Jump to content
moeetee

is this a false or real alarm from ESET?

Recommended Posts

I opened up uTorrent and started downloading 2 TV shows from a public torrent website and I receive consistent popups from ESET as show below:

ESETT.thumb.PNG.7e701a41c3e1d3b5019c616782e342b8.PNGESETT2.thumb.PNG.cc3e1e6a95a31811f237b40ceba79efc.PNG

 

I kept clicking on Clean and the popup just kept popping up and continued to download the video files. Once they were done, I did a scan and nothing was found.

 

Is this a false alarm or not? Were their viruses that ESET's scan did not locate?

Share this post


Link to post
Share on other sites

If you would like to use the PUA in question, expand Advanced options, check "Exclude signature from detection" and then click Ignore. Otherwise uninstall the PUA in a standard way.

Share this post


Link to post
Share on other sites
1 minute ago, Marcos said:

If you would like to use the PUA in question, expand Advanced options, check "Exclude signature from detection" and then click Ignore. Otherwise uninstall the PUA in a standard way.

What's a PUA?

Share this post


Link to post
Share on other sites

I don't think I am asking on the options that I know I can choose from, I am talking about the popup and uTorrent. I've used it before so I am not sure why ESET popped up on this. 

Share this post


Link to post
Share on other sites
20 minutes ago, moeetee said:

I am talking about the popup and uTorrent. I've used it before so I am not sure why ESET popped up on this. 

Eset is alerting on the file uTorrent downloaded; not for uTorrent itself. Also detection of uTorrent itself or its downloads is nothing new: https://torrentfreak.com/utorrent-flagged-as-threat-by-microsoft-and-anti-virus-vendors-180312/

 

Share this post


Link to post
Share on other sites
1 minute ago, itman said:

Eset is alerting on the file uTorrent downloaded; not for uTorrent itself. Also detection of uTorrent itself or its downloads is nothing new: https://torrentfreak.com/utorrent-flagged-as-threat-by-microsoft-and-anti-virus-vendors-180312/

 

Hey man, that is not correct. Once I deleted the files and I open uTorrent and nothing is downloading..those popups still occur.

Share this post


Link to post
Share on other sites

The app attempts to update. Upon update, it downloads the installer which is detected. As long as the app will attempt to update, the PUA will be detected. If you want to use it, exclude it from detection as suggested above.

Share this post


Link to post
Share on other sites

Or, disable uTorrent auto updating if that is possible. Then manually download any updates that might be available; preferably from a web site that has "sanitized" the download.

Edited by itman

Share this post


Link to post
Share on other sites
22 minutes ago, Marcos said:

The app attempts to update. Upon update, it downloads the installer which is detected. As long as the app will attempt to update, the PUA will be detected. If you want to use it, exclude it from detection as suggested above.

 

17 minutes ago, itman said:

Or, disable uTorrent auto updating if that is possible. Then manually download any updates that might be available; preferably from a web site that has "sanitized" the download.

I just opened it - disabled auto updates - exited it out. Reopened it and I still get the same thing...Nothing has been dowloaded or current being downloaded.

Share this post


Link to post
Share on other sites

I see now that the event was detected not on a newly created file but when the app attempted to access the installer in the update folder. You can either choose to clean/delete the app in the install folder or exclude the signature from detection.

Share this post


Link to post
Share on other sites
3 minutes ago, Marcos said:

I see now that the event was detected not on a newly created file but when the app attempted to access the installer in the update folder. You can either choose to clean/delete the app in the install folder or exclude the signature from detection.

Okay, I manually deleted those folders and .exe in the updates folder but when I reopen uTorrent these auto appear.ESETTT.thumb.png.df5772b7e4b1b777fc8b4d0f787fdc29.png

Share this post


Link to post
Share on other sites
23 minutes ago, moeetee said:

Okay, I manually deleted those folders and .exe in the updates folder but when I reopen uTorrent these auto appear.

Did you reboot? Appears uTorrent's auto update setting might be a registry setting. This won't take effect until a reboot is performed.

If that doesn't work, your only other alternative is to create an Eset HIPS block rule that prevents utorrent.exe from modifying and deleting files in C:\Users\Moe\AppData\Roaming\uTorrent\updates\*.* .

Share this post


Link to post
Share on other sites
1 minute ago, itman said:

Did you reboot? Appears uTorrent's auto update setting might be a registry setting. This won't take effect until a reboot is performed.

If that doesn't work, your only other alternative is to create an Eset HIPS block rule that prevents utorrent.exe from modifying and deleting files in C:\Users\Moe\AppData\Roaming\uTorrent\updates\*.* .

Let me reboot right now. 

Share this post


Link to post
Share on other sites

Oh and when I deleted those files/folders and I reopened uTorrent, the popup did come up but it came once and when I clicked on Clean. Nothing happened thereafter as uTorrent is running. No reoccurring popups. Buet, let me reboot and see.

Share this post


Link to post
Share on other sites
7 minutes ago, itman said:

Did you reboot? Appears uTorrent's auto update setting might be a registry setting. This won't take effect until a reboot is performed.

If that doesn't work, your only other alternative is to create an Eset HIPS block rule that prevents utorrent.exe from modifying and deleting files in C:\Users\Moe\AppData\Roaming\uTorrent\updates\*.* .

ESETTT4.png.1d412dfcc4a1708e8355b47a904379cf.png

 

 

This is what popped up now.

Share this post


Link to post
Share on other sites

Possible uTorrent created a Win scheduled task that runs at boot time or has modified a registry run key either of which could be performing the update.

Personally, I would just dump uTorrent and find somethng else.

 

Share this post


Link to post
Share on other sites

How do I create a  Eset HIPS block rule that prevents utorrent.exe from modifying and deleting files in C:\Users\Moe\AppData\Roaming\uTorrent\updates\*.* . ?

 

Share this post


Link to post
Share on other sites
3 minutes ago, moeetee said:

How do I create a  Eset HIPS block rule that prevents utorrent.exe from modifying and deleting files in C:\Users\Moe\AppData\Roaming\uTorrent\updates\*.* . ?

 

Refer to Eset in-program online help.

Share this post


Link to post
Share on other sites
34 minutes ago, itman said:

Refer to Eset in-program online help.

Why is uTorrent being detected by ESET in the first place?

Edited by moeetee

Share this post


Link to post
Share on other sites
29 minutes ago, moeetee said:

Why is uTorrent being detected by ESET in the first place?

Quote

use qBittorrent which is open source and virus free. uTorrent is infested with malware and spyware

https://forum.eset.com/topic/5285-eset-detecting-utorrent-as-a-pup-all-of-a-sudden/?do=findComment&comment=29891

Share this post


Link to post
Share on other sites

Save your time with this matter , switch to Deluge or qBittorrent, both are open-source and shouldn't install anything else with your client

Edited by Rami

Share this post


Link to post
Share on other sites
On 9/26/2019 at 1:49 PM, Rami said:

Save your time with this matter , switch to Deluge or qBittorrent, both are open-source and shouldn't install anything else with your client

I will check that out thanks man.

So, I got a popup showing this. This came out of no where, I think I clicked delete or clean all? Why did this popup out of no where?

eseeet28.thumb.PNG.0c31da53efdce81630662096aaab5ae4.PNG

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...