easy one of two people SOny because they dont want homebrew. Or a looser thats cant play homebrew on his psp and doesnt want any body else to do so eather.

[Video_freak]

Dun Dun Dun Dun.........

[ACID]

Dun Dun Dun Dun.........
Go to bed. Hey they just killed kenney:eek:

[MasterChafed]

damn dude, this sux big time. People really need to stop with this crap.

[masterpsp2.6]

hope i dont end up with this...dumb people who like to spoil fun

[LC_killer]

thanks for the heads up

[wraggster]

everyone needs to be vigilent now inc me

[dagger89]

Source: Toc2rta IRC chat last night
Time: 23:43
Person: Zarp2000

Avoid EVERYTHING from Zarp2000

[PSPdemon]

i heard to from this... but we dont know if he gave it out to someone else...

be on the look out....

also...another report came in as of another one got bricked... keep your eyes out

[dagger89]

I'll see if I can find the logs from IRC.. I was on last night, and might have them (the logs not the virus...don't want to cause confusion) on my PC....

[gunntims0103]

this is definitly gonna get out of hand quickly. almost like a desease spreading through downloads and hidden in e-boots. even now where all putting it out there that we know about it. this would make virus creators make even more of it just to piss us off. why would some one want to brick other's psps it doesnt make sense. anyway just know what your downloading and be smart thats all i gotta say

[Zukan]

Thanks for the warning, I'm not mentally stable enough to lose my PSP :(

[gamehunter101]

Source: Toc2rta IRC chat last night
Time: 23:43
Person: Zarp2000

Avoid EVERYTHING from Zarp2000

whose the admin for the channel that he was in

[Sektor]

You can call it a trojan or a malicious program but unless it replicates itself, it's not a virus.

[dagger89]

I forgot.... it might have been bri3d, but im not sure (i was on several channels [gamehackersguild, noobz, and psp-hacks])

And its called a trojan... not a virus

[Mr. Shizzy]

Ugghhh...this makes me sick. Now the only place I will be downloading anything from is right here at psp-news. :)

[iball]

You can call it a trojan or a malicious program but unless it replicates itself, it's not a virus.
Bingo, give this man a cookie.

[vladiftodi]

yeah, i bet theese are made by sony, to comfirm that homebrew is bad, or by stupid or maniac people
hacking is art in educational purposes, but bricking a psp is not even hacking whell yes

[FreePlay]

whose the admin for the channel that he was inI'm an operator for that entire server, and you can be DAMN sure he's not coming back there. And it's not someone from Sony, trust me. It's just some jackass who thought it would be funny. Perhaps I should report his IP to his ISP. What do you guys think? I just hope he wasn't on a proxy, or it could be a bit more difficult.

[Mr. Shizzy]

Hell yeah, I would report this loser!

[dejkirkby]

Report him.

[Malksta]

I'll be aware..

[mr_nick666]

I hope the ba$tard$ that created this virus get leprosy of the hands and ears :mad:

EDIT: and testicles... :rolleyes:

[dagger89]

I'm an operator for that entire server, and you can be DAMN sure he's not coming back there. And it's not someone from Sony, trust me. It's just some jackass who thought it would be funny. Perhaps I should report his IP to his ISP. What do you guys think? I just hope he wasn't on a proxy, or it could be a bit more difficult.

Sure why not....

[Kramer]

Yeah go for it FreePlay he deserves it.

[The_Ultimate_Eggman]

ONE word sums these kinda people up im sure I speak for all legitimate psp devs when I say WANKERS !!!!.

[ACID]

I'm an operator for that entire server, and you can be DAMN sure he's not coming back there. And it's not someone from Sony, trust me. It's just some jackass who thought it would be funny. Perhaps I should report his IP to his ISP. What do you guys think? I just hope he wasn't on a proxy, or it could be a bit more difficult.
Hang him bi his B****:eek:

[mnuhaily22]

Damn it, who is the motherf**ker who released this motherfu**ing virus, newsflash, your a piece of cow sh**, everybody who f**king owns a PSP would fu**ing own you right now if they f**king saw you, by the way, this is not a fu**ing threat it is a motherf**king promice you bi**h.F**k you.

[mnuhaily22]

I'm an operator for that entire server, and you can be DAMN sure he's not coming back there. And it's not someone from Sony, trust me. It's just some jackass who thought it would be funny. Perhaps I should report his IP to his ISP. What do you guys think? I just hope he wasn't on a proxy, or it could be a bit more difficult.
Go for it, this b**ch needs to f**king rot in hell for this.:mad:

[EnderPSP]

This happened before, and will probably happen again, unfortunately (although I hope it will never happen again). Sad.
Anyone actually having the psp trojan should send it to major antiviruses. That would help.

