is nexus virus?

[Azuwi]

ever since i registered on nexus and downloaded vortex and mods ive been keep logging out from websites for no reason and got a bunch of weird emails that says "xxx have attempted to login to this site, is this you?" blablabla

or does some skyrim mods contain viruses?

[smr1957]

Nexus is completely safe (or as completely safe as is humanly possible on the internet). There was one attempt some years ago to access their user base and it failed. However, due to that - out of an abundance of caution - they required everyone to change their passwords and required them to be longer and more complex. Also all files are scanned - accept for the largest, which are internally verified (and which is indicted on both the description page and the file download page and with a button to click on that gives the results of their scan). There were also literally just a couple of attempts by individuals to upload mods that contained malicious code, and they were immediately deleted before even being made available for download. But, just don't take my word for it (though I have personally downloaded well over 5,000 mods from them with never any issues), there is also this post from Ilja (in a discussion that specifically asked how safe Nexus was, and he mentions the cases that I was referring to):

"Nexus scans all files these days. I only recall two potential problems over several years.

Years ago someone used (apparently stolen) account password to change files from one of the mods. Old system didn't catch it immediately, due change being authorised. However, it only took few hours them to clear it out.

Nexus ramped their security further after that. Now all changes are scanned and they are using up to date scanner as well. Nexus has grown from that and has a lot of new resources to work with.

Someone just recently tried to upload malicious files to FO3 section of site. Files never got in to circulation. Scanner caught the data from upload and moderators banned the author outright - which points out that malicious data was uploaded intentionally and wasn't due to secondary infection.

Neither of these cases ended up being serious. First one is old and can't happen anymore. Second case was caught before files ended up being actually available."

https://steamcommunity.com/app/377160/discussions/0/2579854400748109343/#c2579854400748782287

And, just to add, in all my time being active in modding (over 15 years now), I have never once heard of a verified case of anyone getting a virus from anything downloaded from Nexus - not once.

Also, see the following:
https://techinfluence.net/is-nexus-mods-safe/
https://www.quora.com/Is-it-safe-to-get-mods-from-Nexus-mods

So anything is completely coincidental to you registering with Nexus and was gotten from some other website. Just run a complete virus scan on your PC to address the issue (and do not open any email unless you are absolutely sure it is from a legitimate source and is safe - email scams are quite common).

[smr1957]

Edited my post to a fuller explanation that I had previously posted in another thread.

[Azuwi]

Okay im new to modding but many of these mods link to 3rd party sites, could it have come from there?

Is it possible that mods contain links to (3rd party websites) that contain viruses?

[canoodle]

as safe as any other encrypted site, obvi if your password for nexus is the same for every other account one account gets hacked and they all do. Just change passwords to something secure and unique each time u get the emails...

[peppermint hollows]

Messaggio originale di Azuwi:

Okay im new to modding but many of these mods link to 3rd party sites, could it have come from there?

Is it possible that mods contain links to (3rd party websites) that contain viruses?

What mods are you looking at that link to 3rd party sites? Well, many mod creators use 3rd party sites where you can donate to them such as Patreon and Ko-fi but those sites are also safe, they shouldn't be linking to anything shady and I'm sure the site's strict moderation would prevent them from doing such.

[Azuwi]

Many of them are "plugins" saying that is required to use the mod.

Since im new to modding, i dont know all of the right terms, but keywords i remember was.

SKSE, SKSE64, Dlloader, Wrye bash, BethINI, SSEedit, MO2, TUDM, ENB, or ENF, Rudra, Enderal, UNP, UUNP, TRX, WIP, FOMAD, NMM, yes... it seems that skyrim modding is in a universe by itself.

I just think its odd it happening right now after I got into skyrim modding, I dont usually browse the web or visit unfamiliar websites, and the last time something simiilar to this happened was many years ago when I was a Csgo player and visited those "betting" sites that you can win/buy/sell/trade skins.

[Arondil]

Messaggio originale di Azuwi:

Okay im new to modding but many of these mods link to 3rd party sites, could it have come from there?

Is it possible that mods contain links to (3rd party websites) that contain viruses?

Sometimes mods have requirements from sites other than nexus.

Two examples for these are the Skyrim script extender (SKSE), and the Microsoft Visual C++ Redistributable for Visual Studio 2019.

In all these cases, you should use your own virus scanner to make sure your downloads are safe. (No-one ever thinks on their deathbed "Gee, I sure wish I hadn't scanned that download to protect my personal details and prevent my hard disk being encrypted in a ransom attack!")

