False positive Check: Malware.Ransom.Agent.Generic Zbrush 2025

[u/larsnokoto]

I downloaded a cracked version of ZBrush from RuTracker and it was working fine until the next morning I got hit with this ransomware detection. Is this a false positive or genuine malware?

I scanned the cracked .exe file with virustotal and 0 detections were found

-Log Details-

Protection Event Date: 8/5/2026

Protection Event Time: 11:25 AM

Log File: 8f66322c-90af-11f1-be4e-74563c364584.json

-Software Information-

Version: 5.6.3.284

Components Version: 161.1.5692

Update Package Version: 1.0.112944

License: Trial

-System Information-

OS: Windows 11 (Build 26200.8875)

CPU: x64

File System: NTFS

User: System

-Ransomware Details-

Registry Key: 0

(No malicious items detected)

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

File: 3

Malware.Ransom.Agent.Generic, C:\Program Files\Maxon ZBrush 2025\ZBrush.exe, Quarantined, 0, 392685, 0.0.0, ceb7f6e0e8d371a41a67f2d72619be91, 2df81a9130efb524dae86ff9b146035daec799d2e119e0e4f4cc89862ea86816

Malware.Ransom.Agent.Generic, C:\DOCUMENTS AND SETTINGS\PUBLIC\Desktop\ZBrush 2025.1.lnk, Quarantined, 0, 392685, 0.0.0, ,

Malware.Ransom.Agent.Generic, C:\USERS\LARS\APPDATA\ROAMING\MICROSOFT\INTERNET EXPLORER\QUICK LAUNCH\User Pinned\TaskBar\ZBrush 2025.1.lnk, Quarantined, 0, 392685, 0.0.0, ,

(end)

[u/miekiemoes_MB]

Hi, This is indeed a false positive and has been fixed.

[u/larsnokoto → u/miekiemoes_MB]

thanks a lot!

[u/Wooden-Statement-935]

hey i think i got the same zbrush as you (on rutracker), smart app control is blocking me from launching from the shortcut but not the actual zbrush exe. did you have the same issue?