this post was submitted on 11 Jan 2025
26 points (96.4% liked)

Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

55319 readers
252 users here now

⚓ Dedicated to the discussion of digital piracy, including ethical problems and legal advancements.

Rules • Full Version

1. Posts must be related to the discussion of digital piracy

2. Don't request invites, trade, sell, or self-promote

3. Don't request or link to specific pirated titles, including DMs

4. Don't submit low-quality posts, be entitled, or harass others

Loot, Pillage, & Plunder

📜 c/Piracy Wiki (Community Edition):

💰 Please help cover server costs.

Ko-Fi Liberapay
Ko-fi Liberapay

founded 2 years ago
MODERATORS
db0@lemmy.dbzer0.com
sunbrothersco@lemmy.dbzer0.com
dataprolet@lemmy.dbzer0.com
Flatworm7591@lemmy.dbzer0.com
RandomLegend@lemmy.dbzer0.com
26
Malwarebytes "AI detection" giving false positive from pirated software? (lemmy.dbzer0.com)
submitted 10 hours ago by Sasori323@lemmy.dbzer0.com to c/piracy@lemmy.dbzer0.com
18 comments fedilink hide all child comments
 

Today I was trying to download Affinity Photo 2 from the websites listed on the megathread, as normally I do exactly that and everything goes just fine.

But when scanning the downloaded files. Windows Defender detected it as hacktool.win32.keygen and malwarebytes as Generic.Malware.AI.DDS.

In the case of Windows, I am guessing that it is not detecting a virus but the actual crack right? That's what that means as far as I'm aware. But what surprised me was malwarebytes, it has sometimes warned about cracks but it's not something it does often, and I don't recognize the detection code, but it seems to be using AI to detect malware now?

Is this something that is known to happen? Malwarebytes AI seems to be detecting cracks as malware... Or is this actually a virus?

I put it in quarantine just in case, but I am guessing this has to be false positives, as it happened with 2 different downloads from 2 different websites.

VirusTotal results also flagged it as "malware", but seems to be also detecting the crack. https://www.virustotal.com/gui/file/127540f7b3558a94f6e8a4ce9c695231e8715e20a17da4584d5df99035a79d49/detection

you are viewing a single comment's thread
view the rest of the comments
[–] empireOfLove2@lemmy.dbzer0.com 3 points 5 hours ago

Pretty much every cracking tool or cracked EXE will trip anti-virus packages because they will either A. Has code to overwrite another program's bytes, which is a typical Trojan, or B. A known common program exe doesn't match the saved hash that the AV has stored for it, since a cracker has modified it.

I'll typically scan my games and tell it to ignore any EXE or single dll it registers as "bad" after doing a quick research on how the crack works. If other files begin showing up bad I might question it. But otherwise you're largely left trusting the cracker, so be very particular about where you download cracks from.