Uploading fakes to a BitTorrent network is relatively easy, but keeping the torrents active is a much more difficult task. The moderation teams on private trackers remove fakes as soon as they appear – if people are stupid enough to even try to upload them. Other directories such as The Pirate Bay and Mininova, however, are more difficult to police due to their open nature but these sites continually battle fakes too.

There are several forces driving this phenomenon. Of course, the likes of the MPAA and their partners like to upload fakes in order to waste downloader’s time and to monitor their activities. That said, there are others who are uploading fakes in order to make themselves money, with many of the fakes simply encouraging the use of malware such as Domplayer, or sending the user ostensibly to get passwords to view the video, but in reality directing them to spammy sites.

Unless you’ve been on Mars for a few years, you will be aware that aXXo is one of the strongest BitTorrent-related brands and as such, the aXXo name is ripe to be exploited with fake torrents and the schemes behind them. This morning, Mininova was bombarded with hundreds of fake aXXo torrents linking to various malware and spam schemes. Luckily the moderation staff at Mininova are very much on the ball, and their skills and experience allowed them to remove them very quickly. Indeed, the thousands of users at Mininova also help by informing the site that a torrent is not what it should be, but it’s an on-going battle.

When a fake is removed from the site, the IP address of the uploader is also banned, meaning that unless the uploader gets himself a new IP, he won’t be able to upload any more. However, the problem is a lot deeper than just the odd person here and there uploading a fake. Just recently malware and spam peddlers have been advertising online for people to work for them on a freelance basis, uploading fakes to torrent sites and getting paid for each one. Hundreds, maybe thousands of people have taken them up on their offers, getting paid around 20 cents for each successful upload. The scammers mitigate the effects of their worker’s IPs being banned by torrent sites by advertising for people with dynamically assigned IP addresses, while encouraging them to use proxies.

We spoke with Moe1210 at Mininova who told us that for them, although time consuming, the aXXo fakes are easiest to spot, and they are often removed from the site in a matter of minutes. However, due to these teams of hired individuals doing the uploading, the sheer number of fake torrents is significant. Even though the mod team are checking the site every 5 minutes, sometimes in that period 50 fakes could’ve been uploaded. On a regular day, the amount of fakes uploaded can reach 2,500.

In the ongoing battle the scammers are getting a little smarter, adjusting the way they operate as the challenge is met by Mininova. They became aware that at certain times of the day the fakes stayed on Mininova for longer periods before being removed, which was down to fluctuating staffing levels due to people having to sleep, rest and venture back into real-life every now and again. To counter this, Mininova now have a worldwide team which cover the major time zones.

Speaking of fake aXXo torrents, Moe1210 told TorrentFreak, “It’s a pretty pointless task uploading a torrent with aXXo in the title trying to trick people [on Mininova]. I’d say that 75% – 80% of our members know that if the torrent is not from aXXo’s account, its fake – meaning, if they check the ‘general’ tab and aXXo’s name is not in red letters, it’s fake! They [the scammers] have no way of spoofing this.”

Many fake torrents are using a tracker located at http://bt9.c7q.fast1010.info, which is hosted with Ecatel in The Netherlands. In order to trick users into believing the torrents it tracks are real, the tracker is faking the download statistics, as can be seen with this fake on TorrentPortal, which at the time of writing is reporting 76278 seeders and 82380 leechers.

The torrent contains an unusable video and a password.html file which claims to reveal a password to play the file, but instead leads the user into a quagmire of spammy sites.

Users looking to avoid these fakes should read our previous article entitled Stop Downloading Fakes and Junk From BitTorrent. In the meantime be aware that the same people behind the aXXo fakes are behind file names such as ‘Race to Witch Mountain 2009 DVDRIP XviD BangeR’, and ‘Watchmen 2009 DVDRIP SeedeRz’.

