How to Verify a MU Online Client Before You Run It
Last updated: 10 July 2026
Ten minutes of checking beats a reinstalled Windows. A MU Online client is a multi-gigabyte archive containing unsigned executables from a hobbyist website — the correct posture is neither paranoia nor blind trust, but a short verification routine you run on every client from every server, ours included. Here is that routine, in order of importance.
Step 1: Only download from the server’s own website
Most infected MU clients are not from servers — they are re-uploads: a “mirror” on a random forum, a “fixed client” in a Discord DM, a torrent of a popular server’s files. The attacker rides an existing server’s reputation. Rule: the address bar shows the server’s real domain, over HTTPS, and you arrived there yourself — not through a link someone sent you. RiftMu distributes its client exclusively through riftmu.com/download; anything else claiming to be our client is not ours.
Step 2: Compute the SHA-256 hash
A hash is a fingerprint: if one byte of the file changes, the fingerprint changes completely. Windows can compute it with no extra software. Open PowerShell (Start → type “powershell”) and run:
Get-FileHash "$env:USERPROFILE\Downloads\NameOfClient.zip" -Algorithm SHA256
Replace the path with your actual download. Compare the output against the checksum the server publishes on the same page as the download links. Two honest caveats:
- A matching hash proves the file is exactly what the server released — it does not prove the release itself is clean. It defeats tampered mirrors and corrupted downloads, which is most of the real-world risk.
- A server that publishes no checksum has not necessarily done anything wrong — but then Step 3 is doing all the work. RiftMu’s policy: the official SHA-256, exact filename and release date are published on the download page together with the mirror links for each client release. If the download page does not show a checksum for the file you have, do not trust that file yet.
Step 3: Scan it with VirusTotal
VirusTotal runs a file past ~70 antivirus engines at once. For large clients, upload the launcher/installer executable (the archive may exceed upload limits) or paste the download URL. Reading the result is the skill:
| Result pattern | What it usually means |
|---|---|
| 0 detections | Clean as far as scanners can tell. Proceed. |
| 1–4 detections, all generic names (“Heur”, “Gen”, “ML”, “Packed”) | Typical for unsigned niche game launchers and anti-cheat drivers. Heuristic engines distrust the category, not the file. Cross-check with Step 2; usually fine. |
| Named trojan/stealer verdicts from major engines (e.g. specific “RedLine”, “Agent Tesla” families) | Stop. Delete the file. Do not rationalize this one. |
| Many detections of any kind | Stop, regardless of what the server’s Discord says. |
Step 4: Understand the warnings you will see anyway
Two warnings appear for virtually every private-server client and are not, by themselves, verdicts:
- Windows SmartScreen (“Windows protected your PC”) triggers on reputation, not analysis — unsigned executables that few people have run yet get flagged by default. It tells you the file is niche, which you already knew. It becomes meaningful only combined with a failed Step 2 or 3. Our game-won’t-start guide covers proceeding past it safely once you have verified the file.
- Antivirus warnings about the anti-cheat. MU servers ship anti-cheat components that hook the game process — behaviorally similar to what malware does, so heuristic engines flag them [Common on private servers]. This is exactly why Step 2 and Step 3 come first: verify the file is the server’s genuine release, then make an informed exception; never make blanket antivirus exclusions for whole drives or folders you also use for other downloads.
Step 5: Contain what you cannot verify
If you want an extra layer: create a separate Windows user account without administrator rights for gaming, refuse any client that demands to run its installer as administrator without explanation, and keep game directories out of your document/photo folders. A launcher legitimately needs to patch its own game folder; it never needs your browser passwords, and modern Windows will ask before an app reaches protected folders.
The routine, condensed
- Official website, HTTPS, typed yourself.
Get-FileHash→ compare with the published SHA-256 on the download page.- VirusTotal → judge the detection pattern, not just the count.
- Treat SmartScreen as reputation info, not a verdict — but only after 2 and 3 pass.
- No admin rights, no blanket AV exclusions.
Apply it to us first: get the client from the download page, verify, then create your account. If any check fails on a file claiming to be ours, tell [email protected] before running anything.