[jefdizon]

Here's one conspiracy for ya, the virus might be done by people contracted by Sony (with plausible deniability of course) to curb piracy and homebrew.

I wouldn't be surprised if Sony announces a new "virus-proof" or "virus-fix" firmware upgrade in the near future, oh, maybe a few weeks from now? ;)

[beansta]

i found a site that may help those whose r lookin for an antitrojan for the psp

http://files.pspupdates.qj.net/cgi-bin/cfiles.cgi?0,0,0,0,40,1585

[NoQuarter]

I doubt sony would do something like this,too much liability.We can always start checking our eboots with devhook or the new psp emulator when it's released.
We all knew this would happen again, at least it wasn't more widespread.

[Lukeson]

What sick asshole wrote this shit??

[John Vattic]

Sony did it.

[canwemakelove]

yh they probly did, daiiiiiiiiiiiiiiiiiiiiim i gota be extra careful:( :mad:

[Lukeson]

Just to be sure... you have to actually copy and execute the virus on the psp, right?

[carlitx]

ya i got a question to i got no idea what bricking is, so can some one please explain just what bricking is?

[Vega]

*******s.

[Vega]

*******s.....

[Lukeson]

bricking your PSP = You're ****ed.

You're ****ed means as much as your PSP is broken

[Emeriastone]

Shouldn't this be called malicious software instead of a virus? It doesn't replicate itself does it?

[Lukeson]

You're right

[win2k1]

Could thins thing be worked into anything else than psp programs like game saves or even the games themselfs?

[Skye]

Would you guys stop saying Sony "did this". They would not be so stupid and risk lawsuits from individuals and all the bad press to brick a few PSPs.

[Artemis-kun]

I'd like to get back to the question of "you have to actually transfer it to the PSP and execute it for it to brick" as none of the replies or the original report exactly state how it happens... like will it automatically export to your PSP when you connect it, and then kill it, or do you have to be dumb enough to do it yourself?

[Vega]

I'd like to get back to the question of "you have to actually transfer it to the PSP and execute it for it to brick" as none of the replies or the original report exactly state how it happens... like will it automatically export to your PSP when you connect it, and then kill it, or do you have to be dumb enough to do it yourself?

It would have to write to flash as soon as you execute the Eboot. It would just be like executing any homebrew app from PSP. Game > Memory Stick > The homebrew with the virus > press X > wait a few seconds > Bricked Psp > Cry .

Damn ******* whoever made this. Best way to be safe is to let other people test and report new homebrew, which is kinda selfish, but one of the only ways to be safe.

[Cloudhunter]

I'd like to get back to the question of "you have to actually transfer it to the PSP and execute it for it to brick" as none of the replies or the original report exactly state how it happens... like will it automatically export to your PSP when you connect it, and then kill it, or do you have to be dumb enough to do it yourself?

Dumb enough to do it yourself. Take that from someone who was helping to test it... :eek:

Not that it worked when I had it. I had "SDL-TEST-4". He was trying to get it working, I should have known it was suspicious, especially as he said he tested it himself and it worked. If anyone wants several work in progress versions to keep a lookout, let me know :rolleyes:

My heart goes out to his victim in IRC, and got bricked.

Damn Zarp2000.

Cloudy

[Veskgar]

Could thins thing be worked into anything else than psp programs like game saves or even the games themselfs?
That is a very good question... Can this be embedded somehow into a regular homebrew app or emulator? Or is that not likely? Unfortunately now we all have to be very careful and worry about "bad" eBoots. This is very sad but I guess its to be expected.

[Ci5tm Konfliqt]

i dont get it . why ? what is the point ? havent they(the virus creators) got anything better to do ?:confused: :mad:

[JaguarXL]

Maybe we can use the PSP Emulator to test homebrews w/o having to worrie about brincking our PSP's... let's hope that emulator realy exists...

[S34MU5]

Its easy to check if its a bricker or not.... run it under an emulated (devhooked) firmware first...
yeh thats what i was thinking. This is probably some areshole with a DS trying to take over the world. (i have nothing against the DS actually im gona get one soon. just some people take PSP vs DS toooo far!)

[inlovewithi]

I hate losers who actually spend their life in front of a computer, creating virus to screw people they're never going to meet. It takes a really immature loser.

