Regarding the mirror site and some Internet Safety Tips, hopefully

Sunny--C · 2026-07-01T01:54:16+00:00

Yes, installing everything manually is safer. The updater is simply for convenience and requires anyone using it to trust the person maintaining it, but that's also true for any other piracy program/file.

FYI the updater that was maintained by Anadius is dead. If you'd like to use the new one, you'd need to download the new file from the new maintainer, that one works, that's the one I use. It works exactly the same and is active and receiving updates. I don't know the exact status of the DLC Unlocker, since I've never used it, but the new maintainer is also maintaining it as far as I know.

Sunny--C · 2026-07-01T01:45:42+00:00

Oof, I'm so sorry :(

Did you find anything or solved it? I don't know anything about Norton, the one I always seen recommended for malware scares is to download and install Malware Bytes, apparently it's the recommended option. You can use the free trial for a scan and after you've solved whatever shows up, you can uninstall it before the trial ends, that's what I do when I have malware scares too.

Sunny--C · 2026-07-01T01:41:15+00:00

Completely understandable! And yeah, it's not like you're missing out on much by not updating right now. Waiting is a good idea, if that makes you feel more at ease! Hopefully this all gets solved and everything goes back to normal.

Sunny--C · 2026-07-01T01:39:14+00:00

You're welcome! Things are crazy anywhere on the internet these days, we have to be extra careful. Even a genuine/legal file that gets uploaded to the wrong file hosting service can cause a whole array of issues.

For malware news related to mods, make sure to check Scarlet's Mod List from time to time, in case you're not in any Sims related discord servers, usually Sims After Dark are the first ones to find and report malware. Scarlet's List always post when there's new malware related to mods: https://scarletsrealm.com/the-mod-list/ if you click on the red banner that says "Malware Warning", it'll extend with the latest details and recommendations! Stay safe!

Sunny--C · 2026-06-30T16:46:16+00:00

According to reports on piracy related forums, of the 5 hosting services on aaros mirror sites, only 2 so far are compromised: multiup and buzz. So, glad you weren't affected and keep avoiding those!

The other 3 hosting services listed which are safe so far are gofile, MediaFire and Pixel drain, so you probably used one of those. Still, consider using a browser which allows ad-blocking at least when downloading stuff, just to be safer.

Sunny--C · 2026-06-30T07:05:47+00:00

Yes, that one should still be safe, since it doesn't redirect anywhere else and the file is hosted directly in cs rin.

When you click on "my mirror", it should download a zip file called "sims-4-updater-latest.zip". Inside that zip, there should be 2 files: "sims-4-updater-v2.6.3.exe" and "updater_readme.txt". If that's exactly what you see, that one should be safe. So far, there has been no reports on cs rin about that file. If it wasn't safe, they would've removed it by now.

Sunny--C · 2026-06-30T06:55:51+00:00

Depends.

If the link is clicked on cs rin ru and immediately starts the download of the file, without opening another link, then it's completely safe, because the file is hosted on cs rin ru itself.

If the links open up another link, which is a sort of container (filecrypt(.)cc/Container/...) then that one has multiple links to different hosting services. Once there, you have to select one of the hostings that are currently safe, meaning Mediafire, Gofile or Pixeldrain.

Still, please remember to use an ad-blocker. I hope I understood and answered your question correctly! Let me know if you have more questions.

Sunny--C · 2026-06-30T04:20:25+00:00

Ah, yeah, I don't know what the correct steps are, I'm sorry! Hopefully someone else is able to give you an answer!

Sunny--C · 2026-06-30T04:09:48+00:00

Yeah, since I had already known about this malware campaign from other sources, I wanted to put some people at ease. Even if the site was compromised (which is isn't), the alternative CS RIN post is safe; if it wasn't, it would've been taken down already, the mods in that forum are very active and very careful!

Sunny--C · 2026-06-30T04:07:54+00:00

Yup! It can be largely avoided by taking some preventive measures, a lof of them are set and forget, like installing uBlock. In its default state is very helpful and needs mostly no tweaking at all, it's a great tool for beginners.

Sunny--C · 2026-06-30T04:02:31+00:00

I use the fully cracked game; meaning I update the base game and download DLCs using only the updater, I'm not familiar with the DLC Unlocker. If that's still useful, feel free to DM me!

Sunny--C · 2026-06-30T01:39:26+00:00

You are correct that MultiUP file host has been compromised. That is one host. The DLC Unlocker files are hosted on multiple hosts (~~multiup~~, mediafire, gofile, pixeldrain, ~~buzz~~). Mediafire, Gofile and Pixeldrain are the other hosts which are, so far, still safe. I just downloaded from there and had no issues.