Even for nexus you can download mod files manually, then scan them, then install them from your local downloads - although I admit I trust nexus' own virus scanner enough not to do that.

[Azuwi]

Messaggio originale di Arondil:

Messaggio originale di Azuwi:

Okay im new to modding but many of these mods link to 3rd party sites, could it have come from there?

Is it possible that mods contain links to (3rd party websites) that contain viruses?

Sometimes mods have requirements from sites other than nexus.

Two examples for these are the Skyrim script extender (SKSE), and the Microsoft Visual C++ Redistributable for Visual Studio 2019.

In all these cases, you should use your own virus scanner to make sure your downloads are safe. (No-one ever thinks on their deathbed "Gee, I sure wish I hadn't scanned that download to protect my personal details and prevent my hard disk being encrypted in a ransom attack!")

Even for nexus you can download mod files manually, then scan them, then install them from your local downloads - although I admit I trust nexus' own virus scanner enough not to do that.

Isn't Microsoft Visual C++ installed by default in Windows (10+) or atleast being used by many other games on Steam or programs? I can remember I see that Microsoft visual c++ is being installed screen on many games I installed on Steam, and shouldn't it be an default standard application your pc would have if it's not a brand new windows install PC where you have nothing on it but skyrim?

[CEPHY]

The only third-party links you should find on Nexus are to things like official microsoft software (.net framework and the like) and SKSE, which is the script extender - and is also perfectly safe.

[Azuwi]

Messaggio originale di CEPHY:

The only third-party links you should find on Nexus are to things like official microsoft software (.net framework and the like) and SKSE, which is the script extender - and is also perfectly safe.

The script extender on steam doesn't work?

[alexander_dougherty]

Messaggio originale di Azuwi:

Messaggio originale di CEPHY:

The only third-party links you should find on Nexus are to things like official microsoft software (.net framework and the like) and SKSE, which is the script extender - and is also perfectly safe.

The script extender on steam doesn't work?

It's not updated regularly I believe.

Best to get it directly from the Silverlock website

[smr1957]

Messaggio originale di Azuwi:

Messaggio originale di CEPHY:

The only third-party links you should find on Nexus are to things like official microsoft software (.net framework and the like) and SKSE, which is the script extender - and is also perfectly safe.

The script extender on steam doesn't work?

That is only for Oldrim, not SSE. And even for Oldrim it is not recommended to use it, but to get SKSE direct from the site: https://skse.silverlock.org/

Ninja'd!

[Rez Elwin]

I'll add that I have been using the Nexus for nearly 10 years on several games. Never once got a Virus or even the warning of a Virus from any download.

[Lady Aeleanor]

Alexander and smr1957 are correct. Go directly to the Silverlock site to get the script extender.

[jreese46]

In addition to what the others have said, about getting the visual studio stuff directly from microsoft and SKSE directly from silverlock, most of the other things you'll see linked or set as a prerequisite on nexus are other nexus mods (ie: xedit, SSE Engine Fixes, etc.) so you don't have to leave nexus to get them, though you may commonly see notes that the newest pre-release is available on github or whatever. You don't need to follow those, and it's often better to stick with the full releases anyway. One thing I wanted to mention, that I think will be pertinent for a while, is afkmods.com, which is the home site of the Unofficial Skyrim Special Edition Patch author, and where the most up to date versions of those mods are hosted now. You may see that come up from time to time.

If you want to be abundantly cautious, look at the series of numbers at the end of the url, for example the 266 on this one.

https://www.nexusmods.com/skyrimspecialedition/mods/266/

If you are hesitant to click on a link, you can go directly to nexus, go to the Skyrim Special Edition section, open any mod you like and change those last numbers to whatever appears in the link, so you get to see the same file without having to click the link at all.

When you go to download a nexus mod, click on the files tab and click on the little circle next to the file name. Most commonly those are green, to tell you the file is safe, but sometimes they are blue or white, if the file is internally verified due to size, or is just too big to scan. If it has been scanned (green) you can click on it, and it will take you to virus total, where you can see the results of all 50+ antiviruses used to scan it. Occasionally one or two will get a false positive, but I have never seen one turn out to be an actual virus. Of course, there is no red circle, as those mods would not be made accessible as soon as they failed the scan.

You can use the same service, by going to virustotal.com and pasting a URL or placing a file in it, and waiting a moment while all the scanners do their work. Once you've downloaded a mod, you can also scan it with your own antivirus, microsoft defender, malwarebytes, etc., before opening or extracting anything from the archive.