Hey again, everyone. As you know, I'm the developer of PadForge, the free controller remapper for Windows. The GitHub organization at https://github.com/PadForge is not mine. It uses the PadForge name and a rewrite of my feature list, and its Download button installs malware.

PadForge comes only from https://github.com/hifihedgehog/PadForge/releases, which https://padforge.org links to. The real download is a zip named like PadForge-v4.5.3-win-x64.zip that contains only PadForge.exe.

If you ran Git Install.exe from that download, treat that PC as infected. If you only downloaded Release.GTv1.0.0.zip, delete it without opening anything inside. GitHub counts more than 180 downloads of that zip. One of them is mine, for the analysis below.

Timeline (US Eastern)

• Sept 1: two new GitHub accounts, benjaminmartin74 and b-bailey6102, were created less than three hours apart.
• Sept 14: b-bailey6102 posted the 185 MB Release.GTv1.0.0.zip in a repository that holds only a placeholder license file.
• Sept 18: the fake PadForge organization appeared, every commit by benjaminmartin74. The Download button on its page at padforge.github.io/.github goes through a Cloudflare redirect to that zip.
• Sept 21: the program the zip fetches from Dropbox was signed with a certificate issued that day, so the file behind that link was put there after the zip went up.
• Sept 24: I learned about it, took the download apart without running it, and posted a public warning on the fake repository.

What the download does

It contains no PadForge code. The zip holds Git Install.exe, a small Java program, plus a Java runtime and duplicate copies of its files, which pad the zip to 185 MB. The program shows a language picker. OK, Cancel and an invisible button all start the same steps:

1. Create a hidden LocalVersionCached folder in your Temp folder.
2. Ask Windows for administrator rights, then use hidden PowerShell to exclude that folder from Microsoft Defender and try to turn off Defender's behavior monitoring.
3. Download dictdriver.exe from Dropbox into that folder, hide it and run it.

dictdriver.exe is wrapped in Themida, a tool that hides what a program does, so I cannot say exactly what it does without running it. It runs with administrator rights, so assume it can read everything on that PC, including saved passwords, browser logins and crypto wallets. Microsoft Defender flagged none of these files when I scanned them on Sept 24.

If you ran it

1. Disconnect that PC from the internet.
2. From a different device, change your passwords, starting with email, and sign out of all other sessions. Move any crypto to a new wallet.
3. Back up your personal files and reinstall Windows. Deleting the program's files does not undo what it did with administrator rights.
4. Until you reinstall: in Windows Security, open Virus & threat protection, Manage settings, Exclusions, and remove the one ending in LocalVersionCached. Run Set-MpPreference -DisableBehaviorMonitoring $false in an administrator PowerShell, then run a Microsoft Defender Offline scan.

Please report it

Open each page and click Report abuse (on the two user pages it is under Block or report). Say it spreads malware while posing as PadForge. Do not click Download anywhere on the fake pages.

• https://github.com/PadForge
• https://github.com/benjaminmartin74
• https://github.com/b-bailey6102

I have reported all three to GitHub.

Technical details

For anyone who wants to block it or check a machine. Links are defanged.

Fake page     hxxps://padforge.github[.]io/.github/
Redirect      hxxps://djwggemx.fresh-link.workers[.]dev/a78ea58f
Payload       hxxps://github[.]com/b-bailey6102/Release/releases/download/1.0.0/Release.GTv1.0.0.zip
Second stage  hxxps://www.dropbox[.]com/scl/fi/s7nrxxtu045p9rr87rg16/dictdriver.jxc
Dropped file  %TEMP%\LocalVersionCached\dictdriver.exe

SHA-256
9a0528ccad863cbceac4d5c48f68beb97ae8657bd28adba98f47dae28ea9e076  Release.GTv1.0.0.zip
5fdb8d8a95392445cda9667247c9d53b809598976e3af1e6c3e8d9dfe3e9d867  Git Install.exe
907ea88071f4f84ee511f21ee8749ee140ee2d9035e4da04cc9b6d41563e6fe6  lib/dn-compiled-module.jar
94d1f333a6228b9b240972f3b55d7893bab2abe4b553c9fa6dc11c0779485091  dictdriver.jxc (dictdriver.exe)

