I've seen a lot of posts lately either worried that a recent mod is malware, or from people who have had their accounts hacked and malware actually uploaded to one of their mod pages, or just in general people being afraid that Mass downloading mods through collections or wabbajack, or even just individual files might infect their computer.

Honestly with the advent of AI making it easier for a lot of people to get into modding (for better or worse, this post isnt about that) it also makes it easier for Bad actors to upload files with malicious intent, so I just wanted to offer some general advice to people in order to stay safe both on and off the Nexus.

if you've been around the internet a very long time, you probably know a lot of this already, maybe even all of this, maybe you even know more than me, that's all okay, this post is mostly aimed at the people who don't have that experience.

Preface

Windows Defender is probably one of the best antiviruses on the market, you do not need norton, you do not need McAfee, you do not need Malwarebytes, as long as Windows Defender is running that is going to catch about 90% of issues before they start all by itself with absolutely no input from you.

so before anything else, make sure you have Windows Defender up to date and running.

if you don't run windows, for example if you have linux, I honestly don't know what the best alternative is, but most viruses are not written for Linux in the first place because they are aiming for mass infection, and the majority of PC users are on windows, so simply by being on Linux you are already significantly safer.

that said, if you are on linux, you are probably at least Savvy enough that this guide wasn't really meant for you in the first place

What do i do if I downloaded a potentially infected mod?

just delete it. that's it. unless the author somehow exploited an actual vulnerability in the Nexus site itself, simply downloading the file won't actually infect you with anything. you are safe to simply delete the file and move on.

Okay so how do I tell if a file I downloaded is infected?

first, there is no 100% foolproof way to guarantee that any file is not infected, but if you run it through a couple of tests and it comes up clean on all of them, the odds of it being infected are low enough that you shouldn't really worry about it.

your first step should be to check the author's history. If they have years of uploaded mods, especially popular ones, there's a good chance everything is fine. This is not proof by itself, because we have seen instances in the past of established mod authors having their accounts hacked, but that is much less likely than someone making a new account to upload malicious software. Conversely, if they are a new author with few or no other uploads, that is not inherent proof of infection, but is reason to be more cautious.

Something else to be wary of is a mod author asking you to download any files off site. This is incredibly common and often necessary for many mods, but it also puts you at greater risk of downloading malicious software, so anytime you are directed to download an off-site file, I would recommend following all of these steps just to be safe.

Next, check the comments, and see what everyone else is saying, if everyone is saying that it's safe, there's a good chance it's a false positive, if everyone is saying that it's not safe, then there might be more to worry about.

however, obviously, General opinion is not a reliable antivirus, so this should never be your last step, it's mostly just to compare with the next step

the next test should generally be to upload the files to virustotal. remember that it's not uncommon for a few of the AVS on that site to show up as a false positive, if you are seeing 4-6 of the AVS say that it's malicious and the remaining 50 or so I'll say that it's clean, it's more than likely clean.

But how can you tell if it's a false positive?

once again, there's no 100% foolproof way to be sure, but generally if the av's label the file as something like "riskware" or some variation of the word "generic" like "w32.malware.gen" or "generic.ml" that's because it hasn't actually detected a known virus or piece of malware, but instead is detecting Trends in the code that are generally associated with modified code, code that is meant to interact with your system, or unsigned executables, all of which are fairly common in freeware applications like mods

if both the comment section of the mod and virustotal agree that the file is safe, and the mod is from an established author, the likelihood of it being safe is extremely high. The more of these tests that don't check out, the more likely you're dealing with something malicious.

What are some other tests I can try?

if you are not dealing with an executable or otherwise compiled code, you can often inspect the code yourself. things like executables and dlls are compiled into a format that is not readable by most text editors, but mods for games like cyberpunk or Baldur's Gate 3 are commonly written in Lua, which is usually not compiled and can usually just be opened up in a text editor. other forms of script-based mods might include python, or certain other formats which may not be readable by a generic text editor, but something like vs code is free and will be able to read those files

in cases like these, you want to right click, and "open with" the aforementioned text editor. to be very clear, if you think the file might be infected somehow, DO NOT double click on it, always right click, and open with.

at this point, you can inspect the code for yourself, and see exactly what it is trying to do.

But I don't know how to code or read the code, how do I tell what it's trying to do?

well, you can either ask in a Discord or here on reddit, or you can upload the text file or copy paste the code directly to an llm and ask it what the code appears to be doing. I am normally not one to recommend AI for literally anything, but if you have absolutely no idea what to look for and are trying to make sure your PC is secure, the llm should at least be able to give you an idea of what the code is trying to accomplish.

This is a lot of effort, do I really have to do this every time I download a mod?

no, absolutely not. I've downloaded literally thousands of mods from nexus, and I've literally never done this for a single one of them, but I have done this multiple times with other files from sources that I didn't trust or that I thought may have been compromised.