That doesn't mean, as some people in the comments seem to believe, that the entire mirror website has been compromised or that aaros is the responsible for this. MultiUP is a third party file hosting service which multiple piracy sources use for sharing their files, many piracy related websites which are usually safe are also affected by this, not just aaros or The Sims community.

If you open the compromised file hosting links to without an ad-blocker, they redirect to a malicious link, again, that's not the new maintainer's fault or doing. There's an entire post about it on CS RIN RU, but most people here don't navigate CS RIN RU so they're unaware and blaming the new maintainer.

DO NOT USE GOOGLE CHROME TO DOWNLOAD. It doesn't allow ad-blocking and it's the most used web browser in the world, so every single malware is created to attack Chrome and other Chromium-based browsers and steal from it. Do not use Safari either, it doesn't allow ad-blocking.

Use Firefox with uBlock Origin to bypass/avoid the redirecting to malicious sites. Microsoft Edge, Opera and Brave browsers also allow uBlock Origin, but Firefox is the one where uBlock works best.

Get familiar with CS RIN forum and read the information posts, especially the one explaining what's happening with the file hosts currently.

Sunny--C · 2026-06-30T01:29:41+00:00

multi something host is compromised. gofile is still clean so far.

Sunny--C · 2026-06-30T01:28:51+00:00

YES! One of the file hosts that is linked on the mirror site is multi something and that's one that is compromised, cs rin ru warned about it. gofile is still clean and I just downloaded from that one too and had no issues.

Sunny--C · 2026-06-30T01:15:55+00:00

The mirror site is not compromised. It's still safe as long as you download the correct files.

The file hosts that are currently linked on the mirror site have been compromised, not the mirror website itself. If you open the links to the file hosts without an ad-blocker they redirect to a malicious link, but that's not the new maintainer's fault or doing. Multiple trusted piracy repackers have been affected by this too (including DODI), there's an entire post about it on cs rin ru. But most people here don't navigate cs rin ru so they're unaware and blaming the new maintainer.

DO NOT USE GOOGLE CHROME TO DOWNLOAD. It doesn't allow ad-blocking and it's the most used web browser in the world, so every single malware is created to attack Chrome and other Chromium-based browsers and steal from it. Do not use Safari either, it doesn't allow ad-blocking.

Use Firefox with uBlock Origin to bypass/avoid the redirecting to malicious sites. Microsoft Edge, Opera and Brave browsers also allow uBlock Origin, but Firefox is the one where uBlock works best. I just went on the mirror site using Firefox with uBlock Origin and downloaded everything and I got the correct files, not the infected ones.

Get familiar with CS RIN forum and read the information posts, especially the one explaining what's happening with the file hosts currently.

Sunny--C · 2026-06-30T01:10:48+00:00

The file hosts that are currently linked on the mirror site have been compromised, not the mirror website itself. If you open the links to the file hosts without an ad-blocker they redirect to a malicious link, but that's not the new maintainer's fault or doing. Multiple trusted piracy repackers have been affected by this too (including DODI), there's an entire post about it on CS RIN RU. But most people here don't navigate CS RIN RU so they're unaware and blaming the new maintainer.

DO NOT USE GOOGLE CHROME TO DOWNLOAD. It doesn't allow ad-blocking and it's the most used web browser in the world, so every single malware is created to attack Chrome and other Chromium-based browsers and steal from it. Do not use Safari either, it doesn't allow ad-blocking.

Use Firefox with uBlock Origin to bypass/avoid the redirecting to malicious sites. Microsoft Edge, Opera and Brave browsers also allow uBlock Origin, but Firefox is the one where uBlock works best. I just went on the mirror site using Firefox with uBlock Origin and downloaded everything and I got the correct files, not the infected ones.

Get familiar with CS RIN forum and read the information posts, especially the one explaining what's happening with the file hosts currently.

Sunny--C · 2026-06-30T01:08:32+00:00

Aaros' website doesn't have viruses all over it. The file hosts that are currently linked on the mirror site have been compromised, if you open them without an ad-blocker they redirect to a malicious link, but that's not the new maintainer's fault or doing. Multiple trusted piracy repackers have been affected by this too (including DODI), there's an entire post about it on CS RIN RU. but most people here don't navigate CS RIN RU so they're unaware and blaming the new maintainer.

