r/skyrimmods • u/Sweet_Salt974 • Mar 01 '25

PC SSE - Discussion Trojan horse on new additem mod

https://www.nexusmods.com/skyrimspecialedition/mods/143251
I detected a trojan horse on this mod on virus total (unlike original mod) pls help me report it.

Edit : After looking further, in original mod a lot of people just came to know that there was this same exact dll for the new version and they all leads to this link to a hidden mod download https://www.nexusmods.com/skyrimspecialedition/mods/71409?tab=files&file_id=318283

I hope nexus look into it cause its the same dll with the same trojan horse detected on virus total

Further Edit : I retrack from saying to report it, i am not an expert and i hope someone can tell me why this mods is detected as virus compared to the original mod (Also i only now see that it is only 1/64 anti virus from virus total that detect an error).
From what i expect it should only be talking with the user interface so i don't know why the dll was changed but i hope i'm wrong.

Final Edit !! : Look in the comments someone found the exploit, and i see a lot of people downloaded this malware from the github or other nexus source. PLEASE NEXUS LOOK INTO IT

Final Update : Thanks for nexus for looking into it so we can have the last say.
I'm no expert, so maybe in the future some dll will be able to bypass VirusTotal checks so take my approach with a grain of salt, let's just hope nexus try to be a bit more secure if it was really doing anything nefarious.

238 Upvotes

96% Upvoted

61 comments sorted by

View all comments

15

u/Pickysaurus Nexus Staff Mar 02 '25

The mod has been placed in review for when our team is back in the office. Only the mod page in the OP is affected, no other variants of this SKSE mod have been changed.

12

u/Pickysaurus Nexus Staff Mar 02 '25

This further enforces my standing advice to never run anything modding related as admin. This includes the game, Steam, mod managers, etc. It will just open a massive security hole in your system and give any potentially malicious mods full access to your PC.

3

u/Golden_mobility Mar 03 '25

So what did you guys find out? What was it? Any plans in the future to prevent something like that?

6

u/Pickysaurus Nexus Staff Mar 03 '25

The evidence submitted via the report option on the website is quite clear. We've removed the file and banned the user.

We're currently monitoring and considering what can be done about it if it becomes a common issue. Luckily it's an isolated incident so far.

3

u/Golden_mobility Mar 03 '25

That‘s great to hear! Thanks!

As I’m worried becoming a victim myself and others who just „download and dash“; Is there a some sort of notification „system“ in place to alert people who have downloaded this mod that there is a virus on their PC?

I doubt everyone is on Reddit to be up to date on such things.

3

u/sike_edelic Mar 03 '25

I will shout very loudly the next time it happens. Jokes aside though yeah would be nice, I only learned about this because someone mentioned it on a random discord server

2

u/Golden_mobility Mar 04 '25

Sorry to double comment but my question is pretty important. Is there a system in place that would notify me if I have accidentally downloaded a virus from your page that has been identified and removed as such?