Malwarebytes "AI detection" giving false positive from pirated software?

Pretty much every cracking tool or cracked EXE will trip anti-virus packages because they will either A. Has code to overwrite another program's bytes, which is a typical Trojan, or B. A known common program exe doesn't match the saved hash that the AV has stored for it, since a cracker has modified it.

I'll typically scan my games and tell it to ignore any EXE or single dll it registers as "bad" after doing a quick research on how the crack works. If other files begin showing up bad I might question it. But otherwise you're largely left trusting the cracker, so be very particular about where you download cracks from.

If I were in your position, I wouldn't have installed it. VT got 37 vendors to flag it.

And it's very common for cracked programs to contain some malware, so my trust wasn't high to begin with. I'm always skeptical about this kind of thing.

Malwarebytes AI seems to be detecting cracks as malware

that and 'keygens' and what not.. detection is probably more the 'norm' than mbam being an exception.

https://www.malwarebytes.com/blog/detections/generic-malware-ai-dds

Items detected as Generic.Malware.AI.DDS can be various types of malware and will be examined and classified at a later stage.

It does not detect is as definite malware, but their trained AI engine seems to conclude or hallucinate a high likelihood. Which may or may not be true.

Or is this actually a virus?

We, you, and they can't tell from this alone. For a definite answer, a deeper analysis will have to be made.

Security Vendors (ie antivirus companies) don't really care that an individual crack may or may not be dangerous on its own, but things like cracks often do display the kind of behavior viruses do, like modifying registries and verification files. While they make these things free for us to use, they're technically doing things on the system the user isn't supposed to do (because it impacts security/integrity).

Game cracks have been a long-used avenue for propagating viruses, so to serve their customers better, they probably err on the side of just assuming that they're all potentially at risk. It's a little over-the-top, but I can see the reasoning.

Finally, lot of antivirus companies are exactly that: companies. They exist to make a profit and they're working with people who sell software by marking pirated copies of their software as malware, which in the view of the people who sell software: they are malware. So often the way they make money dictates what they treat as legitimate versus not legitimate. Especially in the US, where the government does a lot of work to support private companies in enforcing copyright.

In other words, it's a crap shoot. I'd say if the virus signature only mentions it being a game crack it's possibly safe, because if it actually contains a virus payload, I would think it would identify that one, too. It wouldn't take a more serious virus and dump it under the "game crack" without more explanation, or at least I hope they don't approach it that way.

It might be a false positive, just detecting a crack. Or it might be a true positive, and actually be malware. Do you trust the author? How much do you want to take the risk?