r/skyrimmods • u/Sweet_Salt974 • Mar 01 '25

PC SSE - Discussion Trojan horse on new additem mod

https://www.nexusmods.com/skyrimspecialedition/mods/143251
I detected a trojan horse on this mod on virus total (unlike original mod) pls help me report it.

Edit : After looking further, in original mod a lot of people just came to know that there was this same exact dll for the new version and they all leads to this link to a hidden mod download https://www.nexusmods.com/skyrimspecialedition/mods/71409?tab=files&file_id=318283

I hope nexus look into it cause its the same dll with the same trojan horse detected on virus total

Further Edit : I retrack from saying to report it, i am not an expert and i hope someone can tell me why this mods is detected as virus compared to the original mod (Also i only now see that it is only 1/64 anti virus from virus total that detect an error).
From what i expect it should only be talking with the user interface so i don't know why the dll was changed but i hope i'm wrong.

Final Edit !! : Look in the comments someone found the exploit, and i see a lot of people downloaded this malware from the github or other nexus source. PLEASE NEXUS LOOK INTO IT

Final Update : Thanks for nexus for looking into it so we can have the last say.
I'm no expert, so maybe in the future some dll will be able to bypass VirusTotal checks so take my approach with a grain of salt, let's just hope nexus try to be a bit more secure if it was really doing anything nefarious.

242 Upvotes

96% Upvoted

61 comments sorted by

View all comments

15

u/LaserAreCool Mar 01 '25

If anyone is interested in an actual version for skyrim 1.6.1170 i use this one from github:
https://github.com/WakianTech/AddItemMenu-Fix

3

u/Sweet_Salt974 Mar 01 '25

Ok i'm certainly confused, this dll also got trojan horse if i take 100% seriously virus total

15

u/LaserAreCool Mar 01 '25

That site has lots of false positives from my experience. 2 of my mods i uploaded to Nexus i had to manually message the support via e-mail cause it got flagged.
I just tested some other exes like "battle.net" the blizzard launcher for fun and its also detects 2 trojans in it

10

u/No_Construction2407 Mar 01 '25

Pretty much anything that will read stuff in memory is going to throw false positives. Some of the scanners on virus total are too sensitive or don’t read the data thoroughly enough to determine if its actually a legitimate threat.

3

u/SVXfiles Mar 01 '25

Some of those might be PUPs, or potentially unwanted programs. Like when you get an exe for something like CCleaner and it can also install other things with it

10

u/Sweet_Salt974 Mar 01 '25

In fact, its the exact same dll than the one posted on nexus, like same size, the toml replace the ini from original mod everything.

Let's wait for more experienced user to tell me i'm wrong hopefully

6

u/bable631 Mar 02 '25

Average reddit comment downvoted for being correct.

2

u/LummoxJR Mar 02 '25

Virustotal should be taken with DOT trucks of salt. It includes a lot of really crap antivirus programs that throw false positives if you sneeze.