SECURITY & VIRUS SCANS
CHECK IT
BEFORE YOU RUN IT.
Every Aurora Forge release is uploaded to VirusTotal, which scans it with around 75 antivirus engines at once. The results are public and linked below, so you do not have to take our word for it. The full source code is published too — if anything still looks suspicious, read exactly what the app does.
2-Series 2.2.8 — scan results
Last scanned 2026-11-09. A clean result means no engine reported the file as malicious.
| File | Result | VirusTotal report |
|---|---|---|
Setup 2.2.8 (Windows installer)DF1150C5…37A984B1 |
0 of 75 engines 39 clean, 28 timed out |
Open report |
Loaders Setup 2.2.8 (WWE 2K26)31723A6C…5B622355 |
1 of 75 engines VBA32 heuristics only — see below |
Open report |
28 engines timed out on the 313 MB installer; that is a VirusTotal size limit, not a detection. Every mainstream engine — Microsoft Defender, Bitdefender, Kaspersky, ESET, Avast, AVG, Norton, McAfee, Sophos and Trend Micro — reports the installer clean.
About the one loaders installer warning
VBA32 (VirusBlokAda) flags the loaders installer as Malware-Cryptor.NSISex.Heur. That is a generic heuristic aimed at NSIS installers — the installer engine every Windows app builder uses — and it is a documented false-positive class:
nsis.sourceforge.io/NSIS_False_Positives
The loaders installer writes three DLL loaders into the folder you pick, backs up anything it replaces, and makes no network requests. You can confirm that from the source. No other engine reports it.
If you see a YARA match for “NSIS Integrity Check function”, that is not a detection either. It matches the integrity-check routine that the NSIS installer engine compiles into essentially every NSIS installer, not anything Aurora Forge does. The same applies to the “packer: overlay” and “obfuscated” tags — every NSIS installer carries its payload as an overlay.
Verify what you downloaded
The published checksum list is at downloads/SHA256SUMS.txt. Compare it locally:
PowerShell: Get-FileHash .\AuroraForge-NT100-Setup-2.2.8-x64.exe -Algorithm SHA256If the hash matches, the file is byte-for-byte what was scanned and published. If it does not match, do not run it.
Why does Windows SmartScreen still warn?
The installers are not code-signed yet. Windows treats any new unsigned installer as unknown, and antivirus heuristics give unsigned files less benefit of the doubt. Signing certificates cost several hundred dollars a year and require identity verification; it is on the roadmap.
Until then: the scan results above, the published checksums and the source code are how you check a build. Nothing here executes anything hidden — the app edits your own game files and project folders, and the source is there to read.