Today I was trying to download Affinity Photo 2 from the websites listed on the megathread, as normally I do exactly that and everything goes just fine.

But when scanning the downloaded files. Windows Defender detected it as hacktool.win32.keygen and malwarebytes as Generic.Malware.AI.DDS.

In the case of Windows, I am guessing that it is not detecting a virus but the actual crack right? That's what that means as far as I'm aware. But what surprised me was malwarebytes, it has sometimes warned about cracks but it's not something it does often, and I don't recognize the detection code, but it seems to be using AI to detect malware now?

Is this something that is known to happen? Malwarebytes AI seems to be detecting cracks as malware... Or is this actually a virus?

I put it in quarantine just in case, but I am guessing this has to be false positives, as it happened with 2 different downloads from 2 different websites.

VirusTotal results also flagged it as "malware", but seems to be also detecting the crack. https://www.virustotal.com/gui/file/127540f7b3558a94f6e8a4ce9c695231e8715e20a17da4584d5df99035a79d49/detection

you are viewing a single comment's thread
view the rest of the comments

[–] hendrik@palaver.p3x.de 4 points 1 month ago* (last edited 1 month ago) (6 children)

That's what google finds:

I'd say judging by the name it's a keygen / crack. So it's telling you downloaded pirated software... Are these online scanners like virustotal.com still a thing? You could upload it there and look what it's saying. Other than that I don't see any good indication of it being malware.
And I don't know much about virus scanners, but the AI detection could as well be something like: people who downloaded this file, also downloaded malware... So I wouldn't trust it to be precise.

[–] Sasori323@lemmy.dbzer0.com 3 points 1 month ago (5 children)

I am guessing it's probably just the crack, and the fact that it detected the same from 2 different download on websites with good reputation on this community makes me think it's that.

And yes I did put it on virustotal. The link is on the post. As I said, it detected the same, but still 32 / 62 (or something) went off, I don't really feel like installing it, honestly. I might look into it later

[–] hendrik@palaver.p3x.de 5 points 1 month ago (4 children)

Hmmh. I mean you often get mixed results on virustotal. But in this case most of the positives say it's a "hacktool' or "patcher". I'd say if it did harm to your computer, it would be in some different category. I'd say the name suggests the majority agrees that it's circumventing the copy protection, and that's the bad thing about that file.

Maybe someone else has some more helpful insight. I'm one of the Linux guys here and I don't really pirate application software. But I don't think we have any good alternative for photo editing, at least not with a similar workflow.

[–] Sasori323@lemmy.dbzer0.com 4 points 1 month ago (1 children)

I use Linux too on a secondary computer, and I do find amazing the amount of incredible open-source / free apps you can find. I have started using LibreOffice instead of (pirated) microsoft office because I honestly think it's just better.

But yeah, unfortunately, I haven't been able find a lot of free and open-source programs that can replace what this one does. And I just don't like adobe.

[–] hendrik@palaver.p3x.de 3 points 1 month ago

Fair enough. Yeah, we have a lot of very good Free Software tools available. But picture editing is kind of a tough one. Always has been.

load more comments (2 replies)