uTorrent Flagged as ‘Threat’ by Microsoft and Anti-Virus Vendors
This week several Windows users noticed that the popular BitTorrent client uTorrent was suddenly being flagged as a threat. While details are scarce, Windows Defender and some other anti-virus vendors list the application as "Potentially Unwanted Software." BitTorrent Inc. sees the warnings as false positives but also stopped serving what it believes to be the problematic release.
Installed on dozens of millions of devices, uTorrent is the go-to torrent client for people all around the world.
While the software usually runs without hassle, many users started to experience problems recently. Several anti-virus tools, including Windows Defender, suddenly labeled the torrent client as dangerous.
Microsoft categorizes the affected clients as “Potentially Unwanted Software,” as can be seen below. The company has had a dedicated Utorrent page for a while, labeling it as a severe threat. This week, however, alarm bells started to go off on a broader scale.
uTorrent threat
https://torrentfreak.com/images/utorrentthreat.png
It’s unclear what exactly triggered the recent warning. According to VirusTotal, a handful of anti-virus companies label uTorrent as problematic. ESET-NOD32 lists “Web Companion” as the trigger, which likely points to Lavasoft’s Ad-Aware software, which is sometimes bundled with uTorrent.
uTorrent parent company BitTorrent Inc. is aware of the problems but believes they’re false positives triggered by one of their recent releases.
“We believe that this passive flag changed to active just hours ago with the Windows patch Tuesday update, when a small percent of users started getting an explicit block,” the company told us.
“We had three uTorrent executables being served from our site. Two were going to 95% of our users and were not part of the Windows block. The third, which was going to 5% of users, was part of the Windows block. We stopped shipping that and confirmed we are no longer seeing any blocks.”
The issue doesn’t appear to be restricted to new installs only. Several users have reported that their uTorrent application was suddenly quarantined as unwanted software, possibly after an automatic update.
We rechecked the VirusTotal result with the most current uTorrent release, and this is still flagged by six anti-virus vendors.
VirusTotal results
https://torrentfreak.com/images/virustotal.png
But that’s not all. The uTorrent download page itself also triggers a warning from MalwareBytes’ real-time protection module, which brands the website itself as malicious.
Interestingly, when trying to install uTorrent, Windows lists Lavasoft Software Canada as the verified publisher. While Lavasoft’s “Ad-Aware WebCompanion” is regularly bundled with uTorrent as an ‘offer,’ we didn’t get that option when we last tried, nor was it installed.
After we installed it during an initial test yesterday, we did notice that WebCompanion was installed around the same time. However, we have been unable to replicate this result.
BitTorrent Inc. stresses that any of the offers users get during the install process are optional, Google-compliant, and in accordance with the Clean Software Alliance (CSA) standards.
Whatever is causing the red flags at Microsoft and the other companies remains a mystery for now, also for BitTorrent Inc.
“Based on our best assessment to date, we’ve found no reason why we would be blocked – especially on some builds and not others which are basically identical,” BitTorrent says.
“We are continuing to reach out, though, and hope to have more information,” the company adds.
Source: Torrentfreak.com