As a final thought, TorrentFreak asked Ecatel if they intend to do anything about the fakes tracker. They told us, “Ecatel does not allow any spam and malware in its network.” And then it became clear. The tracker hosted at Ecatel doesn’t host the content, the users do – like all trackers. Sometimes the law’s such an ass.

Article from: TorrentFreak, check out our new blog at FreakBits.

Other people get other problems such as torrents never finishing or when they watch a downloaded video it turns out to be completely the wrong thing – i.e the file was deliberately mislabeled. Sometimes the video download is of such poor quality it’s simply unwatchable and of course all this adds up to a lot of frustration and wasted time.

There are many techniques employed by experienced file-sharers to ensure that the torrent is what it says it is and of a good enough quality to even bother with. We’ll look at just a few of them here.

Remember that sharing certain types of media via BitTorrent may not be legal in your country.

1. Always read the comments

Before downloading any torrent, it’s always prudent to read the comments on the site. It only takes a few seconds but it’s time well spent. Very often there are requests from previous downloaders for a password to access the file or some might be asking where to download a special video player to view it. Movies should never come as .zip or an .exe file, if they do there is every chance the file comes with some sort of catch. If the movie won’t play with VLC Media Player there’s every chance it’s a fake. Any files needing 3WPlayer, DomPlayer or any that direct to other sites and ask you to fill in forms or install stuff, are also fake.

2. Can the source be trusted?

A good way to find out if a .torrent is real or not is to find out who uploaded the file. There are several well known users that always release new torrents on the same account, aXXo and EZTV are some good examples of such users. If the user is anonymous, you could look at the tracker, and see if it’s widely used. There is no guarantee that files on a well known trackers are safe, but you can almost be certain that files tracked by trackers such as bittorrent.isthebe.st are fake.

3. Is the file actually released already?

Many people use sites such as VCDQuality and Nforce.nl (sites that rates the quality of media releases on the internet) to not only ensure that the video is of a good quality, but also to weed out malfunctioning releases and identify real ones. Recently a movie producer was grateful to the BitTorrent community for spreading his movie ‘The Man From Earth‘, so we can use this movie as an example:

The VCDQ page shows a lot of information but let’s look at the box marked ‘folder’. Here you can see the release name. By copying and pasting this exact filename into Google, a list of almost guaranteed non-fake torrents appear.

4. TorrentSpam?

Another place to check is TorrentSpam. If you already have a torrent file in your possession, you can either paste the full name (or hash value, obtainable from the ‘general’ tab in uTorrent) into their search engine and if someone has reported this as a bad torrent, the results will be shown. Equally, if despite all the measures you still end up downloading a bad torrent, its possible to report this fact for the benefit of other TorrentSpam users in the future.

Do you have any tips or tricks not mentioned here that you would like to share? Feel free to leave a comment!

4. Other suggestions

We asked Matthijs from Mininova for some good tips on how to avoid downloading fake or scammy torrents and he came up with the following suggestions in addition to what we already posted.

In the end it’s experience alone that helps identify the fakes. Most people who have been file-sharing for a little while can easily spot these bad torrents but it’s clearly not so easy for the novice, judging by the number of emails we get at TorrentFreak each week. Let’s hope that number reduces soon.

Article from: TorrentFreak, check out our new blog at FreakBits.

All of the malware we’ve reported on comes from the same 2 servers found at 69.72.144.122 and 207.44.244.86 and this new kid on the block is no different.

DomPlayer is the latest malware to get on BitTorrent user’s nerves. In the last article on this issue we already discovered that the DomPlayer domain was sitting dormant but we didn’t know what it would become. It’s live now and here’s the deal:

Someone downloads a TV show (very often an aXXo fake) via BitTorrent. When the file is played, a message appears:

This video can only be played in DomPlayer, Visit Download.Domplayer.Com

On arrival, the user is greeted with a nice shiny site to distract them from the fact this is an elaborate trick based on DRM’ing previously-free media and forcing users to take steps to unlock it.

