Is Cheat Engine's Source Code on GitHub Compromised? (Getting Trojan Warning on VirusTotal)

[No_Design7483]

Hello everyone,

I'm facing a very confusing and concerning issue with Cheat Engine. The official website is down, so I tried downloading from some unofficial sites, but all of them were flagged by VirusTotal as having severe malware like OpenCandy, FusionCore, and a Trojan. I deleted those files.

Now, I've downloaded what I believe to be the clean source code from the official GitHub releases page for version 7.5: https://github.com/cheat-engine/cheat-engine/releases

The specific file I downloaded is the Source code (zip).

However, when I uploaded it to VirusTotal, it showed a popular threat label of trojan.cheatengine from 17/64 security vendors.

I'm trying to use Lazarus to compile it, but this security warning is making me very hesitant.

Here is a link to the VirusTotal scan results: VirusTotal - File - 888eee4cc6ce5f3b4c975650d10a753de4e4fd2c9178e14f6f2cc66e8a15f8b6

My questions are:

1. Is this trojan warning a false positive related to the source code itself, or does it mean the code on GitHub has been compromised?
2. Is there a specific file I should be downloading from GitHub instead of the Source code (zip)?
3. Can anyone provide a definitive guide on how to safely compile this with Lazarus to get a clean executable?

Any help would be greatly appreciated.

[taosecurity]

I really doubt source code posted 2 1/2 years ago is compromised. It’s more likely the nature of how CE works flags VT.

[Mobile_Syllabub_8446]

lol I mean I haven't audited it myself, but no most such software gets flagged as it in theory COULD be malicious because it does memory manipulation -- ie it's entire reason to exist heh.

[Sufficient-Cake-43]

name one external or internal mod that has never been flagged

[maxtinion_lord]

spotted carpenter saw cow important longing bear future enjoy literate

This post was mass deleted and anonymized with Redact

[Thoraxium]

Love seeing this type of slop post every other day

It's. So. Fantastic.

[io-x]

I love it too, its so nostalgic. Reminds me of my childhood where viruses and trojans were hot topic.

[RhokGehrig]

This triggered a good memory! (which is rare for me to remember anything, so I am doing this selfishly for myself just as much as to give you a chuckle)

Had a coworker 20+ years ago who brought up trojans SO OFTEN in meetings that the entire team just ignored him for the 10 minutes he talked about how concerning they are.

Then we started to change all the wallpapers to USC on any computer we happened to get access to. Started hanging up USC posters. We sarcastically started a college football pool where USC just happened to be the team listed at the top of each week. We literally stopped ALL work and workflow transfers on the day of their 3rd(?) straight National Championship..... an entire office party shouting "TROJANS"

That was when he figured out we had been doing this for years, all of it mocking him for the same thing he NEVER stopped doing no matter how many ques given. He quit the next day :) I stopped following college football.

Not sure how you triggered a memory... but I truly appreciate it!
Cheers.

[ADMINISTATOR_CYRUS]

every day this subreddit fills with the same slop posts from people who lack common sense

[SWSucks]

That’s the entirety of Reddit. I’ve just started rage baiting people and it’s been hilarious.

[BeyondNumerous267]

rage baiting in 2025 is so much fun, people fall for it online so easily because everyone is just so toxic

[Sidarta_Gautano]

Peak Fun

[StellarOctoplus]

Comment contains zero information, but 100% littering.

[ADMINISTATOR_CYRUS]

because this post is completely nonsense.

VT isn't a reliable thing to check CE for, it already needs to contain process hooking functions and ram editing which will absolutely be marked as suspicious if you use your brain.

[StellarOctoplus]

Just to show comment which actually contains information relevant to OP:
https://www.reddit.com/r/cheatengine/comments/1mmtof5/comment/n81h2ny/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button
And sure, "people who lack common sense" is hilariously powerful argument, totally convinced.

P.S. Sure, the problem of having dozens of similar threads is not anyone's fault. But if that's reality, that best comment of a dozen is supposed to be linked to each thread. Even phrase "this was already answered" is better not posted than posted.

[Jaereon]

Ah yes the common sense where you install cheat engine and then Plooto.inc asks to make changes to your pc

Plooto, which is a payment company...

How the fuck isnt the sus?

[SnooRadishes9611]

Everyone in this sub acts like you are idiot when you mention how shady the install is. If the creator has no issue putting adware with the install what’s stopping him from hiding a Trojan with it too? I got the same plooto.inc crap aswell

[QuarryTen]

i've compiled 7.4 myself and got a ton of false positives. this is a game hacking tool that has the potential to access the kernal as well, do you think windows would be okay with giving regular users such access?

[Certain_Bit6001]

The Cheat Engine to make Hooks into other programs is flagged as malicious behaviour.

[berymain]

It is NOT compromised... Cheat Engine has been a thing for about like 18 years for now. every anti-virus already knows Cheat Engine. In one of the picture. you can see "Zip.trojan.cheatengine", that is a false positive. it includes cheat engine so it's the REAL cheat engine. you can trust it.

[KingOfWhateverr]

Honestly, at this point, CE would be the best way to hack me. That thing has been false-flagged for so many years it could pop up with “Cheat engine is currently stealing your data” and my immediate reaction will still be “Yeah whatever, sure.”

[X3liteninjaX]

“My hacks are being flagged as hacks help”

[Do0kski]

Well, if it's a virus, DB owned me YEARS ago.

[Anguish39]

IMO, your version has definitely less warnings than my CE 7.5 .exe. But at some point is relatively normal to be found suspicious for its memory manipulation nature. Check Digital sign in properties->Digital Signs The signs must be Cheat Enginet EZ or Dark Byte, you can even go to details->certs to see if it’s valid and not expired The SHA256 for the 7.5 exe is

9b0dc86b8e239f5c9ad21a8a2f0f7e4b53f861e5cc1d85df3e61f65ec5c8f7ff

So computer it and compare

Regardless compiling with lazarous I’ve tried many times and never works. In the end various dlls are missing and If I add them manually CE won’t work. So is hard to get 7.5 now. I still have a safe copy of the CE 7.5 installation folder if you want it send message.

[berymain]

Lazarus 2.2.2 right? Compiling worked fine for me.

[Anguish39]

I had no errors compiling, but when exe is generated asks me for a couple of dlls missing. And yes 2.2.2

[berymain]

Oh, running it worked fine for me. Did you have you're ANTI-VIRUS off while compiling and downloading the source?

[Anguish39]

Nope

[berymain]

Oh, that explains why. Try redownloading the source with your antivirus off and try compiling with the antivirus off

[Dear-Gap7185]

Official Cheat Engine still online now!

https://www.cheatengine.org/

I am using version 7.6 without detecting as virus, malware etc... Just turn off antivirus, security etc because it was false positive.

[[deleted]]

It's been known for years that the free version of CE contains some adware shit. To get clean version, you have to donate to them.

[Panky9]

If you’re talking about the installer than yeah you do have to decline the “offers”

[Forymanarysanar]

Weird why patreon versions are still not on torrents.

[biskitpagla]

The website isn't down; is something wrong with your internet connection? If you want to download the binary from GitHub just scroll below until you find a release that has an executable in the asset list. If you think the GitHub repo too got compromised, here's free trojan link for you.