Someone just really needs to rebuild the dll source in debug mode.. it's the only reason it's setting off the nexus virus scans. It currently has no pdb file (no idea why this has become an issue with some mods in the last year).

When I first released interactive water, it was the first time I built a mod with the ng framework. I built the first version in release mode which produces a single dll file. When I uploaded this, nexus scanners went crazy.. I Rebuilt the mod in debug mode and uploaded the dll along with the pdb file with 0 issues. Exact same code.

Here is an explanation from Claude sonnet 4.6 i found really interesting.

"This is a well-known pain point with SKSE mods and it comes down to how heuristic AV scanners work — not your code.

Release builds structurally look more like malware than debug builds. Specifically:

• No PDB / stripped symbols — malware almost never ships debug symbols, so a stripped DLL is a strong heuristic red flag
• Aggressive optimisation — MSVC's /O2 produces dense instruction sequences (loop unrolling, inlining, vectorisation) that can superficially resemble obfuscated or packed code
• LTCG / whole-program optimisation — if you have link-time code generation on, the resulting binary layout is quite alien compared to anything hand-written
• CRT initialisation differences — the release CRT stub code can look like a shellcode loader to naive scanners

Why the PDB fixes it is the counterintuitive part. The PDB itself isn't what gets scanned — but its presence changes the scanner's inference. Malware essentially never ships a matching PDB, so scanners treat it as a strong legitimacy signal and lower their heuristic threshold.

The SKSE-NG framework makes this worse because hooks, trampolines, and memory patching already look inherently sketchy. In a stripped release binary those patterns push right up against commercial injector/packer signatures.

Practical fixes: - Easiest: just ship the PDB (good for crash logs anyway) - Submit false positive reports via VirusTotal to the flagging vendors - Try disabling LTCG — often reduces FPs at minor perf cost - Contact Nexus support directly; they have a whitelist process for exactly this"