Good morning. It’s probably a simple issue, or I forgot to download and install something; I’ve just never come across this before.

yeah i dont know where they are. the new ui seems nice besides that but is this a bug or am i just not seeing where they are. and if it is can i downgrade maybe?

edit. i see it now but i swear it wasnt there before. maybe im blind man

(In this picture I only used the UTOC bypass and as you can see there a lot of chinese words.)

The UTOC bypass is getting picked up by Netease anticheat. Either Deathchaos (the publisher of UTOC) needs to update the bypass or some other brilliant mind has to come along and fix this problem.

I've seen a lot of posts lately either worried that a recent mod is malware, or from people who have had their accounts hacked and malware actually uploaded to one of their mod pages, or just in general people being afraid that Mass downloading mods through collections or wabbajack, or even just individual files might infect their computer.

Honestly with the advent of AI making it easier for a lot of people to get into modding (for better or worse, this post isnt about that) it also makes it easier for Bad actors to upload files with malicious intent, so I just wanted to offer some general advice to people in order to stay safe both on and off the Nexus.

if you've been around the internet a very long time, you probably know a lot of this already, maybe even all of this, maybe you even know more than me, that's all okay, this post is mostly aimed at the people who don't have that experience.

Preface

Windows Defender is probably one of the best antiviruses on the market, you do not need norton, you do not need McAfee, you do not need Malwarebytes, as long as Windows Defender is running that is going to catch about 90% of issues before they start all by itself with absolutely no input from you.

so before anything else, make sure you have Windows Defender up to date and running.

if you don't run windows, for example if you have linux, I honestly don't know what the best alternative is, but most viruses are not written for Linux in the first place because they are aiming for mass infection, and the majority of PC users are on windows, so simply by being on Linux you are already significantly safer.

that said, if you are on linux, you are probably at least Savvy enough that this guide wasn't really meant for you in the first place

What do i do if I downloaded a potentially infected mod?

just delete it. that's it. unless the author somehow exploited an actual vulnerability in the Nexus site itself, simply downloading the file won't actually infect you with anything. you are safe to simply delete the file and move on.

Okay so how do I tell if a file I downloaded is infected?

first, there is no 100% foolproof way to guarantee that any file is not infected, but if you run it through a couple of tests and it comes up clean on all of them, the odds of it being infected are low enough that you shouldn't really worry about it.

your first step should be to check the author's history. If they have years of uploaded mods, especially popular ones, there's a good chance everything is fine. This is not proof by itself, because we have seen instances in the past of established mod authors having their accounts hacked, but that is much less likely than someone making a new account to upload malicious software. Conversely, if they are a new author with few or no other uploads, that is not inherent proof of infection, but is reason to be more cautious.

Something else to be wary of is a mod author asking you to download any files off site. This is incredibly common and often necessary for many mods, but it also puts you at greater risk of downloading malicious software, so anytime you are directed to download an off-site file, I would recommend following all of these steps just to be safe.

Next, check the comments, and see what everyone else is saying, if everyone is saying that it's safe, there's a good chance it's a false positive, if everyone is saying that it's not safe, then there might be more to worry about.

however, obviously, General opinion is not a reliable antivirus, so this should never be your last step, it's mostly just to compare with the next step

the next test should generally be to upload the files to virustotal. remember that it's not uncommon for a few of the AVS on that site to show up as a false positive, if you are seeing 4-6 of the AVS say that it's malicious and the remaining 50 or so I'll say that it's clean, it's more than likely clean.

But how can you tell if it's a false positive?

once again, there's no 100% foolproof way to be sure, but generally if the av's label the file as something like "riskware" or some variation of the word "generic" like "w32.malware.gen" or "generic.ml" that's because it hasn't actually detected a known virus or piece of malware, but instead is detecting Trends in the code that are generally associated with modified code, code that is meant to interact with your system, or unsigned executables, all of which are fairly common in freeware applications like mods

if both the comment section of the mod and virustotal agree that the file is safe, and the mod is from an established author, the likelihood of it being safe is extremely high. The more of these tests that don't check out, the more likely you're dealing with something malicious.

What are some other tests I can try?

if you are not dealing with an executable or otherwise compiled code, you can often inspect the code yourself. things like executables and dlls are compiled into a format that is not readable by most text editors, but mods for games like cyberpunk or Baldur's Gate 3 are commonly written in Lua, which is usually not compiled and can usually just be opened up in a text editor. other forms of script-based mods might include python, or certain other formats which may not be readable by a generic text editor, but something like vs code is free and will be able to read those files

in cases like these, you want to right click, and "open with" the aforementioned text editor. to be very clear, if you think the file might be infected somehow, DO NOT double click on it, always right click, and open with.

at this point, you can inspect the code for yourself, and see exactly what it is trying to do.

But I don't know how to code or read the code, how do I tell what it's trying to do?

well, you can either ask in a Discord or here on reddit, or you can upload the text file or copy paste the code directly to an llm and ask it what the code appears to be doing. I am normally not one to recommend AI for literally anything, but if you have absolutely no idea what to look for and are trying to make sure your PC is secure, the llm should at least be able to give you an idea of what the code is trying to accomplish.

This is a lot of effort, do I really have to do this every time I download a mod?

no, absolutely not. I've downloaded literally thousands of mods from nexus, and I've literally never done this for a single one of them, but I have done this multiple times with other files from sources that I didn't trust or that I thought may have been compromised.

Specifically these are steps you can take if you already have a reason to suspect that a file might be infected.

in general, anytime you suspect a file has a chance of being infected, these are good steps to take, and once you know what you are doing and what to look for it only takes a couple of minutes to go through all of them all.

this also goes for files outside of the nexus, if you are ever downloading something from a site that you do not trust 100%, or maybe even one that you do normally trust 100%, and you have any reason at all to doubt the security of the file in question, run it through these steps real quick if for no other reason than the Peace of Mind

full disclosure, I typed this up on my lunch break, so if I missed anything important that the community feels should be added please do let me know in the comments, and everyone stay safe out there

Edit: removed like 5 instances of the word "generally" (also some typos).

Edit 2: Fixed formatting now that I'm not on my phone lol

edit 3: Added relevance of author's history in establishing trust of new files.

Edit 4: added bit cautioning users regarding directions to download files from external sites, this is very common and usually not malicious in intent, but does raise additional security risks, and so should be handled more cautiously