Virus Scanning at Nexus Mods

All content uploaded to Nexus Mods goes through multiple security checks and a virus scan process before being made available to download. Files that file any of these checks are placed into a quarantined state and require manual review by a moderator or Community Manager before being unlocked. Users can see the security status of a file by looking for the indicator next to each file in the "Files" tab.

File status on Nexus Mods

When viewing a mod page, the "Files" tab will give details on all mod files that have been shared. Each entry in the files list will feature a badge next to the title indicating the security/virus scan status.

Badge Type	Description
Green Checkmark	This file has passed both our internal security checks and a VirusTotal scan. You can review the VirusTotal report by clicking on the checkmark icon.
Blue Checkmark	This file has passed our internal security checks but was not able to be scanned by VirusTotal.
White Checkmark	This file has not been security scanned. This status most often appears on very old files that were uploaded before we implemented stricter security checks.
Yellow Question Mark	The file is still running through our security scans and is unavailable to download. Check back later to see if the status has been updated.
Red Cross	This file has failed our security scans or has a significant number of positives in the VirusTotal scan. It will need to be reviewed by a moderator to determine if it is safe to download. *Note:* This doesn't automatically mean the file is malicious, just that it requires closer inspection.

My PC has flagged a download as a virus. Should I report it?

Anti-virus programs sometimes flag mod files as malware because the mods may contain code or behaviours similar to actual threats. This can happen because mods might use techniques common in malware or have unusual file structures. Anti-virus programs can also mistake harmless mod behaviours for suspicious activity. To reduce false positives, it's important for anti-virus companies to refine their detection methods and for users to report any mistakes.

If you're concerned about a file you've downloaded, you can check the security scan status (detailed above) and look at the number of downloads, endorsements and how long a mod has been available to make a sensible call on how likely the file is to actually be malicious.

For example, if your PC flags a file that has been downloaded by 2 million users, has 200,000 endorsements and has been available on Nexus Mods for over 5 years it's very, very unlikely that the file is actually malicious.

In contrast, if a mod file has only just been uploaded and it's by a user who only registered a short time before posting it, there is a more likely chance that the file could contain malware. However, in this case, our security scans are likely to have picked up any known malicious patterns and quarantined the file.