Microsoft security software detects and removes this threat.

This tool generates software keys.

Malware is often installed along with this tool. Microsoft security software finds malware on more than half of the PCs where we detect this tool.

You can read more about Win32/Keygen in Volume 13 of the Security Intelligence Report.

Find out ways that malware can get on your PC

What to do now

Use the following free Microsoft software to detect and remove this threat:

You should also run a full scan. A full scan might find other, hidden malware.

Get more help

You can also see our advanced troubleshooting page for more help.

If you’re using Windows XP, see our Windows XP end of support page.

Threat behavior

HackTool:Win32/Keygen is the detection name for a tool that generates keys for software.

Because HackTool:Win32/Keygen is often distributed the same way as malware, you may be at risk of further infection. A common social engineering tactic used by malware is to masquerade as Keygens, in an try to trick you into downloading and running the malware.

In the past, we have seen malware present on more than half the PCs where we detect HackTool:Win32/Keygen; you can read more about this in the Volume 13 of the Security Intelligence Report.

The following are some threats often detected on PCs with Win32/Keygen:

Win32/Keygens may have any number of interfaces, depending on the keys or serial numbers they are generating. The following is one example of a serial number generator for Adobe Photoshop CS3:

Further reading

Volume 13 of the Security Intelligence Report takes a more detailed look at Win32/Keygen.

You can find out more about software piracy, and the risks associated with software piracy on Microsoft piracy site.

Analysis by Jasmine Sesso & Francis Allan Tan Seng


Alerts from your security software may be the only symptom.


Alert level: Medium
First detected by definition:
Latest detected by definition: and higher
First detected on: Oct 07, 2008
This entry was first published on: Jul 16, 2009
This entry was updated on: Aug 22, 2014

This threat is also detected as:
  • Troj/Keygen (Sophos)
  • Crack (VirusBuster)
  • not-a-virus:Keygen (Kaspersky)
  • CRCK_KEYGEN (Trend Micro)