Have I been hacked by Vortex update???

[JimmineyCrikit]

I just clicked "restart & update" on Vortex and it immediately put my computer into a Windows Update (something it obviously should not be able to do).  It updated then restarted my computer.  Since this is very concerning, I immediately went to reset to the last update and Windows said it has been more than 10 days.  Even more concerning.

 Then, when I went to check my version before making this post, the Vortex app was completely gone.  Shortcut no longer working, folder no longer exists.

This was the update option from the notifications dropdown in the Vortex app itself which has apparently compromised my entire computer.  Since the normal methods of trying to secure my system are out the window, it seems the only option I have at this point is a complete system reset and to lose everything unless I want to continue with whatever compromised update has been pushed on my computer directly from the Vortex app.

Any help to avoid that would be appreciated.

[JimmineyCrikit]

It even corrupted unrelated data, like data from Steam games with no connection to Vortex

Edit:  It also has corrupted system files and "updated" AMD as well as my operating system.  This is 100% a massive security breach caused exclusively by Vortex

Edited October 14 by JimmineyCrikit

[Nagev]

Hi there - Vortex is an open source project https://github.com/Nexus-Mods/Vortex any sort of tampering in the official code will be immediately apparent to everyone using the software (over 100k daily users and developers).

Unless you have sourced the application outside of the Nexus Mods site/the official Github page, Vortex's functionality would never cause the issues you described.

Are you perhaps confused by the Fallout New Vegas sanity checks extension which mentioned you may need to update your AMD drivers for the game to function correctly?

[JimmineyCrikit]

7 hours ago, Nagev said:

Hi there - Vortex is an open source project https://github.com/Nexus-Mods/Vortex any sort of tampering in the official code will be immediately apparent to everyone using the software (over 100k daily users and developers).

Unless you have sourced the application outside of the Nexus Mods site/the official Github page, Vortex's functionality would never cause the issues you described.

Are you perhaps confused by the Fallout New Vegas sanity checks extension which mentioned you may need to update your AMD drivers for the game to function correctly?

 

Pretty certain.   Unless Vortex pushes said sanity checks through it's official notification system as a Vortex update.  It was the green notification in the notifications dropdown which tells you a (presumably) official update is available.  I even waited a week or two between when I first saw it and when I decided to click it.  Modding some games can get delicate and when things are working I don't like to screw anything up.  After I clicked it, it went straight into a Windows update.  One which Windows Update said did not happen.  There is no mistaking that screen, though.  You can't do anything else while it is running.  The AMD update runs differently and prompts you to restart from the desktop after the download has finished.

I've also received several system runtime type errors, "blue screen of death"..  resetting the drivers does not seem to have fully solved the issue.

It's extremely puzzling and troubling.  The only thing that makes sense to me is that a malicious update was allowed to be pushed through somehow.

I could be wrong, sure.  I just don't see how.  Also, Vortex completely nuking itself as a result is completely baffling in it's own right.  I didn't grab anything from offsite whatsoever.   I was updating the app, not a mod or anything.. it just doesn't seem realistic whatsoever that anything else could be responsible.

[Zanderat]

Have you run a full deep virus/malware scan on your pc?  You clearly have something going on that is unique to your system.

[Nagev]

Then I'm afraid we're at an impasse as I can guarantee that the official Vortex installer contains no malicious code whatsoever. As Zanderat mentioned, the issue is unique to your system. We've never had any reports of Vortex installing Windows updates/AMD drivers or anything of the sort. The recent update (I'm assuming you're using the 1.13.0-beta.3 release) would've never caused the issues you're describing.

On the other hand, Vortex "removing itself", has been encountered by users that were running the application through the Vortex installer itself rather than the application shortcut (causing it to re-install every time they would run the installer). Alternatively there have been instances where some cloud storage services would revert Vortex changes (removing the `%appdata%/vortex` folder); so if you do use any sort of cloud storage solution, make sure it knows to leave Vortex's data alone.

Please note that I can't rule out hardware failure, especially given that you're encountering BSOD.

Out of curiosity, which 3rd party extensions do you have installed?

[JimmineyCrikit]

Do you mean stuff like the GECK or FNVEdit? (xEdit?)  

Honestly I'm having a hard time remembering right now.  I haven't tried to reinstall Vortex yet.  I'm not looking forward to going through everything to make sure it all plays nice again.

I had those two for sure.. can't remember which others.  The LODGen one for sure.  Can't say if there were others but they were all pretty standard stuff.

[JimmineyCrikit]

On 10/16/2024 at 6:19 AM, Nagev said:

Then I'm afraid we're at an impasse as I can guarantee that the official Vortex installer contains no malicious code whatsoever. As Zanderat mentioned, the issue is unique to your system. We've never had any reports of Vortex installing Windows updates/AMD drivers or anything of the sort. The recent update (I'm assuming you're using the 1.13.0-beta.3 release) would've never caused the issues you're describing.

On the other hand, Vortex "removing itself", has been encountered by users that were running the application through the Vortex installer itself rather than the application shortcut (causing it to re-install every time they would run the installer). Alternatively there have been instances where some cloud storage services would revert Vortex changes (removing the `%appdata%/vortex` folder); so if you do use any sort of cloud storage solution, make sure it knows to leave Vortex's data alone.

Please note that I can't rule out hardware failure, especially given that you're encountering BSOD.

Out of curiosity, which 3rd party extensions do you have installed?

I don't know if you missed my response because I didn't quote.

Also, I'm assuming there's no way to recover the state of things before Vortex nuked?  It's always a tangled mess to make a large mod list work together.

[Nagev]

Hey - no I meant Vortex 3rd party extensions, game extensions, API extensions, etc. Can view which ones you have installed through the Extensions page inside Vortex.

Vortex's state is located separately from the actual application. State is stored in `%appdata%/vortex`, as long as you back that up alongside your mods and downloads you should be able to keep your data.

That being said, I can't guarantee that just re-installing Vortex would fix anything; it's more likely that your OS itself is corrupt in some way.

run `sfc /scannow` in a terminal window to give Windows a chance to fix itself.