[erix2006]

FU** FU** FU** FU** FU** My brother just FU** ing bricked my psp with this virus :eek: . He downloaded some sh** from internet. I am about kick his ass!! :( But luckily he`s got psp so I am gonna take his psp and gonna use it. :p But still... I am not happy :mad:

[aries2k4]

Wow, this sucks. Ya report the prick. Hope it doesn´t spread to quick and I hope no more pop up(at least for a while). Damn, now I´m going to have to run pspsafe(psp-condom) before starting to have fun.

[gotmilk0112]

what if its another "fake"? like way back in 2005 someone reported a "psp virus" that "changes the color of your background every month" but that is what the psp does by default.

just follow these words and you wont get any virus's:

If its too good to be true....it probably is. and will be a virus.

[beansta]

why do people do this 4, 4 a quick thrill or what? i dnt get it. immature lil 12 yr olds thats all it is

[blackrave]

This is very, very sad. Some fool is trying to break all of our PSPs.
I only download stuff from DCEmu, though, so I won't ever get this.
There is a newer version of PSafeP here (http://www.dcemu.co.uk/vbulletin/showthread.php?t=12514&highlight=psafep), v1.2, which has a few bug fixes.

Thanks for warning us! :)

[splodger15]

Thanks for letting us now pspdemon so we can stay aware

[Vega]

Whoever made it must have decent PSP coding knowledge. I heard that writing to flash is quite hard. Maybe its a respectable coder who developed this.

Who knows.

[djamm]

Whoever made it must have decent PSP coding knowledge...Maybe its a respectable coder who developed this.

Well it would have been the first time a decent coder did something similar to this...On the DS, Darkfader released a similar program that bricked the DS! And he was one of the first people to run unsigned code on the DS.

I hope everyone is aware, and I hope this sort of malicious behaviour doesn't continue!

:confused:

[ExcruciationX]

...Darkfader released a similar program that bricked the DS! And he was one of the first people to run unsigned code on the DS.

Oh really? Never heard of that!

[Vega]

I'm an operator for that entire server, and you can be DAMN sure he's not coming back there. And it's not someone from Sony, trust me. It's just some jackass who thought it would be funny. Perhaps I should report his IP to his ISP. What do you guys think? I just hope he wasn't on a proxy, or it could be a bit more difficult.


Would it be possible to compare his I.P address to other people who have submitted past work on your site? Im eager to find out who this is and tell him how much of a wankstain he is

[Mr.Denny]

It was bound to happen anyway i suppose.

Let`s just all be careful. :)

Still, i download only from DCemu which is very safe indeed. ;)

[mib_]

Personally I don't think this is a virus or trojan.. I just think whoever wrote it was trying to create something else, and through bad coding has accidently ended up with a program that bricks your PSP. Until someone see's the actual code, then I call this whole scare bullsh*t. It just reminds me of the whole 2.00 downgrader / tiff exploit that Symantec still flag as a virus. It's a rogue eboot, so avoid it. End of.

Writing a trojan for a PSP is pointless.. it just won't spread. Bumpkiss.
:cool:

[wiedel]

Thanks for the warning PSPdemon!!

[Veskgar]

Well if this was intentionally created, this is exactly what the virus writer wanted. Panic, controversy, attention, etc. to make him feel like he has some sort of importance in the world.

So I say, just be careful, be vigilant, but don't get panicked or back away from the PSP homebrew scene. This only strengthens our resolve and solidarity and we will never go away.

WOW! I sound like a politician trying to sell a war plan huh? Owell ;-)

[Vega]

yea, it would take more than some assholes virus to back me off from PSP homebrew.

A virus that makes the console explode in your hands..... now.... would be different ;)

[dzdncnfsd]

How is this a virus? Do you mean it's a trojan? How does it spread?

[Cloudhunter]

Personally I don't think this is a virus or trojan.. I just think whoever wrote it was trying to create something else, and through bad coding has accidently ended up with a program that bricks your PSP.

Having tested frequent versions of his program, in numerous attempts to get it to work (I was lucky I had to go offline 30 minutes before he got it working... The other tester copped it), I can't see how a program that is only 76 KB big, and was meant to be a "SDL game" should write to flash accidentally. It shouldn't have even been a kernel mode eboot in that case.

You can't "Accidently" Create a game based on another library that formats your flash.

Cloudy

EDIT:

How is this a virus? Do you mean it's a trojan? How does it spread?
Technically, it should be considered a "trojan" or "malware" as it comes under false premises.