This is where DomPlayer differs from the other malware media players we’ve report on. The site claims: “DomPlayer is 100% clean, no bundled software!” At this stage, it doesn’t appear to install any intrusive adware etc on the host PC – there is a different trick up this 945K installer’s sleeve.

When it’s run, it’s believed the software locates the user, directs him to a telephone hotline appropriate to his country and instructs him to call it via cellphone. The call leads to the ‘activation’ of the DomPlayer software but ends up costing the user money.

If the user is in a country ‘unsupported’ by DomPlayer’s payment system, he will be directed to the 3WPlayer site where he can install 3WPlayer and a load of malware onto his PC, completely free of charge.

Although fake aXXo releases are known to be a frequent target of this scam, other media is also affected so many file-sharers find it prudent to check the comments on the site before they download a torrent.

UPDATE: Reports suggest that software is now available to play 3WPlayer (and possibly DomPlayer) files without getting either player. This software is untested by TorrentFreak.

UPDATE 2: Software to crack 3WPlayer, WinZix can also be found here. Click here for the .torrent.

Article from: TorrentFreak, check out our new blog at FreakBits.

However, there are companies out there who give you ‘free’ software (like a torrent client) but at the same time install some of that extra stuff you don’t want too. We have regularly reported on BitTorrent clients which also install this malware such as Torrent101, BitRoll, TorrentQ and GetTorrent. These are just a handful of bad clients currently available online.

It didn’t take much research to discover that a Swedish company called Wakenet is behind the enterprise, a company that made news on lots of spyware sites due to its Anti-Leech plugin.

Wakenet has a new domain called uvTorrent.com (currently diverting to their Cash4Downloads site) – no prizes for guessing the planned confusion with novices and the official ‘uTorrent’ client. They also have a new (fake) ‘compression’ utility called Winzix, obviously named to be confused with Winzip. Unfortunate downloaders will download something from BitTorrent, only to learn that it needs to ‘decompressed’ with Winzix in order to work. Installing Winzix again results in malware getting onto the host PC.

Our investigations revealed two major servers carrying the malware-ridden clients, media players, compression utilities and other sites supporting the enterprise:

IP: 69.72.144.122

1. netpumper.com (there’s even a link to this from Wakenet’s homepage)
2. bitgrabber.com
3. bitroll.com
4. c4dl.com
5. cash4downloads.com
6. download.play3w.com
7. get-torrent.com
8. playon.play3w.com
9. winzix.com (additional information from Symantec)
10. bitdownload.org
11. divoplayer.com
12. plugindl.com
13. torrent101.com
14. torrentq.com
15. torrentsoftware.org

IP: 207.44.244.86

1. bitroll.com
2. c4dl.com
3. cash4downloads.com (Click here for removal instructions)
4. download.netpumper.com
5. Uvtorrent.com
6. playon.play3w.com
7. wakenet.se (WakeNet’s own homepage is on the same server)
8. bitsofporn.com
9. domplayer.com
10. gamingtorrent.com
11. kitplayer.com
12. torrentmusic.org
13. torrentgamers.com
14. Torrentspeeder.com (different server currently)

We suggest that everyone stays well away from every site on the above lists. Use uTorrent or Azureus to download and if you ever download anything that requires anything other than a standard media player or WinRAR in order to play, be a little suspicious. Checking the comments to the torrent you plan to download is always a good idea.

For the little more adventurous reader, it’s possible to use the Windows HOSTS file to block the activity caused not only by the malware listed above but also that from hundreds of other sources. We recommend the excellent guide from MVPS, “Blocking Unwanted Parasites with a Hosts File”

UPDATE: Reports suggest that software is now available to play 3WPlayer (and possibly DomPlayer) files without getting either player. This software is untested by TorrentFreak.

UPDATE 2: Software to crack 3WPlayer, WinZix can also be found here. Click here for the .torrent.

Article from: TorrentFreak, check out our new blog at FreakBits.