Higlac

Just got another email. We're sure that they didn't get access to the database?

No weird access logs on your databases? No chance that someone that does have access was hit by a rootkit? Because as far as I can tell they got my email address from someplace else. Nobody that knows the affected email downloaded anything today.

In your news post you said you couldn't get in contact with the owner of the compromised staff account, any update on that?

After further scanning and stuff, Avast sees it as a virus only when you try to run it, but not when you try to scan the .zip or .exe.

I've taken the initiative to boot up a virtual machine and check out the emailed file. Superantispyware and Avast are not flagging the downloaded file as a trojan. Malwarebytes, however does. Avast detects the file when you try to run it, but not when downloaded. So if you think you may have been hit with it, try malwarebytes first, then hit it with the rest of what you might want to run. PM me if you need/want links to good removal tools. What I do to clean PCs: 1. Combofix 2. disable system restore 3. Malwarebytes 4. Superantispyware 5. Avast boot-time scan 6. Avast full-system scan 7. re-enable system restore 8. run CCleaner to hit the registry and temp files 9. monitor for suspicious activity 10. If suspicious activity continues/ stuff comes back a. Run Malwarebytes Anti-Rootkit b. Continue from step 1.

You replied as I was editing. I'll check with my other gaming friends to see if they've been hit with this.

I am not on the Bethesda forums. Also, have there been any other reports of spam? Another edit: From what I'm seeing so far, Superantispyware and Avast are not flagging the downloaded file as a trojan. Malwarebytes, however does. So if you think you may have been hit with it, try malwarebytes first, then hit it with the rest of what you might want to run. What I do to clean PCs: 1. Combofix 2. disable system restore 3. Malwarebytes 4. Superantispyware 5. Avast boot-time scan 6. Avast full-system scan 7. re-enable system restore 8. run CCleaner to hit the registry and temp files 9. monitor for suspicious activity 10. If suspicious activity continues/ stuff comes back a. Run Malwarebytes Anti-Rootkit b. Continue from step 1.

Thanks for the quick response. I've got my VM going now to try to see exactly what this thing does. Let me know if you want the email source.

I got an email from Nexus sent from what looks like a French travel site (terresoubliees.com) via mailjet.com. It links to a download for a .zip of an .exe. The email started setting off alarms because I've never gotten an email from nexusmods, none of the links are in cleartext, and it links directly to a download. I'm not trusting it for now, so I've fired up a virtual machine to investigate. I'll update later after I finish downloading and installing Wine so I can run this .exe in a safe environment. Unless, of course, Nexus sends unsolicited emails from French addresses through a separate company? I'll update after investigation. If an admin/mod wants a copy of the email/download, then please PM me. Edit: Crashes when you try to run it in Wine, brb installing windows VM.

First, let me say that this site is a great resource and pretty damn awesome. But I've noticed that some things are broken. At least one mod has had it's download files swapped with other files. NMM isn't finding some mod's associated servers. --Edit: That seems to have resolved itself. The views counter on the forums is broken. My last issue is that I wish there was an option to have failed downloads continue automatically. Details here. Much thanks for the awesome site though.