> For the complete documentation index, see [llms.txt](https://docs.akiraghost.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.akiraghost.com/faq/general-questions/antivirus-false-flags.md).

# Antivirus False Flags

Akira is safe. If your antivirus flagged it, this page walks through why, what the detection name is actually telling you, and how to sanity-check things for yourself.

We'd rather over-explain this than have you running software you're unsure about.

## The short version

Akira does several things that AV software treats as suspicious by default:

* It's heavily obfuscated and packed (to protect against leakers and reverse engineering)
* It's not digitally signed, and won't be (this is intentional, see below)
* Some products use rotating builds, so the binary you downloaded is one no AV vendor has ever seen before
* It hooks into and modifies the Minecraft process, which is the entire job description of a PvP client

Real malware does all of the above too, so AV engines flag anything that looks like this by default. The detection you see is almost always a generic, heuristic, or packer label, which is the giveaway. Read the detection name your AV gave you. If it says `Generic.ML`, `Heur`, `Packed`, `Wacatac`, `Tiggre`, or `HackTool`, your AV is guessing, not matching a known threat.

## Why this happens

### Obfuscation

Akira's code is obfuscated. The instructions on disk are functionally identical to the source but rewritten into something you (or anyone trying to scrape, repackage, or copy the code) cannot easily read.

Malware authors do the same thing for the same reason: they don't want you to see what's inside. AV engines have learned to treat obfuscated control flow as suspicious in general, which catches Akira in the same net as actual malware.

### Packing

The binary ships compressed and encrypted, and only unpacks itself into memory at runtime. This protects the code from static analysis and makes it useless to anyone trying to copy or repackage it.

Packing is also the most common evasion technique used by malware, so any packed binary trips heuristics regardless of what's inside.

### No digital signature, on purpose

We don't sign Akira's binaries, and we won't. There are two reasons, and both of them are in your interest.

First, a code signature would actively make Akira worse at its job. Signing ties a binary to a fixed publisher identity, which gives any third-party detection system a stable fingerprint to track and block. Unsigned, ever-changing binaries are much harder to fingerprint, which is the whole point.

Second, signing would put your account at risk. Server-side detection systems don't just block clients, they can flag the accounts associated with them. A binary that doesn't carry an identifying signature makes that association much harder. That tradeoff is deliberate.

The cost of this choice is exactly what you're experiencing. Windows SmartScreen and most AV engines treat unsigned executables as a yellow flag by default. That's the price of staying invisible.

### Rotating builds

A few of our products ship with rotating builds. Every time you download, you get a freshly compiled and freshly obfuscated binary with a different code layout, different packing, and a different file hash. Two users downloading five seconds apart get two different files. The version sitting on your disk is, in a literal sense, unique to the moment you downloaded it.

The upside: no third-party system can blacklist a hash it has never observed. The downside: AV vendors can't recognize a file they've never seen before. From an AV's perspective, every download is a brand-new unknown executable with zero reputation, which lands you straight in the "suspicious until proven otherwise" bucket. There is no way around that without giving up the thing that makes rotating builds useful in the first place.

### Process modification and memory access

Akira is a Minecraft client modification. To do its job it has to attach to the Minecraft process, read and write its memory, hook native and JVM functions, and run a JNI native component for performance-critical paths. These are the same Windows API calls a memory-scraping trojan would use. The OS cannot tell the difference between "Akira drawing overlays on top of the game" and "malware reading a password manager." It's the same set of calls.

### Anti-debug and anti-tamper

The client detects when it's being run inside a debugger, a sandbox, or a memory analysis tool. This is standard for any protected software, commercial games included. It's also standard for malware that doesn't want to be picked apart. Same checks, same flag.

## Read your detection name

This is the most useful thing on the page. Your AV told you something specific. Look at what it actually said.

If the name contains any of these, it's a generic heuristic. Your AV didn't match a real piece of malware, it just decided the file looked off:

| In the detection name                                                                  | What it means                                                             |
| -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- |
| `Generic`, `Generic.ML`, `Gen`                                                         | A machine-learning classifier guessed "suspicious"                        |
| `Heur`, `Heuristic`, `HEUR`                                                            | Behavior resembles bad things                                             |
| `Packed`, `Packer`, `Obfus`, `Obfuscated`                                              | The file is compressed or encrypted, could be hiding anything             |
| `Suspicious`, `Unsafe`, `Risky`, `Riskware`                                            | The engine isn't sure, flagging just in case                              |
| `Trojan.Generic`, `Trojan:Win32/Wacatac`, `Trojan:Win32/Sabsik`, `Trojan:Win32/Phonzy` | Microsoft Defender's catch-all ML buckets, infamous for false positives   |
| `Wacatac`, `Tiggre`, `Bearfoos`, `Ulise`                                               | Generic family names for "unknown packed PE"                              |
| `HackTool`, `RiskWare`, `PUA`, `Unwanted`                                              | "This tool modifies other software." Accurate. Not the same as malicious. |
| `Injector`, `MemMod`, `ProcessHollowing.Heur`                                          | "It writes to other processes' memory." Yes, on purpose.                  |

## Track record

You don't have to take our word for any of this.

Akira has been used continuously in the Minecraft PvP community for years. Genuine malware does not survive that kind of timeline. The moment someone ships a client that steals accounts or drops a stealer, the IoCs get published, the screenshots circulate, and the developer's reputation is over within days. None of that exists for Akira because there's nothing to find.

We've also had our share of skeptics. People have asked hard questions. People have outright tried to frame us. Every time, we've responded directly and walked through exactly what our software does, including the parts that legitimately look strange at first glance. That offer stands for anyone reading this. Ask, and you'll get a real answer.

And for anyone still on the fence: if you find anything in Akira that causes actual harm — stealing data, exfiltrating credentials, persisting after uninstall, touching any process other than Minecraft, anything we said we'd never do on the list below — we'll pay you $200. We're that sure.

## Whitelisting Akira

If you've checked the detection name and you're satisfied, you can whitelist the file.

### Windows Defender

{% stepper %}
{% step %}

### Open Virus & threat protection

Open Windows Security, then go to **Virus & threat protection**.
{% endstep %}

{% step %}

### Manage settings

Under **Virus & threat protection settings**, click **Manage settings**.
{% endstep %}

{% step %}

### Open exclusions

Scroll to **Exclusions** and click **Add or remove exclusions**.
{% endstep %}

{% step %}

### Add the Akira folder

Click **Add an exclusion**, pick **Folder**, and select the folder where you keep Akira.
{% endstep %}
{% endstepper %}

Add the whole folder, not just the .exe. Akira writes runtime files alongside it, and if those get scanned mid-launch you'll hit the same problem again.

### Other antivirus products

The exclusion path looks similar in other products. Look for "Exclusions," "Exceptions," "Allowlist," or "Trusted files" in the settings. If you can't find it, search "\[your AV name] add exclusion folder."

Only whitelist software you actually trust. If anything on this page felt off, don't.

## What we will never do

To be completely explicit, Akira will never:

* Read or transmit your Minecraft credentials, session tokens, or account data beyond what is required to authenticate to Akira itself
* Touch your browser, browser data, password manager, crypto wallets, or Discord token
* Persist after uninstall (no scheduled tasks, no services, no registry survival)
* Communicate with any server outside `akiraghost.com` and its CDN
* Modify any process other than the Minecraft process you launched it against

If you ever see network traffic, file access, or process behavior outside that list, tell us immediately. That would be a compromised build and we want to know about it.

## Still concerned?

Open a ticket in our Discord with:

* The exact detection name your AV reported
* The AV product and version
* A screenshot of the alert

We'll go through it with you.