+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Malwarebytes detects utorrent (/showthread.php?tid=6057435)
Malwarebytes detects utorrent - AlphaTurtle - Mar 16, 2020
Hey, so I just ran Malwarebytes after a while and it is detecting utorrent for some reason.
I know utorrent can be a false positive, but I've heard some of the versions are not the best.
I also remember reading that someone was using an older version of utorrent from a few years back that still works better than any other.
What is your suggestion?
Code
-Scan Details-
Process: 1
PUP.Optional.BundleInstaller, C:\USERS\ALPHA\APPDATA\ROAMING\UTORRENT\UTORRENT.EXE, No Action By User, 503, 799052, , , ,
Module: 1
PUP.Optional.BundleInstaller, C:\USERS\ALPHA\APPDATA\ROAMING\UTORRENT\UTORRENT.EXE, No Action By User, 503, 799052, , , ,
Registry Key: 1
PUP.Optional.BundleInstaller, HKU\S-1-5-21-2272392849-1977043155-1536836044-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\uTorrent, No Action By User, 503, 799052, , , ,
Registry Value: 1
PUP.Optional.BundleInstaller, HKU\S-1-5-21-2272392849-1977043155-1536836044-1003\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|uTorrent, No Action By User, 503, 799052, , , ,
Registry Data: 0
(No malicious items detected)
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 4
PUP.Optional.BundleInstaller, C:\USERS\ALPHA\APPDATA\ROAMING\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk, No Action By User, 503, 799052, , , ,
PUP.Optional.BundleInstaller, C:\USERS\ALPHA\APPDATA\ROAMING\Microsoft\Windows\Start Menu\µTorrent.lnk, No Action By User, 503, 799052, , , ,
PUP.Optional.BundleInstaller, C:\USERS\ALPHA\APPDATA\ROAMING\UTORRENT\UTORRENT.EXE, No Action By User, 503, 799052, 1.0.20814, , ame,
PUP.Optional.BundleInstaller, C:\USERS\ALPHA\APPDATA\ROAMING\UTORRENT\UPDATES\3.5.5_45608.EXE, No Action By User, 503, 799052, 1.0.20814, , ame,
Physical Sector: 0
(No malicious items detected)
WMI: 0
(No malicious items detected)RE: Malwarebytes detects utorrent - Obistone - Mar 16, 2020
It's used for an illegal activity, so it's obvious on why it would be detected.
https://www.ghacks.net/2019/12/09/utorrent-is-flagged-as-malicious-by-several-antivirus-engines-currently/
https://www.extremetech.com/computing/267410-microsoft-begins-flagging-utorrent-as-malware
RE: Malwarebytes detects utorrent - Aura - Mar 17, 2020
It's a false positive. Simple as that.