Class.exe is probably a packed .exe (it's been compressed to take up less disk space), seeing it's supplied by a warez group. Packed executables often trigger a false positive, because the virus scanner sees "compressed" as "obscured", and goes for a "better safe than sorry" approach. While you should of course be cautious with everything warez0rized, this sounds like such a false positive.