A Call of Duty malware attack has been discovered in Modern Warfare 2 (2009) lobbies, infecting players with a self-spreading virus. With this plaguing players, the original Modern Warfare 2’s Steam servers have shut down since the attack.
- Related Reading: Modern Warfare 2 and Warzone Season 5 New Content – Maps, Weapons, Celebrity Operators and More
A Steam thread brought the issue to light, with the original poster naming the malware as “Trojan:Win32 Wacatac.B!ml.” This malware seems to be listed in the VirusTotal repository and is flagged as suspicious, with the malware apparently replacing dsound.dll. The program infects other players through the use of hacked lobbies.
One commenter in the thread did a bit of digging and found strings in the program that reveal the malware is a type of worm, or self-spreading virus. It also seems to have been made specifically for MW2.
I can see strings:
Worm deactivated by control server.
Worm failed to retrieve data from the control server.
Worm killed by control server.
Worm up to date.
wormStatus infected %s
Unsupported Windows version (tf?)
User was randomly selected to be a spreader in modded lobbies.
User was selected to be a host/ignore modded lobbies/join unmodded lobbies only
username=%s&steamID=%lld&cpu=%s&gpu=%s&winver=%sThe “tf?” proably means “what the f**k?”.
Seems this stuff has been coded specifically for COD MW2
Since the discovery of the malware, Steam servers for MW2 have been brought offline to “investigate reports of an issue.” No word yet on when the servers will be brought back up.
Update: Activision has announced that a patch for the 2009 game was released and multiplayer functionality is now working again!
📢 #MW2
Multiplayer for Call of Duty: Modern Warfare 2 (2009) on Steam was patched to address a recent issue and is now back online.
— Call of Duty Updates (@CODUpdates) August 2, 2023
Thanks, ModernWarzone!
More Call of Duty Reading: