I Got a Virus from Nexus?

[Arshaka]

I've got a bit of a story, strap in if you want to know, etc.

TL,DR: I got a virus, probably from a Nexus download, and I don't know how to check (for sure) or what to do with the information.

 

I launch my most recent save file, having made no changes to my skyrim files (or any files at all) between saving it and now loading it. Skyrim pops up the "This save is missing content. Load anyway?" I forget the specifics to quote it. Anyway, this confuses the hell out of me. Having some experience with this sort of problem (I helped a friend troubleshoot what turned out to be his antivirus deleting d3d9.dll), I check my antivirus (Windows Defender). Lo and behold, it quarantined a file between my saving the game and loading it. This is where I freak out a bit and just delete the thing without much thought. It was a trojan, named something about four letters long with a period in the middle. What I'm figuring what happened is, when I downloaded The Huntsman (only mod today), it came with a Trojan. The issue is, I've checked my Huntsman files in my Skyrim folder versus my backup and the compressed download, and they all match exactly.

 

So it doesn't look much like The Huntsman came with a virus. However, I haven't downloaded anything from a site that isn't Nexus in over a month. Past that, the only downloads I've done in maybe the past six months have been image files or from Nexus (or linked from Nexus, a bit like what Climates of Tamriel does). And, I think a Trojan virus only gets disseminated by downloads (or opening email attachments, but that is not a concern in this case). So, it's likely I downloaded what Windows Defender strongly thinks is a virus from Nexus.

 

If I did download a virus from nexus, what do I do? Do I contact Nexus and tell them? Or do I try and figure out what download it was? How would I even go about that, once it's deleted?

 

Am I missing something? I know there's a chance that I got this from something that wasn't a download or an attachment, but my internet usage has been really laid back recently, so I'm figuring that's not part of the picture. Knowing me, I'm assuming something to be true when it isn't, and I've constructed an entire story out of it. Thanks for reading, and I'd appreciate any thoughts.

[Arshaka]

Here's a more technical question. In order for Skyrim to be able to tell if it's missing content required for a save to work, I'd guess it has some sort of list or registry of what the save has in it. If I can get at that list on the save, and the one I made by loading anyway and saving right after, I could find out what file exactly was deleted. I could then find what mod it's from, and download the mod again to see if it recurs. But I'm totally clueless about how to access such a registry, or even if it exists.

[IsharaMeradin]

When Skyrim loads a save file it looks at its master list of ESM and ESP files and compares that to the currently loaded list of ESM and ESP files. If one or more are missing, you get the warning that content is missing and are asked if you want to proceed or not.

 

In order to determine what ESM and ESP files comprise the master list for a particular save file, you can use Wrye Bash (WB). It will list all of the plugins and in the expected load order. WB even color codes the plugins so that you can tell at a glance if your current load order lacks plugins, has additional plugins, and/or has plugins listed in a different order.

[Arshaka]

TL,DR: The deleted file is called 'mantle of he.esp' and I don't know what it's from

 

Using the window Current Load Order under the saves tab (being overspecific because I'm unfamiliar with Wrye Bash), the file which was deleted appears to be named "mantle of he.esp". It appeared in an about two hour stretch of play, itself about three hours after installing The Huntsman. In-game, that stretch of time involves me taking a carriage to Riften from Whiterun, getting distracted, and walking back to Ivarstead. I also looked at a couple of the armors from Immersive Armors (not important, likely, but there was a mantle in there). I have no idea what this esp is from, and it confuses me how it appears to have propagated itself during gameplay. When I search my backups for the phrase "of he", I get the Shrine of Heroes from the mod Familiar Faces. I know it uses some papyrus utilities not implemented by the game itself, and it's been having trouble with my game files, perhaps that's it? In any case, at least my save files aren't corrupted and the major gameplay elements seem intact. Unless there's a way to identify the source of the file which I don't know (not too unlikely, this is not my comfort zone), I'm just going to leave it.

 

Thanks!

Edited May 26, 2016 by Arshaka