Why Trainers show up as Virus sometimes!

[Sykoo]

Hey everyone!
I've seen that lots of people are kind of confused regarding why the trainer(s) show up as virus files like trojan and other types of malware when they try to launch the files. So I thought I'd make this thread to tell you guys in-depth about why it shows up!

Basically, trainers and other types of hacks for games are positve negative softwares, which means that they are softwares used to manipulate other softwares (in this case, games). They pretty much get into the game, and edits its information. Useally, games which has gotten security in their system, which can also be known as "anti-cheating", detects those files as harmful files to the game.

Injectors and DLL hacks are most of the time detected as "injector/malware". They have to be assigned as some sort of virus so that the game security won't bother to touch the file as it might get harmed itself. It's pretty much like you do not touch a mafia boss when he passes by you, as you don't want to get harmed. But the game system is not the only thing that detects those files as harmful. Our antivirus firewalls does too! And therefore, useally people are asked to run the software as administrator and even add it to their exception list on their antivirus/firewalls!

However there are real viruses too that people spread with their either fake or true hacks, but you can be 100% sure that you're totally safe by downloading cheats and other files from MrAntiFun! Useally, the real viruses which can and will harm your computer, gets more than 5 threats detected when scanned by VirusTotal and other virus detectors similar to that! If a file gets under or about 5 threats on some kind of virus detector like VirusTotal, they can be considered as safe files!

If you scan the most of our cheats on MrAntiFun, you'll get under 5 threats, maybe about that amount! It also has to do with what kind of system the game the cheat is assigned to uses! If it's a super complicated and advanced anti-cheat system, it'll probably get over 5 threats even though its a safe file!

But as I told you before, I can assure you 1oo%'ly that the files you're downloading from this site, are safe and simple to use! If you have any personal questions or anything regarding MrAntiFun website, feel free to contact me anytime you like!

Have fun cheating, fellas'!

/Sykoo - Moderator of MrAntiFun

 

[InfernoFiend]

Every trainer out there will be picked up by some antivirus products as a trojan or virus... Trainers are detected falsely as viruses due to how they are compressed and encrypted. The reason for them being encrypted is to prevent other trainer release groups from stealing another group's trainer and claiming it as their own. As a result most antivirus applications will then flag the trainer as a virus because it's structure and signature is similar. They also get flagged as viruses due to the fact that trainers modify the cached memory of a game which is also similar to how some viruses function.

That is about all I know on the subject honestly but I am glad we have a post here on this subject. I think something like this needs to be pinned on the main page so people can just get this into their heads.

Even I learned something about this subject thanks to Sykoo's post (＾ω＾)

 

[undeadninjaz]

Simply said that trainers has the ability to change or modify a game and so on.... Simple as that

 

[farhat]

Trainers are like yogurt ma man, yogurt is full of Bacteria, but Good bacteria that's why yogurt is good for u! The trainers here r the same!

 

[darkfly]

So this is Safe right? My anti-virus(malwarebytes) Thought it was adware...is it?

 

[kekeface]

but
SHA256: b208b54a21edfc45134320ba60ffb4edcb5fb64bcdc9778e4365d92a3db693f4
File name: Total War Rome 2 Emperor Edition V2.2.0 Trainer 14 Build 15539 M...
Detection ratio: 18 / 55
Analysis date: 2015-07-30 06:56:20 UTC ( 0 minutes ago )

thats 18/55...hmm? is it a virus or not?

also
SHA256: 42f8a0399079154949452b559bcbeb99cdde9f4dde9306aec130fcabf2a899e6
File name: Total War Shogun 2 V1.1.0.0 Trainer 8 MrAntiFun B.EXE
Detection ratio: 12 / 55
Analysis date: 2015-07-30 06:59:17 UTC ( 0 minutes ago )

 

[Wilfredo]

I'm concerning that my Norton keepin delete Total War: Attila because of its Trojan and virus. Is it false positive? I need to know!

 

[ForeignHost]

Nonsense... You can make trainers and injectors without bothering Anti-Virus programs, problem is people tend to use obfuscation.

Besides the trainers that use obfuscation, any Trainer will rarely get wrongly flagged, meaning there are Trainers out there that do stuff they shouldn't! Like creating files to sabotage other Trainers (there was a huge outbreak back in 2014).

Trainers flagged as downloaders (and others) are as suspicious as it can get, so far none of the Official MrAntiFun Trainers has been flagged by any Anti-Virus (Avast, Avira, Kaspersky, ESET, Malwarebytes, etc.) over the years on my computer (I only recently started downloading officially from this forum and no problems either).

I suggest you all stay away from unknown Sources and Community Trainers, being ignorant towards Anti-Virus warnings is half-way to get burned. That will be all I have to say on the matter, if people choose to believe or not it's their problem.

 

[dallas990]

the trainers are not viruses they pop up as viruses some times because your antivirus program never heard of it so yea.

 

[Hoover1979]

I have noticed recently a surge of false positives from AV programs and now Microsoft Security Essentials. I had to completely uninstall Avast as it was blocking the MrAntifun Website completely, even when I whitelisted it, and was not only deleting trainers, the instant I opened them, but would randomly remove batches of trainers at will.

