← Back to game

Antivirus False Positives

Last updated: 2026-10-18

The Windows and macOS editions of Rogue's Cog are distributed through Steam. Now and then an antivirus product flags a new build of an indie game as suspicious. Here is what that usually means, how to check that your copy is the one we shipped, and how to get the flag removed.

1. My antivirus says this is malware. Is it?

Almost certainly not. Rogue's Cog is built on Electron, which packages a Chromium and Node.js runtime into every app. Several antivirus engines use broad heuristics that flag freshly released Electron executables they have not seen before. These are generic detections (names like Trojan.Generic, Heur.AdvML.B or ML/PUP), not identifications of a specific piece of malware.

About signing: the Windows executable is not code-signed (no Authenticode signature). We ship it only through Steam, and Steam checks every installed file against the build manifest we upload. That missing signature is one reason some engines treat the file as "unknown". The macOS app is signed with Nestwell Studio LLC's Apple Developer ID and notarized by Apple.

2. How do I check my install is genuine?

The most reliable check is Steam's own integrity check:

  1. In your Steam Library, right-click Rogue's Cog and choose Properties.
  2. Open Installed Files and click Verify integrity of game files.

Steam compares every file against the build we published and re-downloads anything that does not match. If it finishes without replacing files, your install is byte-for-byte what we shipped.

If your antivirus quarantined the game's executable, restore it from quarantine (or add an exclusion), then run the integrity check above so Steam can confirm or repair it.

3. VirusTotal says some engines flag it

You can look up the executable's hash on VirusTotal without uploading anything. In Steam, choose Manage → Browse local files on Rogue's Cog to find the install folder, then get the SHA-256 of the executable: 

# Windows (PowerShell, in the install folder)
Get-FileHash .\RoguesClimb.exe -Algorithm SHA256

# macOS (Terminal, in the install folder)
shasum -a 256 RoguesClimb.app/Contents/MacOS/RoguesClimb

Then open https://www.virustotal.com/gui/file/<sha256> with your hash in place of <sha256>. (The executable keeps its original internal file name, RoguesClimb; the game displays as Rogue's Cog.) A handful of generic heuristic flags out of roughly 70 engines is normal for a new Electron release.

If a flag names a specific malware family (for example Emotet or WannaCry) rather than a generic heuristic, stop: do not run the file, and email support@roguescog.com with the hash and the detection name so we can investigate right away.

4. How do I report a false positive to the vendor?

Antivirus vendors take false-positive reports directly, and you do not need to be their customer. Each submission takes a few minutes, and vendors usually respond within a few days.

Microsoft Defender
  1. Go to Microsoft's file submission page.
  2. Choose the home-customer option and upload RoguesClimb.exe.
  3. Choose the option for an incorrect detection and paste the text below.
Norton (Gen Digital)
  1. Go to submit.norton.com.
  2. Choose the false-positive option and upload RoguesClimb.exe.
  3. Paste the text below into the comments field.
Avast / AVG
  1. Go to avast.com/report-false-positive.
  2. Upload RoguesClimb.exe and choose the incorrect-detection reason.
  3. Paste the text below.
Bitdefender
  1. Go to Bitdefender's incorrect-detection page.
  2. Use the upload form and choose the false-positive option.
  3. Paste the text below.

For other vendors (McAfee, Kaspersky, ESET, Trend Micro and so on), search for "vendor name false positive submission". Every major vendor has a re-analysis form. Text you can paste into any of them: 

False-positive report: Rogue's Cog (Nestwell Studio LLC)

Rogue's Cog is a commercial Electron game by Nestwell Studio LLC,
distributed through Steam.
File: RoguesClimb.exe
SHA-256: {paste the output of Get-FileHash}
The Windows executable is not Authenticode-signed; its integrity is
verified by Steam against the published build manifest.
Please re-analyse the file and remove the heuristic detection.

5. macOS says the app can't be opened

The macOS build is signed and notarized, so Gatekeeper should open it without a warning. To check the signature yourself, run this in Terminal from the install folder: 

codesign -dv RoguesClimb.app
# Look for: Authority=Developer ID Application: Nestwell Studio LLC

spctl -a -t exec -vv RoguesClimb.app
# Look for: accepted  source=Notarized Developer ID

If the signature checks out but your Mac still refuses to open the game, it may be a managed Mac whose security profile only allows specific developers. Show the output above to your IT administrator.

6. Windows showed a "Windows protected your PC" dialog

That SmartScreen dialog appears for files downloaded through a web browser. Games installed and launched through Steam do not normally trigger it. If you see it, make sure you are starting Rogue's Cog from your Steam Library, and run the integrity check in section 2.

7. How do I tell us about it?