Why does my antivirus say a recomp is a virus?
Recomps (what is a recomp?) are brand-new programs that few people have run yet. Antivirus software trusts programs by reputation, digital signatures and patterns. A fan port usually has no paid code-signing certificate and no download history, and it does unusual things: it reads game files, compiles code or patches memory. Those traits can trigger a heuristic warning even when the file is clean.
Real projects run into this regularly. The Skate 3 Recomp team, for example, said in its 2.0.1 release notes that some antivirus engines flagged its files. The fix was to add proper version information, and the team reported the false positive to Microsoft.
False positive or real malware: how to tell
| Sign | Probably a false positive | Probably dangerous |
|---|---|---|
| Where you got it | The project’s own GitHub releases page | A video description, a forum mirror or a “download” site |
| What you downloaded | A zip file with the program, as the README describes | An installer, a “launcher” or a password-protected archive |
| Detections on VirusTotal | One to three engines, with generic names | Many engines, or names like “stealer”, “trojan” or “RAT” |
| What the page asks of you | Nothing unusual | Turn off your antivirus, or paste a command into a terminal |
| Who else uses it | Open issues and discussion on the project page | No issue tracker, new account, comments switched off |
How do I check a recomp safely?
- Check the source. Find the project’s official page from a site you trust, such as its port page on Is It Ported?, not from a video description.
- Compare the file. Make sure the file name and version match the latest release on the official page.
- Scan the exact file. Upload it to VirusTotal. One or two generic detections on a fresh release are common. Detections named after password stealers are not.
- Read the project’s notes. Real projects usually mention known false positives in their release notes or issues.
- Don’t disable your protection. If your antivirus quarantines a file from the official page, restore that one file or add an exception for it. Never switch protection off completely.
Are there fake recomps?
Yes. Attackers copy the names of popular projects because people search for them. Security researchers have found fake GitHub repositories posing as game tools and emulators, including fake PlayStation 5 emulators, that delivered password-stealing malware. McAfee Labs also reported links in YouTube video descriptions that led to such repositories. A fake recomp often looks like this:
- The repository is new, has no history and shows only a download link.
- The README promises a finished port of a big new game, often one that no real project has released.
- The download is a password-protected archive “to avoid detection”.
- Comments or issues are turned off.
What about recomp launchers?
Real recomp launchers download ports from each project’s own release page. They never include the game itself. Treat any “launcher” that offers to install a commercial game in one click as fake. Our launchers page lists the real ones and where to get them.
Is it safe to play recomps at all?
Recomps from their official project pages are generally as safe as other open-source games. Their code is public, and other players report problems quickly on the issue tracker. The risk is in copies: a recomp downloaded from anywhere else can contain anything.
Why do fake downloads target recomp fans?
Recomp fans are used to antivirus warnings. Real projects often tell players that a detection is a false positive, so people learn to click past it. Attackers use that habit: a fake page says the warning is “normal” and asks you to turn protection off. Malwarebytes warned on 18 Jun 2026 that retro gaming fans had become a target on GitHub. In that case, fake repositories posed as a PlayStation Vita audio tool, and the zip file installed a loader for password stealers. The safe rule is simple: accept a false positive only for a file from the project’s own page, never for a copy.
What does a real recomp download look like?
- It sits on the project’s releases page, next to the source code and the release notes.
- It is a zip or tar file named after the project and its version, not an installer for “the full game”.
- The README explains which files you need from your own copy, and where to put them.
- Other players discuss each version in the project’s issues or Discord, including any antivirus problems.
If one of these is missing, wait for others to confirm the download before you run it.
What should I do if I already ran a fake download?
- Disconnect the PC from the internet.
- Run a full scan with your antivirus and a second scanner.
- From another device, change the passwords of your email, game stores, Discord and banking, and turn on two-factor sign-in.
- Check your accounts for sign-ins you don’t recognize.
- If you entered payment details, contact your bank.
How does Is It Ported? check ports?
We download every port from its official page and play it on real devices. We also check the site that hosts it for pop-ups, redirects, fake download buttons and malware flags. Every port page shows that check and its date. When we find a fake copy of a popular port, we name it on that port’s page so others can avoid it.
Sources
- Skate 3 Recomp v2.0.1 release notes (antivirus false positives)
- GitHub's dark side: malware disguised as cracks, hacks and crypto tools
- Fake PS5 emulators on GitHub spread malware to gamers
- What is a false positive Avira Antivirus detection?
- Retro gaming fans are the new target for fake GitHub malware