Home Artists Posts Import Register

Content

While most of you probably already read about this on various Discords, there is a bit of a sh1t show that is making the rounds in the Sims modding community, as someone is spreading malicious scripts alongside fake mods/from hacked accounts, so look out for yourselves as this is some serious stuff!
 

UPDATE:
TwistedMexi released a new mod called 'ModGuard' that:
"Blocks common virus vectors, tracks the mod file that attempted to download it, notifies you, and shares the mod name with our team so compromised modder accounts can be notified as soon as possible."
Download link:
https://www.patreon.com/posts/98126153


Links outside of Discord covering the incident:
https://simsafterdark.com/malware-warning/
https://www.reddit.com/r/Sims4/comments/1akzieh/alert_malware_is_being_spread_through_ts4script/
https://answers.ea.com/t5/Mod-CC-Issues/CURRENT-ISSUE-Malicous-Script-Mods/td-p/13469910
https://scarletsrealm.com/malware-mod-information/
https://littlemssam.tumblr.com/


I will also quote the announcement that was made on the Sims After Dark discord server here:

Malware Update: What We Know Now
To recap, here are the mods we know for sure were affected by the recent malware outbreak:
"Cult Mod v2" uploaded to ModTheSims by PimpMySims (impostor account)
"Social Events - Unlimited Time" uploaded to CurseForge by MySims4 (single-use account)
"Weather and Forecast Cheat Menu" uploaded to The Sims Resource by MSQSIMS (hacked, real account)
"Seasons Cheats Menu" uploaded to The Sims Resource by MSQSIMS (hacked, real account)
"Motherlode Menu" uploaded to The Sims Resource by MSQSIMS (hacked, real account)
"Mood Cheat Menu" uploaded to The Sims Resource by MSQSIMS (hacked, real account)
"Mouth Preset N16" uploaded to The Sims Resource by PlayersWonderland (hacked, real account)


Due to this malware using an exe file, we believe that anyone using a Mac or Linux device is completely unaffected by this. 

If the exe file was downloaded and executed on your Windows device, it has likely stolen a vast amount of your data and saved passwords from your operating system, your internet browser (Chrome, Edge, Opera, Firefox, and more all affected), Discord, Steam, Telegram, and certain crypto wallets.

To quickly check if you have been compromised, press Windows + R on your keyboard to open the Run window. Enter %AppData%\Microsoft\Internet Explorer\UserData in the prompt and hit OK. This will open up the folder the malware was using. If there is a file in this folder called 'Updater .exe' or 'Main .exe', you have unfortunately fallen victim to the malware. We are unware at this time if the malware has any function which would delete the file at a later time to cover its tracks. 

To quickly remove the malware from your computer, Overwolf/CurseForge has put together a cleaner program to deal with it. This program should work even if you downloaded the malware outside of CurseForge. Download SimsVirusCleaner .exe from their github page linked here and run it. Once it has finished, it will give you an output about whether any files have been removed. 

Our bot, Bella Goth, has been updated to inform you if your LastException contains data which suggests you have been affected by the malware. If you do not believe you downloaded any of the affected mods, please alert our staff and we will help you determine the cause. 

If you think you may have been affected by any of these mods, it is vitally important that you change your passwords for all your important accounts as soon as possible. If your credit card information was stored on your computer or in any of your accounts linked to your passwords, you may need to contact your bank or credit card company to inform them your card number is not secure.

Comments

OzzyBlaze

Thanks Peco - I had no idea - Thankful it seems like I'm clear

Toni Hawthorne

Thanks so much. My computer seems to be okay.

Kendall Caminiti-Hess

I have the OLD versions from 2019-2020 for a few of them...thanks for the warning/update... EDIT: ran the "%AppData%\Microsoft\Internet Explorer\UserData" and thankfully I'm in the clear...KUDOS to you and everyone else who's helping out the community!