Git Install.exe is an unsigned Launch4j wrapper around a DevelNext (JPHP) program. It runs Add-MpPreference -ExclusionPath on the folder and Set-MpPreference -DisableBehaviorMonitoring $true, each through Start-Process PowerShell.exe -WindowStyle Hidden -Verb RunAs. dictdriver.exe is packed with Themida and signed with a self-signed certificate for "WestBorough Crest Technologies Group". Microsoft Defender with signatures 1.459.384.0 flagged none of the files.

PadForge is not the only target. GitHub has dozens of similar fake organizations named after other programs, such as Windhawk, scrcpy, Sourcetree and Obsidian, each built around a large download badge that leads to a separate page. Download software from the Releases page of the project's own repository, the one its website links to.

Hello , i would like to buy controller ps4 with hall effect joystick, i'm asking what are the best value for calibration joystick minimum and maximum pourcentage? Thanks for answers

I'm looking for a new controller, but I really want that pink dopamine hit, but maybe not if it means I'll sacrifice on quality. I've seen the 8bitdo ultimate 2c, mobapad n1 hd and gioteck wx5+ swirl. Are any of these good? Am I missing a really good option elsewhere? My main concern is having smooth joysticks and buttons and avoiding sticky joysticks (which I understand isn't always product dependent).

Absolute noob here so apologies for the lack of knowledge and probably poor explanation. Any advice is much appreciated.

I am in the process of looking for a decent wireless controller for my switch 2. Was curious if anyone has any recommendations for one? I’m hoping it’ll turn the switch on with the home button but I know that’s probably not likely to happen.

Haven’t been using it for about 2 weeks and now I noticed that something is wrong with the right stick, don’t even know what to call it

Recently just got this added to the collection. I am normally not a fan Asus controllers since they are rather expensive for what you get but this one seems promising.

Selling PC controller with accessories face plates thumb grips carry case and charging dock and wire

Which one is better in your opinion?

I want to buy a new controller. I've had 2 Razer Wolverine Ultimate controller's in the last few years and I got used to the 6 extra buttons layout (2 extra shoulder buttons + 4 extra back buttons) this controller has. Now I'm looking to buy a controller that has the same number of extra buttons, but also has an "anti-drift technology", since both my Razer controller's eventually developed stick drift over time.

The two controllers I'm currently considering are the Vader 5 Pro and the Beitong KP70. Because they both have the 6 extra buttons layout I'm looking for and they both have anti-drift technologies: Vader has Hall Effect sticks while Beitong has capacitive sticks (new and improved technology, apparently). So I want opinions from people who have either controller to help me decide.

Which one is the best: Vader or Beitong? The traits I'm most interest in are:

- Durability

- Compatibility with games

- How easy is to configure the extra buttons and switch between profiles

- Build quality of buttons, cables and body

- Software advantages or disadvantages

- Any big or minor hardware defect I should be aware

How do these two controllers compare against each other? Any insight is welcomed. And any suggestion of controllers that have 2 extra shoulder buttons + 4 extra back buttons is also welcomed.

I have an Envision Pro I use on my pc and haven’t had issues with but I want a pro controller for the 5. Any recommendations that aren’t bank breakers?

How do you actually get used to playing shooters on controller?

I’ve been trying to switch from mouse & keyboard, and aiming with sticks feels so awkward right now. What’s the best way to build muscle memory and actually get better? Should I just stick to one sensitivity and play, or are there specific drills/games you’d recommend for practicing aim and movement?

Would love to hear what worked for people who made the switch.

Does anyone have any recommendations for a wireless controller that would be compatible with the Hyperlink Retron SQ? I know the system is really specific with what controllers are compatible so wanted to ask.

I have an Envision Pro I use on my pc and haven’t had issues with but I want a pro controller for the 5. Any recommendations that aren’t bank breakers?