[r2works]

I think we should start donations for all those who test eboots, emu, homebrews, etc..

[Cloudhunter]

I think we should start donations for all those who test eboots, emu, homebrews, etc..


Not really, but a word of advice.

Before testing an EBOOT from an unknown developer, test it through devhook

Cloudy

[Video_freak]

How is this a virus? Do you mean it's a trojan? How does it spread?
It's really a trojan. No need to bitch around. :rolleyes:
I'm sorry if you were seriously asking that though. ;)
And for those of you who think DCEmu is 100%, wraggster and staff don't ALWAYS check EVERY file, so don't sue DCEmu if you get any sort of malicous or trojan-like software from here.

[Wally]

Just download everything from Dcemu

This hasnt entered any sites quite frankly

Just be careful guys, even if Dcemu is the safest site in the world. Viruses can be disguised as something else such as "Full Speed N64 emulator" or "Full Speed PSX Emulator"

This is why sony gets us to update, be warey

Im not afraid of this guy, hes a n00b. end of story

[thaforgottenone]

ok...ok...ok guys.....i did it because i couldnt get the CFW to work............. SIIIke haha i was just playing, i wouldnt do such thing...love my PSP as much as my gf..but spend more tyme wid my PSP hahahaha but yea like tha dude post b4 i did... juss be safe bout things and it was a noob loser..

[Cloudhunter]

ok...ok...ok guys.....i did it because i couldnt get the CFW to work............. SIIIke haha i was just playing, i wouldnt do such thing...love my PSP as much as my gf..but spend more tyme wid my PSP hahahaha but yea like tha dude post b4 i did... juss be safe bout things and it was a noob loser..

Don't be such a spammer.

[thaforgottenone]

sorry bout that juss wanted a catching intro... juss throwin my 2cents

[Kyros]

Hi all, I just downloaded PSafeP v. 1.2 (Dark Killer) because of this Virus or Trojan on the loose and scanned all my EBOOTs on my memory stick then came accross a couple of my Homebrew apps. that the program read there was "SUSPICIOUS FLASH ACCESS DETECTED!" and that was for __SCE__Dev Hook, DGEN, Homer's RIN v. 3.3, Links 2, NesterJ, SNES9XTYL, Wifi Sniffer, but there was one that the program read "Flash Access Detected, but appears to be read only" and that was for PSP Radio... Now my question is why are these EBOOTs reading this and most importantly how would I know if when I'm downloading an app. into my memory stick that I would get a Virus or Trojan because that app. read "SUSPICIOUS FLASH ACCESS DETECTED!" when the ones on my memory stick read the same thing and work perfectly fine...thanx for your time.

[M!ckeY]

@ thaforgttenone

Learn how to spell.....it's just not juss

[Basil Zero]

exactly what program is this virus in?

[ICE]

come on now people if you want to piss someone off do it in person by peeing on their shoe or something. dont make some crappy trojan and do it from miles away. BE A MAN. or a WOMAN if thats the case.

[thaforgottenone]

Sorry, yet agen. This time for not using the right spelling of a word. Just got stuck on blogging mode when typing. Next time, the task of typing towards a reply on this site will be carried out in a correctable manner. I just like spelling it that way.

But back to the topic, any known sites that where hosting/had this Virus or Trojan? I just want to know what sites to back off of.

[keefurxxcore]

MY PSP IS BRICKED :'( im so pissed off im sending it to sony :"(

[ICE]

keefur your sig is WAY too big. ur gonna get it deleted.

[Video_freak]

Haha it's hella cool though! :)

[pibs]

dang that thing is a page long

[win2k1]

Ok so I have got devhook working emulating firmware 1.5. I could not do it with do it with devhook 0.46 so I had to use my old not used 32mb stick and put devhook 0.45 on it. I tried many ways to get it working with version 0.46 but non worked so I guess the 32mb stick will be my checking programs stick. Just for a last chance does anybody know how to get version 1.5 working with 0.46?

Now if I use the emulated 1.5 firmware this does not make my PSP 100% safe, does it, there still is a chance that this trojin will still write to the psp flash?

[Cloudhunter]

Now if I use the emulated 1.5 firmware this does not make my PSP 100% safe, does it, there still is a chance that this trojin will still write to the psp flash?

Nope, the most it will do is mess up devhook. Plus it was an isolated case, as yet it hasn't been spread by any means.

