Cracked software, keygens and activators: what they really install

What cracks, keygens, activators and cheats are

All of these tools exist to make paid software or games behave as if they were licensed, or to give an unfair advantage in online games. They work by changing program files, patching memory or faking the licence check.

• Crack or patch: a modified program file, or a small tool that modifies one, so that the licence check is skipped.
• Keygen: a program that generates registration keys that the software will accept.
• Activator: a tool that activates Windows or Office without a valid licence, often by emulating a KMS server, the system that companies use to activate their own PCs. Microsoft Defender detects common ones as HackTool:Win32/AutoKMS and similar names.
• Loader: in the piracy world, a program that starts the real software and patches it in memory. (Security researchers use "loader" differently: for malware that downloads more malware.)
• Repack: a pirated game or program, compressed and bundled with its crack in one installer.
• Game cheats, trainers and mod menus: tools that change a game's memory or files; many need administrator rights or a driver.

Not every crack is malicious in itself. The problem is that you cannot tell which ones are, because the people who make and share them answer to no one, and the tools need exactly the access that malware wants.

Why they are such a good carrier for malware

Malware authors do not need to trick anyone into running an unknown program when people are already searching for one, downloading it from an anonymous site and running it as administrator. Microsoft's guidance on preventing malware names pirated software and the sites that offer it as a common source of infection, both through bundled malware and through the sites themselves.

The "turn off your antivirus" instruction

Almost every crack comes with a note: antivirus programs will flag it as a "false positive", so disable real-time protection, add an exclusion for the folder or switch off Tamper Protection before running it. Sometimes the claim is half true, because a genuine crack does modify software and gets a hacktool detection. But the instruction is identical whether the file is a harmless patch or a password stealer, and once protection is off nothing checks which one you have.

Password-protected archives

Cracks are often shared as ZIP, RAR or 7z archives with a password written on the download page or in a text file next to it. Security scanners cannot look inside an encrypted archive, and mail services and browsers cannot scan it on the way in. The password protects the malware from inspection, not you from anything.

Fake download sites, videos and search results

Many crack sites are not run by crackers at all. They are networks of pages built to rank for "[program name] crack free download", "full version" or "activator 2026", and they send every visitor to the same rotating malware, whatever program they asked for. Video tutorials that promise a free version of a paid program and link to a file in the description are used the same way, sometimes from hijacked channels. Shared links to cloud storage and file hosting services make the file look more trustworthy than it is.

Repacks and cheats run with full rights

Installers and game cheats usually ask for administrator rights, and some cheats install drivers so that they can read game memory. Anything bundled with them gets the same rights, which makes it easy to switch off security tools, add exclusions and hide.

What actually comes with cracks

Security vendors and Microsoft report the same handful of payloads again and again:

• Information stealers. The most common payload today. They copy saved browser passwords, cookies, autofill data, crypto wallets, messenger and gaming sessions, and documents, and send them off within minutes, often before you have finished installing the program. See information stealers.
• Cryptominers. They use the processor or graphics card to mine cryptocurrency for someone else. The PC gets slow, hot and loud. Games and repacks are a favourite carrier because gaming PCs have strong graphics cards. See cryptominers on Windows.
• Ransomware. Some ransomware families have spread mostly through cracks and keygens for years; the STOP/Djvu family, which encrypts personal files on home PCs, is the best-known example. See how ransomware works.
• Loaders and remote access trojans. They give the attacker a way back in and install whatever pays best later. See trojans and loaders and remote access trojans.
• Adware, browser hijackers and unwanted programs. Bundled installers on crack sites add extensions, change the search engine or install "optimizers". See potentially unwanted programs.
• Proxyware. Programs that rent out your internet connection to others, so that criminal traffic appears to come from your address.

It is common to get more than one at once: a loader brings a stealer, then a miner, then something else a week later. That is why cleaning up after a crack is about more than deleting the crack.

Why your antivirus flags a crack, and what the names mean

Detections on cracks fall into two groups, and they mean very different things.

• Tool or riskware names such as Microsoft's HackTool:Win32/... or HackTool:Win64/AutoKMS, Kaspersky's not-a-virus:RiskTool, or ESET's "potentially unsafe application". These say the file modifies software or licences. They do not say the file is harmless; they say its main job is not a typical malware job.
• Malware names such as Trojan:Win32/..., PWS:Win32/... (password stealer), Trojan:Win32/CoinMiner, Ransom:Win32/..., or another vendor's Trojan.GenericKD or Gen:Variant. These say the scanner found malicious code or behaviour.

