What to do if you installed a Minecraft mod with malware

When Modrinth or CurseForge removes a mod with malware, the copy you downloaded stays on your computer, and its malware can keep running. These five steps remove it and protect your accounts. Do them in order.

To know which steps apply to you, open the project on Modgrade: its Security tab says what its malware does, for example which accounts it steals. If you are not sure, do every step.

1. Remove the file

Close Minecraft first. Then delete the file from your mods folder. For a plugin, delete it from your server's plugins folder. If a modpack installed it, delete it from that modpack's mods folder.

2. Scan your computer

Some malware downloads and installs other programs, which stay after the mod is gone. A full scan finds them.

Run a full scan with your antivirus. On Windows, the built-in one is Microsoft Defender, in the Windows Security app.

On a server: check the plugins folder of your server for files you did not add.

3. Remove the browser extension

Only if its malware installs a browser extension. Such an extension records what you type into websites and sends your login cookies, so remove it before you change your passwords.

  1. In each browser (Chrome, Edge, Opera, Opera GX, Brave) and each profile, open the extensions page, remove any extension you did not install, and turn developer mode off.
  2. Most home computers can skip this step. On a school or work computer, before you delete the folders below, double-click the .reg file in C:\ProgramData\ChromeDevAssist\policy-backup-* to restore the browser settings the malware removed.
  3. Close the browsers, then delete the folders %LOCALAPPDATA%\ChromeDevAssist and C:\ProgramData\ChromeDevAssist, and the file %LOCALAPPDATA%\Microsoft\Windows\Explorer\iiconcache_widemod_2560.db.

4. Protect your accounts

Malware that steals logins sends them to its author, who can then sign in as you. Do this after the scan, so the new passwords are not stolen too, and only for what its malware steals.

  • Microsoft and MinecraftIf it steals your Minecraft session or launcher accountsUse "sign out everywhere" in your Microsoft security settings and change your Microsoft account password.
  • DiscordIf it steals your Discord tokensChange your Discord password.
  • Accounts you use in your browserIf it records what you type in your browserUse "sign out everywhere" in the security settings of your accounts, such as Microsoft and Discord. Change every password you typed in your browser since you installed it, and turn on two-factor authentication (2FA).
  • Bank cardIf it records what you type in your browserIf you typed card details into a website since you installed it, contact your bank.
  • Saved passwordsIf it steals saved passwordsChange the passwords saved in your browser and other apps.
  • Crypto walletIf it steals crypto walletsMove your crypto to a new wallet.

5. Check your other files

A player who installed one file with malware may have others from the same place. Check your other mods and plugins with the Scanner, and look for them on Minecraft Malware Reports.

You downloaded a launcher from a fake site? The Fake sites tab of that launcher's page says what to do, and the fake sites we know are listed on Minecraft Malware Reports.