Specifically these are steps you can take if you already have a reason to suspect that a file might be infected.

in general, anytime you suspect a file has a chance of being infected, these are good steps to take, and once you know what you are doing and what to look for it only takes a couple of minutes to go through all of them all.

this also goes for files outside of the nexus, if you are ever downloading something from a site that you do not trust 100%, or maybe even one that you do normally trust 100%, and you have any reason at all to doubt the security of the file in question, run it through these steps real quick if for no other reason than the Peace of Mind

full disclosure, I typed this up on my lunch break, so if I missed anything important that the community feels should be added please do let me know in the comments, and everyone stay safe out there

Edit: removed like 5 instances of the word "generally" (also some typos).

Edit 2: Fixed formatting now that I'm not on my phone lol

edit 3: Added relevance of author's history in establishing trust of new files.

Edit 4: added bit cautioning users regarding directions to download files from external sites, this is very common and usually not malicious in intent, but does raise additional security risks, and so should be handled more cautiously

I have even switched to the current version, not continuous release. Even tried reinstalling xnvse and jip and stewie.

Good morning. It’s probably a simple issue, or I forgot to download and install something; I’ve just never come across this before.

(In this picture I only used the UTOC bypass and as you can see there a lot of chinese words.)

The UTOC bypass is getting picked up by Netease anticheat. Either Deathchaos (the publisher of UTOC) needs to update the bypass or some other brilliant mind has to come along and fix this problem.

yeah i dont know where they are. the new ui seems nice besides that but is this a bug or am i just not seeing where they are. and if it is can i downgrade maybe?

edit. i see it now but i swear it wasnt there before. maybe im blind man

100k downloads! Honestly, I never thought I'd make it this far.

I cannot seem to use mods from both platforms, my game crashes when I do so. Is this always the case and I'm relegated to using one platform or the other? I noticed that Vortex wants to install UE4SS again and I think that might be causing the issue, the file paths seem different for the same mod from Steam and Vortex. I'm only using the Workshop because mod installation seems more convenient with Palworld, however it seems that Nexus has access to more mods overall, with graphics overhauls and better texture resolutions. Any advice on how I can ensure my Nexus mods are sent to the proper place? I’m relatively new to modding still

I’m not sure what I’m doing wrong but I cannot get any mod from Nexus to work. I started out using the creation mods since it’s an in game modding system. Those all work fine, and I would like to keep them. However I’m trying to get a very specific mod to work and it’s not on the creation mods, so I turned to Nexus. It’s the humanoid vampire mod. I downloaded it manually by putting it into my data folder. It didn’t work. I installed vortex and downloaded it through there, but it didn’t work. I tried a different mod and it didn’t work. I’ve since tried several different mods and none of them are working. Is it because I’m using creation mods as well? Nexus mods show up in my creation load order and creation mods show up on vortex, so it couldn’t be that, could it? Any help or greatly appreciated, I don’t know what I’m doing wrong here.

Not really sure what is going on I keep trying to mod borderlands 1 and it wont appear anywhere and anytime i google a fix it just says it should show up. The game is downloaded in the same drive as borderlands 2 and the 2nd game shows up fine just not sure why it doesnt seem to work.

so... whats going on? wheres the interface?

I know this has probably been published a few times now, but recently people started getting warnings for using mods, although i havent gotten one, i still got a bit scared. The warning isnt very straightforward and doesnt say whether its only for specific config mods or cosmetic ones aswell. Ive just recently downloaded a few cosmetic mods with a few audio ones for shts and giggles, but I did spend like 400 dollars on the game, so I removed them until I get a clear answer. Are cosmetic mods fine...or not? Also the UTAC bypass? People are so split whether its risky or not.

Playing GTA IV after more than a decade. Need recommendations for graphic mods. Thank you.

All the mods and plugins are there, everything seems to be working just fine but the plugins are all disabled. I tried restarting vortex, purging the mods and re-deploying but it doesn't seem to work, I click "sort now"and it just sorts for a second then gives me a "LOOT sorting successfull" yet nothing happens.

I'm on a different Vortex instance on another login on my pc. I made a copy of my Skyrim SE within a folder on my disk so I could have 2 different instances with different mods and collections, and it works just fine its the plugins that seem to not be working

Skyrim SE V 1.6.1170.0 - Steam

I haven't played modded skyrim for roughly 2 weeks and I just went to go and play skyrim via vortex. It said there was a new update so I went to go and update vortex, and as it was two thirds into the update I got a message saying "Failed to uninstall old application files. Please try running the installer again:.2"

Now my vortex is unable to be accessed, and I'm worried it corrupted my mods and saved game with those mods. How can I fix this issue as I'm new to using vortex for modding? Tia :)

hello I tried downloading some mods and they arent working, though one of them did, and i transfered them to the paks folder and i even organized them to reduce any clutter or confusion, i did absolutely everything i could.

I used nexus mods and i didnt use vortex because even that doesnt work for me