Cloudy

[Kyros]

Okay I posted what I'm about to post again a lil over a week ago and nobody responded so hopefully someone will give me some feed back this time...Hi all, I just downloaded PSafeP v. 1.2 (Dark Killer) because of this Virus or Trojan on the loose and scanned all my EBOOTs on my memory stick then came accross a couple of my Homebrew apps. that the program read there was "SUSPICIOUS FLASH ACCESS DETECTED!" and that was for __SCE__Dev Hook, DGEN, Homer's RIN v. 3.3, Links 2, NesterJ, SNES9XTYL, Wifi Sniffer, but there was one that the program read "Flash Access Detected, but appears to be read only" and that was for PSP Radio... Now my question is why are these EBOOTs reading this and most importantly how would I know if when I'm downloading an app. into my memory stick that I would get a Virus or Trojan because that app. read "SUSPICIOUS FLASH ACCESS DETECTED!" when the ones on my memory stick read the same thing and work perfectly fine...thanx for your time.

[LilSwish722]

ah well...this was bound to happen at one point or another...thx for the warning

[ramzak]

thanks for the warming man, but still tho -_- i cant believe that there is a virus for psp...OMG that means that i musnt download like crazy then -_-.

[Cloudhunter]

Okay I posted what I'm about to post again a lil over a week ago and nobody responded so hopefully someone will give me some feed back this time...Hi all, I just downloaded PSafeP v. 1.2 (Dark Killer) because of this Virus or Trojan on the loose and scanned all my EBOOTs on my memory stick then came accross a couple of my Homebrew apps. that the program read there was "SUSPICIOUS FLASH ACCESS DETECTED!" and that was for __SCE__Dev Hook, DGEN, Homer's RIN v. 3.3, Links 2, NesterJ, SNES9XTYL, Wifi Sniffer, but there was one that the program read "Flash Access Detected, but appears to be read only" and that was for PSP Radio... Now my question is why are these EBOOTs reading this and most importantly how would I know if when I'm downloading an app. into my memory stick that I would get a Virus or Trojan because that app. read "SUSPICIOUS FLASH ACCESS DETECTED!" when the ones on my memory stick read the same thing and work perfectly fine...thanx for your time.It's a false positive, they all don't write to flash. They are safe.

The one you should look out for is one called "SDL_TEST-5", don't ever download that, thats the bricker. It is being set in irc as far as I know.


thanks for the warming man, but still tho -_- i cant believe that there is a virus for psp...OMG that means that i musnt download like crazy then -_-.
Most of homebrew is safe, but like said above, the only known one so far is "SDL_TEST-5".

Cloudy

[sovram]

It was inevitable

[Kyros]

Good to know, thanx Cloudhunter.

[Yuhooman]

well Hi this is my first post but here me out
ever herd the saying that theres good in everything... This Zarp2000 guy has created the greatest downgrader. If you PURPOSELY brick your PSP because you uprgrade it or something you can unbricker it with Pandora's Battery the came out last month by Noobz, C+D and others. I know this works I just finished unbricking a friends PSP If someone can help me put up the videos of the process i'll be happy to add evidence :thumbup:
the site is http://www.noobz.eu/joomla/news/unbricker-for-all-firmwares.html check it out if you have or know of someones brick
PS: if anybody knows where i can get the SDL_TEST-5 (psp bricker) pls pm me thxx

[ExcruciationX]

And why do we care? You're most likely lying.

[xg917]

so if this malicious code thing ****s our psps, up will we still be able to use pandora to recover it?

[Sonicboy 101]

Don't bump old threads. This is old anyway, dates back to October...

[Lodis]

well Hi this is my first post but here me out
ever herd the saying that theres good in everything... This Zarp2000 guy has created the greatest downgrader. If you PURPOSELY brick your PSP because you uprgrade it or something you can unbricker it with Pandora's Battery the came out last month by Noobz, C+D and others. I know this works I just finished unbricking a friends PSP If someone can help me put up the videos of the process i'll be happy to add evidence :thumbup:
the site is http://www.noobz.eu/joomla/news/unbricker-for-all-firmwares.html check it out if you have or know of someones brick
PS: if anybody knows where i can get the SDL_TEST-5 (psp bricker) pls pm me thxx

Bumping such old threads has to be one of the most annoying habits on forums that exists. It wouldn't be so bad if the information you posted was actually correct. The fact is, you do not need to purposely brick your Psp before being able to use Pandora on it.

Pandora will work on a perfectly fine Psp as well as a bricked one. Before bumping such an old thread, at least you could have bumped it with accurate information.

[DPyro]

Don't bump old threads.