How Do I Exclude RawCheats From Antivirus?

Antivirus folder exclusions for cheat loaders are a Microsoft-supported configuration documented in the official Defender administrator guide. The same workflow applies to every major third-party AV — the menu paths differ but the concept is identical. Below is the step-by-step for each common product.

Windows Defender (built-in)

1. Open Windows Security from the Start menu (search "Windows Security")
2. Click Virus and threat protection
3. Under Virus and threat protection settings, click Manage settings
4. Scroll to Exclusions
5. Click Add or remove exclusions (UAC prompt)
6. Click Add an exclusion, choose Folder
7. Browse to %LOCALAPPDATA%\RawCheats and confirm
8. Repeat for the Raw Spoofer folder

Microsoft's official guidance covers this as a normal admin task. Folder-level exclusions skip both scheduled scans and real-time protection inside the excluded path.

ESET

1. Open ESET HOME or Smart Security UI
2. Setup to Advanced Setup to Detection Engine to Exclusions
3. File and folder exclusions to Edit
4. Add to Folder
5. Browse to RawCheats folder, add wildcard \* for subfolders
6. OK and Save

Avast / AVG

1. Menu to Settings
2. General to Exceptions (Avast) or Exceptions (AVG)
3. Add Exception, select Folder
4. Paste RawCheats path
5. OK

Kaspersky

1. Settings (gear icon)
2. Threats and Exclusions to Manage exclusions
3. Add, choose Folder, browse to RawCheats
4. Save

Bitdefender

1. Protection to Antivirus to Settings to Manage Exceptions
2. Add an Exception, choose Folder
3. Browse to RawCheats path
4. Save

Malwarebytes

1. Settings to Allow List
2. Add to Allow a folder
3. Browse, select RawCheats folder
4. OK

Why folder exclusion and not file exclusion

File-level exclusions break on every loader update because the binary's path or hash changes. Folder-level exclusions persist across updates — the loader's auto-update mechanism writes new binaries into the same folder and Defender ignores all of it. This is also why Microsoft recommends folder-level for legitimate developer tools and IT admin scripts.

Don't exclude the whole drive

Tempting and wrong. Excluding C:\ removes Defender from anything outside Windows\ and Program Files\ — that's most of your user-writable surface. Excluding the precise RawCheats folder limits the trust window to exactly the binaries we ship.

Verify the exclusion took

Drop the loader binary into Defender's Submit a sample portal — if Defender returns "no threat detected" while your local quarantine is empty, the exclusion is active. Or just restart the loader; if injection succeeds without a Defender popup, exclusion is working.

Network-level exclusion

If you run a network-level threat scanner (pfSense IDS, Cisco Umbrella, ESET LiveGrid), the cheat traffic to update.rawcheats.com and api.rawcheats.com needs to bypass deep packet inspection. Whitelist those domains in the security appliance. Most home users don't have this layer.

Group Policy / Intune

Corporate-managed Defender via Intune or Group Policy can block local exclusions. If you're on a managed laptop and the Exclusions section is greyed out, the policy blocks you. Use a personal machine for cheat workflows — running on a managed corporate machine is bad opsec for unrelated reasons too.

After exclusion

Restart the Raw loader. The first run after exclusion may show a Defender "permitted" toast notification — normal. Subsequent launches are silent. For the broader Defender context see does Windows Defender flag RawCheats. For injection troubleshooting see troubleshoot injection issues.