I was also being prevented from restoring trainers, and my whitelisting settings were being overrided so the only way I could even Access the MrAntifun website (and websites for other trainers) was to not only uninstall Avast, but use Ccleaner to remove it's hooks from my registery. So I switched to Microsoft Security Essentials. Now M.S.E. is flagging trainers from MrAntfun, and other trainer devs as severe threats, in an ever increasing rate.

I am starting to see an alarming pattern of false-positives, website blocking and whitelist overriding, in the Anti-virus scene. So far M.S.E. hasn't blocked MrAntifun.net, or other trainer websites, and I am unsure if M.S.E. is/will override whitelisting settings regarding trainers/trainer websites, like Avast is, but I am concerned that will change in the future, as Microsoft continues to increase it's aggression toward trainers.

I also suspect it is the presence of trainers on my system that is the reason for Baidu Antivurus destroying my system entirely. I avoid Baidu like the plague now, as it locks me from every program on my system. The first time I had reinstalled Windows 7 on a new SSD drive, and installed Baidu, and upon reboot, I was greeted with a cascade of "Access Violation (0xc00000005)" crash messages from every background program on my system. Not one Exe file would run, not even windows setup would run (they all insta-crashed with "Access Violation (0xc00000005)"crash message), so I had to boot from my Windows 7 DVD and reformat and clean install my OS again. some time later I tried installing Baidu again and the same crap happened on the next reboot. I avoid Baidu AV Like the plague now, as I do Avast and AVG (The latter two didn't ruin my system but stop me from having, and using trainers and won't listen when I say "I want the trainers on my system")

It is starting to look like some sort of conspiracy being afoot against trainer devs and websites. although I can find no sources, I am beginning to suspect money transactions between Game Devs/Publishers and Antivirus Companies/Microsoft to try to put the kybosh on trainers to end cheating on PC games, regardless of the trainers only being for Singleplayer. I've found a lot of (closed minded) gamers in the Steam discussions can't differentiate between cheating in a singleplayer environment from cheating in a multiplayer environment, and refuse to listen to the facts and go on the personal attack. Maybe there are also Devs/Publishers with the same mindset.

One Steam gamer (who I won't name) threatened to report me to Valve for breaching the Steam Subscriber Agreement, simply because MrAntifun is a friend of mine. Obviously either he only made an idle threat, or Valve laughed him off as I did not get my account flagged, or even a warning.

Like I said in the fifth paragraph, I have no sources for the Devs/Publishers bribing MS and AV companies to quash trainers theory, it is just a theory, brought on by noticing a clear pattern of increasing trainer false-positives, website blocking, whitelist overriding (regarding trainers and trainer websites), and the false positives being now being listed as "Severe" threats, in an ever increasing manor.

 

[trainer23]

Just move on to a newer OS. You won't have problems anymore. Besides, Win 7 support is pretty much gone, even though "officially" they say something else.

 

[Kalas]

Just move on to a newer OS. You won't have problems anymore. Besides, Win 7 support is pretty much gone, even though "officially" they say something else.

It's not about OS, It's because of a "lame" Antivirus some people use.

Recommended Antivirus to use: Malwarebytes

 

[Lui Camble]

The thing that concerns me is that the Max Payne 3 Trainer shows up on virustotal as:
SHA256: 5384884ef9969e5e62c0dbdf2b88d70c25604059d029391dc723faff277f3dc1
File name: Max Payne 3 V1.0.0.130 Trainer +5 MrAntiFun.zip
Detection ratio: 24 / 62
Analysis date: 2017-07-12 20:56:07 UTC ( 2 hours, 37 minutes ago )

And also that malwarebytes detected every copy of the Max Payne 3 Trainer as you know, Hacktool.

And now my Recycle Bin is apparently corrupt, for god knows what reason.

 

[trainer23]

Because you know nothing about computers. Even MB has been corrupted with bullshit definitions. Wonder why!? It's about modifying memory addresses in real time, that is why it shows as that. Most virus definitions are only suppositions, like they have similarities in behavior to this though it is not. You most certainly infected your system with crap from somewhere else or you downloaded the trainer from a third party site. This guy wouldn't be working his ass off to make these trainers for so long if they were so bad. People would flag it as dangerous, yet it is not. And consider supporting him with no adblock and maybe some money too, for it is his living. Stop denying his work! Everywhere I turn around I see people trying to destroy others who need and want to make a living. Do you have any idea how difficult and frustrating this really is? For your enjoyment support him!

 

[Lui Camble]

Well i'm sorry that i am paranoid.

 

[Kalas]

Well i'm sorry that i am paranoid.

Look, don't download Trainers from other places that has MrAntiFun in their title, It may contain virus If you don't download them from the source. (Here)

Files you got from here that shows as virus, they are called False Positive. (look that up on google)

 

[Riot706]

Hmmm...well, I got the blue screen of death [Your computer ran into a problem and needs to restart!] because of MAF trainers...

 

[trainer23]

Memory leak. Instead of blaming the trainer, eliminate everything else first.

 

[Droid8Apple]

Mind=Blown... it's years after this OP and I still see people every day "BUT BUT BUT, my VirusDefeaterDemolishingDominator-SE;SEE,XRtotalEXTENDED said it was definitely a virus!"

 

[BrimstoneZV]

It is mildly amusing but I will say this its increasingly annoying now none of my trainers are working avast just decided to start flagging them today and me removing and saying they are fine doesn't do anything.