We also reported on BitTorrent clients such as Torrent101, BitRoll and GetTorrent, which also caused caused a whole load of trouble for those who installed them – even uTorrent and WinZip users were in the sights of malware offloaders.

In an email yesterday to TorrentFreak, a reader pointed us to a problem torrent located here (removed). The file is clearly labeled as ‘The Wolfman DVDrip 2010 aXXo’ but it is a fake, a fact which can be quickly learned by reading the comments underneath the torrent. Nevertheless, we thought it might be interesting to demonstrate how it’s possible to look a little deeper.

The file is tracked by a whole range of trackers but one sticks out immediately.

http://tracker.torrentq.com/announce.php currently lists 48,416 seeds and 37,496 seeders for the supposed ‘The Wolfman’ movie, a highly attractive proposition for those inexperienced in dealing with fake torrents.

Of course the stats are faked, and are run from a tracker set up especially to deliver fake torrents. Indeed, it’s run on a subdomain of TorrentQ, a bad client we featured in an earlier article. Here’s a quick step-by-step of the method we used to investigate the tracker. There are other ways, but this is pretty simple so anyone can try this out.

It’s possible to find information about the files indexed on many trackers by using ‘scrape’. In the case of the TorrentQ tracker, the scrape URL is located at http://tracker.torrentq.com/scrape.php. So first off, go to this URL and you’ll get the option to download a file, in this case ‘scrape.php’ – download it.

In this file will be information about the files being seeded on this tracker.

Next use DeHackEd’s nice little online tool called DumpTorrentCGI. Browse to the ‘scrape’ file on your hard drive, change output type to ‘/scrape’ and click the ‘decode’ button. You should get this report;

Immediately you can see that all the files are apparently hugely popular, but of course, all of these stats are faked. To prove that, one can use a site like Torrentz.com, which creates its torrent URLs by using a torrent’s hash value. Simply test each torrent by using http://www.torrentz.com/ followed by the hash value, as shown below, and check the comments.

http://www.torrentz.com/0366eb6bdbab88f2ccd9397a0b421b3947c82e06

The torrents TorrentQ tracks are for Wolfman, Legion, My Name is Khan, The Book of Eli, From Paris With Love, Ninja Assassin, Edge of Darkness, Shutter Island and Dear John.

Every single one is flagged as a fake by commenters on Torrentz.com.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Unfortunately, as fast as we report such things, the malware peddlers create yet more bad clients with new names, but carrying the same bad story. However, these guys are very determined to get software such as CIDHELP on your machine, ready to watch your activities and to this end have become quite creative. Recently BitTorrent users are reporting that they have downloaded various pieces of video (usually a TV show) only to be confronted with a message during the first few seconds of the video which advises them to download a new media player called 3wPlayer, in order to view the rest of the file.

The displayed url directs the unsuspecting to the Play3W site, where they are given the chance of installing a shiny new media player.

From the screenshot you will see that there is a ‘more’ button and when you install this player ‘more’ is exactly what you get – more malware in the form of CIDHELP, yet again. It can be difficult task to uninstall it too, especially when you consider the veiled legal threat on the CIDHELP site – the vendor warns you could be in breach of the EULA if you try to remove it with your anti-spyware software. To get rid of the software, they advise to first turn off your anti-adware/spyware software and re-install the software, something that rings a few alarm bells!

It may seem that every pusher in the world is getting involved in the BitTorrent malware scene but a simple WHOIS on all the domains hosting the torrent clients listed above, (Torrent101 for example) including the 3wPlayer site, reveals that they are more than likely the same outfit, exploiting the less experienced members of the BitTorrent community. Anyone concerned about a particular torrent should take the time to read the user comments on the site where the torrent was downloaded from. Very often problems such as fake files are spoken about there.

Anyone needing a media player that will deal with almost any video format should consider the excellent VLC Media Player, available for free download. Those who still haven’t settled on a quality BitTorrent client will find everything they need by getting uTorrent. No spyware, adware or malware present in either product.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Unfortunately, several popular torrent sites carried advertising for these bad clients but thankfully, sites like The Pirate Bay saw the damage these things can cause and removed the adverts. TPB’s brokep wrote, “We’re getting a lot of email about people downloading torrent clients that are advertised on the site. Do not download them! We have put a ban for the ad companies to sell ads for these clients on our site.” Mininova and Snarf-it also blocked the adverts.

In February, we reported on yet another client, TorrentQ after a tip-off from the owner of BT-Junkie. Of course, this wasn’t a new client but the old one with a new name.

In April, in order to try to save unsuspecting file-sharers from installing malware, we ran Google Adword campaigns on the BitRoll, Torrent101 and TorrentQ websites, informing people of just how bad these clients are. Google apparantly doesn’t like to be associated with bad news and a few days later, Adsense adverts disappeared from the sites.

Disappointingly, we are now exposed to yet another ‘new’ bad torrent client. Get-Torrent is the latest in a sequence of malware-laden torrent clients, cloned from the same infected DNA as BitRoll, Torrent101 and TorrentQ. As can be seen from the client’s ‘skinning’ pages, these products are identical;

As we promised in our earlier posts, every time a bad client appears we will do our best to let the BitTorrent community know about it. Anyone thinking of installing a BitTorrent client should stay away from these products and install a free, clean client, such as uTorrent.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Of course these campaigns were just for “fun”. It was nice to turn their advertising strategy against them, and help some naive BitTorrent users along the way. However, the downside of it all is that they now make money off my ads, which allows them to advertise their crappy BitTorrent clients on other websites, so it’s not really an optimal solution.

Here’s an example of the TorrentFreak ad on the Torrent101 website. If people clicked the link, they were directed to this post about Torrent101.

Luckily, most BitTorrent site admins don’t allow ads for these shady clients on their sites. Brokep from The Pirate Bay said earlier “We’re getting a lot of email about people downloading torrent clients that are advertised on the site. Do not download them! We have put a ban for the ad companies to sell ads for these clients on our site.”, and the admins of mininova and btjunkie also banned all ads for these BitTorrent clients on their websites.

People need to be aware that these clients can seriously mess-up up your computer, and the Google adwords campaigns were a fun way to do this. I’m happy to see that Google search is giving a helping hand as well, for free.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Installing one of these clients will result in a hijacked browser and numerous popups. Most experienced BitTorrent users probably wont fall for these clients, and ignore catchy phrases like, “We use unique technology to increase the download speed of your torrents”.

However, people who are new to BitTorrent might accidentally download one of these clients, especially when sites like Torrentspy.com start to integrate ads for these clients (torrent101 in this case) into their design.

Luckily most BitTorrent site admins refuse to advertise these clients. The Pirate Bay said that they will ban these clients two weeks ago, mininova successfully banned these malicious clients, and BTjunkie wont let them advertise on their site either.

We’ll make a post every time that these guys rename their client, at least Google can warn some people then.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.