Sometime you have been told to whitelist the file to run the crack, it is false positive. Why some AV is detecting such virus "is containing virus"?

I know some of the crack is a fake file to crash you computer or stealing some private information, but most of them is able to making the software running in full version.

I tried to run the crack in sandbox and or use some online service like FireAMP to analyze what file, registry are created but usually there is nothing suspicious.

I think I shouldn't upload any crack sample here, but I bet if you know the answer of this question you should know where to download some sample, by the way here some of the VirusTotal scan report: Link1, Link2, Link3

Edit: I can see there is someone is voting to close this question for reason "primarily opinion-based", but this is totally not primarily opinion-based. After looking at the suggested answer, the reason is "make their target not work as intended".

3 Answers 3


I'm fairly certain crack tools are detected as malware or viruses because, by definition, they are. Their specific purpose is to modify programs and files so that they don't work as designed. They delete verification files, modify registration status and do whatever they can to make their target not work as intended.

Even though the crack allows you, the user, to use the program for free (ie you are achieving your goal with the program and making it work as you intend it to), AV doesn't care about that. If some program wants to edit another one (or edit system files), it fits the definition of what malware is.

  • 2
    +1 for the answer, a good reason "make their target not work as intended." is equal to malware.
    – Bilo
    Jul 4, 2016 at 17:58
  • 14
    And as a beautiful testament to theft, some of them do actually contain exploits, because, well criminals like exploiting criminals because there's often no legal consequences. Jul 4, 2016 at 18:11
  • @FiascoLabs yep. I figured I didn't need to explain that, though, since OP said they knew that. Jul 4, 2016 at 18:12
  • 6
    I don't think this answer is correct. That same logic would apply to firewalls and antivirus software as well, and they are not detected as malware. (After all, antivirus software makes malware not work as intended.) Also, that's just not the definition of malware -- malware is software that does harm to the users or owners of a system. Jul 5, 2016 at 8:27
  • 1
    The firewall prevents whatever program's traffic it blocks from working as intended. But, in any event, that isn't the definition of malware. Malware isn't software that does harm to programs -- antivirus does that and it's not malware -- malware is software that harms users and owners. It includes ransomware, spyware, viruses, worms, trojans, and so on. (You can confirm this with literally dozens of sources by punching "malware" into your favorite search engine.) Jul 5, 2016 at 11:23

Four reasons:

  1. Most of their customers want their software to work this way. Or, they would prefer people that believe that they do and therefore act as if they do.

  2. They are unwilling to certify such software as safe, and once they've identified it, they have to either alert or not alert. As you pointed out, much such software is malicious.

  3. Sometimes the security software is installed by someone other than the sole user of a machine. Often the person who installed that software and manages it would like to know that cracked software has been installed on his machine.

  4. Some programs use heuristics to detect malware. Programs that inspect other programs and manipulate or modify them may be automatically flagged as malware unless they are specifically whitelisted. There's no upside to whitelisting cracks and a significant downside -- that may be considered facilitating crime or may put them at risk should something they whitelisted prove to be malicious or otherwise harmful.


It's a complicated question.

  1. most cracks nowadays need to use malware tricks to actually work. This tends to set off false positives for heuristics. The antivirus people refuse to fix this, because it opens the door for real malware to hide from the heuristics by masquerading as a crack, and because it's a nice dose of FUD to scare people into not pirating. Windows Defender is one of the worst about this. The fact that sometimes a crack does have an actual virus or malware in it doesn't help.

  2. the software vendors prefer this state. They used to be really bad about this, with McAfee outright deleting files with the filename of keygen.exe, saying that it was an uncleanable virus, and that the file could not be cleaned. To this day, I still find key generators (which have no malware code at all in them) declared viruses or malware. The more honest programs will outright tell you it's a keygen, and classify it as potentially unwanted program, but will still want to delete it. Windows Defender is one of the more honest ones in this regard, and will outright tell you it's a windows hacking tool to bypass validation.

I have no quarrel with an antivirus that wants to delete a keygen, provided it is honest about it. This is very useful on company computers. As a company, you can get into trouble by having pirated software on the computer, so you actually WOULD want your antivirus solution to forcibly remove it. But it ticks me off when it just says it's a virus or malware when it knows it's really a crack or a keygen.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .