NOTE: This early 2024 episode is no longer current, but this thread is left here for reference.
Beginning as early as mid-January 2024, we began seeing Sims 4 script mods with malicious executable .exe code hidden in them.
The mods masqueraded as being from existing creators or from a brand-new creator with a name similar to an existing one. In one known case, it appears that a creator’s account was hacked to update the creator’s own mod page. These mods also presented themselves as being previously existing mods. (Mac users: Because this is .exe code, it won’t affect you, but may produce LEs.)
Mods known to have been compromised
If you have these mods, remove them:
- "PimpMySims4" (impersonated) – Cult Mod – was on Mod the Sims
- MySims4 – "Social Events - Unlimited Time" – was on Curseforge
- MSQSims (hacked) – on The Sims Resource, Feb. 5-8
- Mood Cheat Menu
- Motherlode Menu
- Seasons Cheat Menu
- Weather Forecast Cheat Menu
- PlayersWonderland (hacked) – Mouth Preset N16 ts4script file – on The Sims Resource, removed Feb. 8
- V1 of an adult mod, with a January file date – on LoversLab
NOTE: There may well be other compromised script mods out there. As they are found, they will be added to this list.
UPDATE: No other were found as of July 2024
How to check your system
To see if your system has been affected by the malicious code:
- select Windows-R
- In the window that opens, type this:
%AppData%\Microsoft\Internet Explorer\UserData
- In the folder that opens, look for files called Updater.exe and/or Main.exe.
If you are affected
If you had one of these files, assume that any sensitive data on your PC may be compromised and take the steps below:
- Clear your system for this specific virus. (See below.) This must be done FIRST.
- If you have the Discord app or a cryptocurrency wallet app, uninstall them. This is important if not obvious: Starting these can trigger an attempt to reinstall this malware.
- Change your passwords.
- Add two-factor authentication where available.
- If you had saved credit card or similar information to a web browser, remove it and find out from your financial institution (or other relevant site) what action to take next.
- Reinstall Discord and cryptocurrency wallet apps from fresh downloads.
- Learn more about keeping your data secure in the future: https://answers.ea.com/t5/EA-Services-General-Questions/Answers-HQ-Online-Security-Newsletter-Januar...
To clear your system:
- Download this fix created by Maxis mod-host partner Curseforge: SimsVirusCleaner
- Double-click the SimsVirusCleaner.exe file in your Downloads folder tor run it.
- This is a good time to run a general virus/malware scan on your computer.
More things to know
- M
od “Updated” and “Cleared” news is currently delayed. When they return in full, there may be additional suggested steps.
- Curseforge and The Sims Resource have updated their file screening for this method of malware inclusion.
- Safest mods during this episode: The least likely mods to be affected by this are mods that are only .package files and mods uploaded by mod creators on Patreon or their own sites.
- ts4script files: Most Sims 4 mods are not script mods and aren’t doing anything requiring a ts4script file. Those are needed by mods that affect gameplay. If you’re downloading CC, look for ts4script files. Do not put them in your Mods folder. Report the CC that included it.
- downloaded folders: Assume that any folder containing a collection of mods might include a compromised mod containing code that can steal your passwords, your banking info, and much more. Do NOT download and install these collections. If you have done so at any time since mid-January, check your system.
- New prevention/detection Sims 4 tool: TwistedMexi has released a tool called ModGuard.
NEW: Other Malware in "Mods"
[April 7, 2024] Malware via a mod that is downloaded as only a text file with a link.
Known cases:
- "S4 CAS Tools" on Nexus from user fubruss (the real mod is on Mod the Sims, from the late CmarNYC, dated 18 March 2023)
- “Loading Screen Randomizer” on Nexus from user fubruss (the real mod is on Mod the Sims, from Tesuto , dated 9 January 2024)
Do NOT follow the links in the text files. Do NOT download other files or follow links from this user. No legitimate mod download will EVER consist of only a text file (a file ending in .txt).
If you downloaded either of these, delete them NOW and run a virus scan. NOTE: This malware does NOT require that you run the game for it to install itself, and is not what ModGuard is designed to detect and stop.
[updated July 23, 2024]
Sul sul!
I don't work for EA, and I don't do private support.
I do receive products from EA as part of the EA Creator Network.
Have you backed up your Saves? Checked for broken and updated mods/CC?
