How files are checked, and what that check does not prove
ModsDrop went live today. Every file page carries one line about scanning. It is a useful line, and it is easy to read more into it than it can carry, so here is what it actually means.
What VirusTotal is
VirusTotal is a scanning service owned by Google. You hand it a file and it runs that file past a large number of antivirus engines at once, from the well known names down to small vendors. It reports how many engines flagged the file and what each one called it.
So it is not one opinion. It is a pile of opinions collected in one place. That is its strength, and it is also its limit. None of it works out what a mod does to your game. It is signature matching and rules of thumb, run many times over.
What happens to a file here
When a file goes up it is sent to VirusTotal, as long as it is small enough to be accepted. The result is written onto the file page, next to the file name, the size, the upload date and the download count. You do not have to look it up yourself. The line is on the page before you press Download, and it tells you whether a scan happened at all.
The three lines you can see
| What the page says | What it means |
|---|---|
| Clean, with the number of engines | The file was scanned and no engine recognised anything in it. The number is how many engines looked at that file. |
| Too large to scan | The file is over VirusTotal’s 650 MB limit, so it was never scanned there. Nothing is known about it either way. |
| Not scanned yet | The file is up but no result has come back. Treat it the same as the line above. |
What “clean” means
Clean means one thing. At the moment of the scan, none of the engines that looked at the file recognised anything in it. That is worth knowing. It rules out what is already known and written into signature databases.
What “clean” does not mean
- A fresh file can be clean and still be unwanted. Engines match what they have seen before. Something written last week that nobody has reported yet has nothing to match against. Clean is a statement about the past, not a certificate for the future.
- Engines disagree with each other. A pile of scanners does not produce one verdict. The same file can be clean today and flagged next month because one vendor changed a rule.
- Mods trip false positives. If you scan a download yourself and see one or two detections, that is not proof of anything on its own. Script mods, .dll files, packed or obfuscated archives and self-extracting installers all trip heuristics that were written with other software in mind. A single detection with a vague name such as “generic trojan” can mean the engine matched a rule rather than a known sample.
- It says nothing about the mod itself. A scan cannot tell you whether a mod works, whether it matches your game version, whether it conflicts with the other mods you have installed, or whether it will wreck a save file. None of that is malware, and none of it shows up in a scan.
Files over 650 MB
VirusTotal will not accept a file above 650 MB. Some mods are bigger than that, usually maps and large packs. Those files cannot be scanned there at all.
When that happens, the page says so. It does not say clean, and it does not leave the line off and hope you miss the gap. If you download one of those, you are relying on your own scanner and your own judgement, and it is better to know that before you start rather than after.
What to do with this
- Read the scan line first. It is on the file page for that reason. Clean with a number is better than too large to scan, and it is fine to decide that a large unscanned file is not worth the risk to you.
- Scan the file yourself once it has downloaded. Do it before you install, not after. Read the result properly: one odd detection on a packed script is different from a long list of engines agreeing.
- Back up your saves before you install. Copy the game’s save or profile folder somewhere else. Most of the damage a mod does is not malicious, it is a broken save or a game that will not load, and a copy turns that into a small annoyance.
- Use the report form. There is one on every file page. If a file is broken, mislabelled, or behaves in a way it should not, tell me. Reports come to my inbox. For a copyright matter, use the DMCA page instead.
Why write this down
A tick printed on every page would mean nothing, because it would sit on the pages where a scan happened and on the pages where one did not. The alternative is to say plainly what was checked, what came back, and where the check runs out.
Not every file here is scanned, so the site does not claim it. ModsDrop went live today and has no track record to lean on, so an accurate description of the check is the one useful thing I can offer instead.
For the practical side of downloading, the guide covers the countdown, the download link and resuming a download that stopped. Anything else, use the contact page.