My antivirus says the build has a virus (false positives explained)

You extract a build, or open a front end, and your antivirus shouts “Trojan detected” and whisks a file away. Before you panic: this is one of the most common things that happens in retro gaming, and in the vast majority of cases the file is perfectly fine. It is called a false positive: the antivirus thinks something is dangerous when it is not.

Why emulators get flagged

Antivirus software looks for behaviour that matches known malware. Emulators and front ends happen to do a lot of things that look suspicious to an automatic scanner:

• Low level memory access. Emulators poke at memory directly to pretend to be old hardware, which is also what some malware does.
• No code signing. Big companies pay for certificates that prove who made a program. Small hobby teams usually do not, and unsigned programs get extra suspicion.
• Packed files. Many tools are compressed to keep them small, a trick malware also uses.
• Machine learning guesses. Modern scanners flag anything that “feels” like malware. Detection names ending in !ml or containing words like Generic or Evo-gen are guesses, not confirmed threats.
• Scripts and launchers. Front ends use batch files, PowerShell and AutoHotKey scripts to glue everything together, and scanners watch those closely.
• BIOS files. These are raw dumps of a console’s start up chip with no structure a scanner can check. Some builds need them, and you must supply your own from hardware you own.

Even official releases of big name emulators like RetroArch, MAME and PCSX2 get flagged regularly. Our full article goes deeper: Why Retro Gaming Front Ends Trigger Anti Virus Warnings.

Step 1: check it on VirusTotal

VirusTotal is free and scans a file with 70 or more antivirus engines at once.

1. Go to VirusTotal and upload the single file that was flagged (usually an .exe or script). Do not upload a whole build: images can be tens of GB.
2. Look at the result. A handful of engines flagging it with vague names, while the rest say clean, is the classic sign of a false positive.
3. If lots of engines flag it with specific, named threats, treat it as genuinely dangerous and delete it.

Step 2: get the file back from quarantine (Windows Security)

If you are happy the file is clean:

1. Open Windows Security from the Start menu.
2. Go to Virus & threat protection > Protection history.
3. Find the entry for the file, click it, and choose Actions > Restore (or Allow on device).

Other antivirus products have a similar “Quarantine” or “Vault” section. If a file went missing during extraction, it is often easier to add the exclusion below and simply extract again.

Step 3: add an exclusion for your builds folder

Do not turn your antivirus off completely. Instead, tell it to leave one folder alone:

1. Create a folder for your builds and downloads, for example D:\Emulation.
2. Open Windows Security > Virus & threat protection.
3. Under Virus & threat protection settings, click Manage settings.
4. Scroll to Exclusions and click Add or remove exclusions.
5. Click Add an exclusion > Folder and pick your folder.

Everything outside that folder stays fully protected. Do this before downloading a huge build: some antivirus programs will grab files mid download or mid extraction, which can corrupt a 200GB archive near the end. If that has already happened, see extraction errors.

When to be genuinely careful

Being relaxed about false positives does not mean ignoring every warning. Take more care if:

• The file did not come from the build’s own download box on Arcade Punks or an official project site.
• Lots of scanners flag it, with specific names rather than vague guesses.
• It behaves oddly: asks for admin rights it does not need, opens connections you did not expect, or changes files outside its own folder.
• A file host page tried to make you install a “downloader” .exe instead of giving you the archive. That one, bin. See RapidGator and file hosts.

Searching the file name plus “false positive”, or checking the comments on the build’s post, often shows that others have already been through it.

Still stuck? Read is it safe and legal?, comment on the build’s post, or ask in our Discord.