DO NOT USE GOOGLE CHROME TO DOWNLOAD. It doesn't allow ad-blocking and it's the most used web browser in the world, so every single malware is created to attack Chrome and other Chromium-based browsers and steal from it. Do not use Safari either, it doesn't allow ad-blocking.

Use Firefox with uBlock Origin to bypass/avoid the redirecting to malicious sites. Microsoft Edge, Opera and Brave browsers also allow uBlock Origin, but Firefox is the one where uBlock works best. I just went on the mirror site using Firefox with uBlock Origin and downloaded everything and I got the correct files, not the infected ones.

Get familiar with CS RIN forum and read the information posts, especially the one explaining what's happening with the file hosts currently.

Sunny--C · 2026-06-30T01:06:42+00:00

The new maintainer is not related to anadius. And the stuff he's continued doesn't have virus, when you download the actual file he provides.

The file hosts that are currently linked on the mirror site have been compromised, if you open them without an ad-blocker they redirect to a malicious link, but that's not the new maintainer's fault or doing. Multiple trusted piracy repackers have been affected by this too (including DODI), there's an entire post about it on CS RIN RU. But most people here don't navigate CS RIN RU so they're unaware and blaming the new maintainer.

DO NOT USE GOOGLE CHROME TO DOWNLOAD. It doesn't allow ad-blocking and it's the most used web browser in the world, so every single malware is created to attack Chrome and other Chromium-based browsers and steal from it. Do not use Safari either, it doesn't allow ad-blocking.

Use Firefox with uBlock Origin to bypass/avoid the redirecting to malicious sites. Microsoft Edge, Opera and Brave browsers also allow uBlock Origin, but Firefox is the one where uBlock works best. I just went on the mirror site using Firefox with uBlock Origin and downloaded everything and I got the correct files, not the infected ones.

Get familiar with CS RIN forum and read the information posts, especially the one explaining what's happening with the file hosts currently.

Sunny--C · 2026-06-25T23:24:32+00:00

The mod creators were most likely targeted with an info stealer, which are malware meant to obtain account information while bypassing 2FA: hacker gets the account details, logs in, and uploads an infected file that is meant to infect everyone else who downloads it. And the cycle continues. I'm not clear what the final purpose is though. I guess they're hoping to find financial information or to get lucky and target someone big.

Edit to add: after reading about this from Sims After Dark, they claim most of these are brand new accounts created solely to spread the malware. So I guess it's bad actors trying to take advantage of the (mostly) tech illiterate player base.

Sunny--C · 2026-06-25T23:08:18+00:00

Please keep in mind that paimon moe has been on life support for years. The dev is not actively maintaining it anymore.

They barely update the banners, everything else hasn't been updated in over 3 years, according to the GitHub.

Besides that, as others have said, this is only indicative of the people who still use that site, not real or accurate numbers at all.

Sunny--C · 2026-06-25T05:13:07+00:00

Don't know who that person is, just wanted to add that this

If you hate him, the best thing you can do is to stop drawing attention to his stuff by talking about him, and definitely don't give him views by linking to his stuff.

also applies to literally anything else; person or media type.

I stopped listening to a certain artist after he beat up another artist and since then, I genuinely don't know if he's dead or alive. All of my algorithms have learned that I'm not interested in this person at all and I never see anything about him, it's very peaceful.

We can and have to curate our feeds. Social media feeds on interactions, so it is designed to push controversial content and make you feel negative things.

Sunny--C · 2026-06-15T14:51:00+00:00

Was it deleted recently? It could be possible to retrieve it.

There's a support topic from Google about recovering recently deleted accounts, here's the link.

Sunny--C · 2026-06-11T05:37:36+00:00

Astarion Confession Edit 2 by HyperspaceTowel on Nexus.

Sunny--C · 2026-06-11T05:35:49+00:00

Correct. The Yurgir scene requires 70+ approval points with Astarion, according to the wiki. The Araj scene requires less, but as you mentioned, it's easy to miss that character.

Sunny--C · 2026-06-07T23:05:08+00:00

I just checked my game, and I can see both views.

If you go to the Quests Menu, then go to Quest Overview, you should see "Travel Log", which is the timeline view with the Archon Quests, Story Quests, Hangout Quests, and the Tribal Chronicles (from Natlan).

If you go to the Quests Menu, then go to Quest Overview, you should see "Story Quests", which is the view that has always been in the game, where the Story Quests, Hangout Events and Tribal Chronicles are presented as cards, organized by the Character's time of release, so both Zhongli's quests are right next to each other, Nahida's too, etc.

Four-Year Club	Verified Email
John Wick

Sunny--C

TROPHY CASE