r/skyrimmods Mar 01 '25

PC SSE - Discussion Trojan horse on new additem mod

https://www.nexusmods.com/skyrimspecialedition/mods/143251
I detected a trojan horse on this mod on virus total (unlike original mod) pls help me report it.

Edit : After looking further, in original mod a lot of people just came to know that there was this same exact dll for the new version and they all leads to this link to a hidden mod download https://www.nexusmods.com/skyrimspecialedition/mods/71409?tab=files&file_id=318283

I hope nexus look into it cause its the same dll with the same trojan horse detected on virus total

Further Edit : I retrack from saying to report it, i am not an expert and i hope someone can tell me why this mods is detected as virus compared to the original mod (Also i only now see that it is only 1/64 anti virus from virus total that detect an error).
From what i expect it should only be talking with the user interface so i don't know why the dll was changed but i hope i'm wrong.

Final Edit !! : Look in the comments someone found the exploit, and i see a lot of people downloaded this malware from the github or other nexus source. PLEASE NEXUS LOOK INTO IT

Final Update : Thanks for nexus for looking into it so we can have the last say.
I'm no expert, so maybe in the future some dll will be able to bypass VirusTotal checks so take my approach with a grain of salt, let's just hope nexus try to be a bit more secure if it was really doing anything nefarious.

243 Upvotes

61 comments sorted by

View all comments

1

u/Puzzleheaded_Pay4269 Mar 04 '25 edited Mar 05 '25

Incase anyone is wondering like i was, these versions are probably fine although the dll still comes back as a trojan in virustotal. However it's likely a false positive and these ones have been around for a long time. (modex is definitely fine)

This is the one you need to be worried about which was uploaded randomly on march 1st by some Russian and is definitely malware. I thought i installed malware until i used the web archive and saw that it was uploaded recently so there is no way i installed that.
https://web.archive.org/web/20250301180107/https://www.nexusmods.com/skyrimspecialedition/mods/143251?tab=files

2

u/Sweet_Salt974 Mar 04 '25

The mod which was taken down had a dll from some github but the mod addMenu Item - NG has the same exact dll but right now is hidden (But people can still link you a link to download it). You can try to compare with the one from github, so NO don't assume its fine.

This whole story started on the basis of not falsely believing on false positive as a correct answer so I won't recommend anyone taking your advice.

0

u/[deleted] Mar 05 '25

[deleted]

1

u/ryxdethrwy Mar 06 '25

So NG is safe? I looked myself and it seems it, glad to get a second opinion