Sometime you have been told to whitelist the file to run the crack, it is false positive. Why some AV is detecting such virus "is containing virus"?

I know some of the crack is a fake file to crash you computer or stealing some private information, but most of them is able to making the software running in full version.

I tried to run the crack in sandbox and or use some online service like FireAMP to analyze what file, registry are created but usually there is nothing suspicious.

I think I shouldn't upload any crack sample here, but I bet if you know the answer of this question you should know where to download some sample, by the way here some of the VirusTotal scan report: Link1, Link2, Link3

Edit: I can see there is someone is voting to close this question for reason "primarily opinion-based", but this is totally not primarily opinion-based. After looking at the suggested answer, the reason is "make their target not work as intended".


I'm fairly certain crack tools are detected as malware or viruses because, by definition, they are. Their specific purpose is to modify programs and files so that they don't work as designed. They delete verification files, modify registration status and do whatever they can to make their target not work as intended.

Even though the crack allows you, the user, to use the program for free (ie you are achieving your goal with the program and making it work as you intend it to), AV doesn't care about that. If some program wants to edit another one (or edit system files), it fits the definition of what malware is.

  • 2
    +1 for the answer, a good reason "make their target not work as intended." is equal to malware. – Bilo Jul 4 '16 at 17:58
  • 13
    And as a beautiful testament to theft, some of them do actually contain exploits, because, well criminals like exploiting criminals because there's often no legal consequences. – Fiasco Labs Jul 4 '16 at 18:11
  • @FiascoLabs yep. I figured I didn't need to explain that, though, since OP said they knew that. – TheWanderer Jul 4 '16 at 18:12
  • Agreed with the post, with the mention that many cracked games actually perform better from a performance perspective due to the current excessive spamcode contained in the original files. Securom was a total failure and original games did not work for legit buyers and nowdays the current protection drastically affects the performance of games. Perhaps the developers should make quality products instead of investing in something that works against legit users. – Overmind Jul 5 '16 at 8:05
  • 4
    I don't think this answer is correct. That same logic would apply to firewalls and antivirus software as well, and they are not detected as malware. (After all, antivirus software makes malware not work as intended.) Also, that's just not the definition of malware -- malware is software that does harm to the users or owners of a system. – David Schwartz Jul 5 '16 at 8:27

Four reasons:

  1. Most of their customers want their software to work this way. Or, they would prefer people that believe that they do and therefore act as if they do.

  2. They are unwilling to certify such software as safe, and once they've identified it, they have to either alert or not alert. As you pointed out, much such software is malicious.

  3. Sometimes the security software is installed by someone other than the sole user of a machine. Often the person who installed that software and manages it would like to know that cracked software has been installed on his machine.

  4. Some programs use heuristics to detect malware. Programs that inspect other programs and manipulate or modify them may be automatically flagged as malware unless they are specifically whitelisted. There's no upside to whitelisting cracks and a significant downside -- that may be considered facilitating crime or may put them at risk should something they whitelisted prove to be malicious or otherwise harmful.

Not the answer you're looking for? Browse other questions tagged or ask your own question.