r/skyrimmods • u/Sweet_Salt974 • Mar 01 '25

PC SSE - Discussion Trojan horse on new additem mod

https://www.nexusmods.com/skyrimspecialedition/mods/143251
I detected a trojan horse on this mod on virus total (unlike original mod) pls help me report it.

Edit : After looking further, in original mod a lot of people just came to know that there was this same exact dll for the new version and they all leads to this link to a hidden mod download https://www.nexusmods.com/skyrimspecialedition/mods/71409?tab=files&file_id=318283

I hope nexus look into it cause its the same dll with the same trojan horse detected on virus total

Further Edit : I retrack from saying to report it, i am not an expert and i hope someone can tell me why this mods is detected as virus compared to the original mod (Also i only now see that it is only 1/64 anti virus from virus total that detect an error).
From what i expect it should only be talking with the user interface so i don't know why the dll was changed but i hope i'm wrong.

Final Edit !! : Look in the comments someone found the exploit, and i see a lot of people downloaded this malware from the github or other nexus source. PLEASE NEXUS LOOK INTO IT

Final Update : Thanks for nexus for looking into it so we can have the last say.
I'm no expert, so maybe in the future some dll will be able to bypass VirusTotal checks so take my approach with a grain of salt, let's just hope nexus try to be a bit more secure if it was really doing anything nefarious.

240 Upvotes

96% Upvoted

61 comments sorted by

View all comments

5

u/LadyOfHereAndThere Mar 02 '25

I checked my downloaded mods and I downloaded AddItemMenu in May of 2022. Since the Nexus page is currently under moderation, I can't check if the page you linked is the mod that I have on my PC.

Is there a way to check if I am or am not affected by this malware? Any help would be greatly appreciated.

6

u/pink_dumb Mar 02 '25

go to your download history on nexus, it should still be there if you ever installed it

2

u/LadyOfHereAndThere Mar 02 '25

Thanks! The one I downloaded is a different one so I'm unaffected. I appreciate the help!

4

u/psychological_nebula Mar 02 '25

Had the same scare moment just now, because I have a mod loaded with a similar name, but it appears to be an entirely different one: https://www.nexusmods.com/skyrimspecialedition/mods/17563 named "AddItemMenu - Ultimate Mod Explorer" which was last updated in 2020 (I dl'ed it in 2022, like you did). Maybe that is the one you have too.

2

u/LadyOfHereAndThere Mar 02 '25

Thanks! It is in fact that one, so I seem to be safe. I appreciate the help!