Because trainers modify running processes, Windows Defender and antivirus software will flag them as "HackTool:Win32/Keygen" or "RiskWare." This is a false positive 99% of the time. However, only download from trusted sources to avoid actual malware.