A crack can carry both: the patch gets a hacktool name and the stealer packed next to it gets a trojan name. If any malware name appears, act on it. More on how vendors name the same threat: why antivirus programs give one threat different names.

Uploading a crack to a multi-engine scanner and seeing only a few hacktool detections does not prove it is clean. Many payloads are downloaded only after the crack runs, so the file you scanned is not the file that does the damage.

Signs that a crack installed something

• Windows Security is off, or shows exclusions you did not add, in Windows Security > Virus & threat protection > Manage settings > Exclusions.
• Protection history in Windows Security lists threats that were found and allowed, or that keep coming back.
• The PC is slow, fans run at full speed when idle, or the graphics card is busy with no game open: typical of a miner.
• New programs in Settings > Apps > Installed apps, new extensions in the browser, or a changed search engine.
• New entries in Task Manager > Startup apps or new tasks in Task Scheduler with random names or paths in %AppData% or %Temp%.
• Sign-in alerts from Google, Microsoft, Steam, Discord or your bank, sessions you do not recognise, or messages sent from your accounts.
• Crypto missing from a wallet, or a clipboard that changes a copied wallet address.

No signs at all does not mean nothing happened. Stealers do their work once and often delete themselves afterwards.

What to do if you ran a crack, keygen or activator

Assume the worst until you have checked, especially if you followed instructions to disable your antivirus.

1. Disconnect from the internet if you suspect a stealer or a remote access tool, to stop more data leaving and more malware arriving.
2. Protect your accounts from another device first. Change the password of your main e-mail account, then banking, Microsoft, Google, Steam, Discord, social media and any crypto exchange, and sign out of all sessions on each. Move crypto to a new wallet created on a clean device. Order and details: securing your accounts after malware.
3. Turn protection back on. In Windows Security > Virus & threat protection > Manage settings, switch on Real-time protection, Cloud-delivered protection and Tamper Protection, and remove exclusions you did not choose yourself.
4. Uninstall the cracked program and anything that came with it, sorting Installed apps by install date: Uninstall a program or app in Windows On uGetFix.
5. Run a full scan, then an offline scan, which works before Windows starts so that hidden malware cannot interfere: Run a Microsoft Defender Offline scan.
6. Check startup entries and scheduled tasks for leftovers and turn them off: Stop apps from opening at startup On uGetFix.
7. Turn on two-step verification for the accounts that matter: Turn on two-step verification / secure a hacked account.

If Windows itself was activated with a KMS activator, the activator may also have installed a service or scheduled task that runs on its own; the scans above usually find it. Activate Windows with a genuine licence in Settings > System > Activation afterwards.

If files were encrypted, follow Ransomware: first steps, finding a decryptor and recovering files instead. If a remote access tool was found, security settings kept switching off, or detections return after every clean-up, resetting Windows is the safer option: clean up or reset Windows after malware.

Safer ways to get the software you need

• Free and open-source alternatives exist for most everyday programs: office suites, image and video editors, 3D tools, audio editors, archivers and PDF tools.
• Free tiers, trials, education and non-commercial licences are offered by many paid programs. Students and teachers can often get professional software free.
• Sales and bundles from official stores bring games and programs down to a fraction of the full price.
• Windows itself keeps working without activation, with a watermark on the desktop and personalisation settings locked, so there is no need for an activator while you decide. A genuine licence is cheaper than recovering from a stolen bank account.
• Download only from the developer's site, the Microsoft Store, Steam or another official store. Check the address before you download; fake "official" sites buy search ads.

If you still decide to use a crack, at least never switch off your antivirus for it, never run it on the PC where you do your banking or keep a crypto wallet, and treat every account used on that PC as at risk.

Common myths about cracks

• "It's a false positive, every crack gets flagged." Some flags are tool detections, but the same excuse is used to deliver stealers. A trojan, stealer or ransomware name is not a false positive.
• "It came from a well-known release group." Malware sites copy release group names and file names. You cannot verify where a file really came from.
• "I scanned it on VirusTotal and only a few engines flagged it." Many cracks download the real payload after they run, and new payloads are not yet known to most engines.
• "Nothing happened, the program works fine." That is the plan. Stealers run once, in the background, and the program works so that you do not look further.
• "I use a VPN, so I'm safe." A VPN hides your connection, not what you run. It does nothing against malware you start yourself.
• "Game cheats are different." Cheats often need administrator rights or drivers, and gaming accounts and skins are valuable, which makes cheats a favourite carrier for stealers.