Possible crypto miner detected for uTorrent.exe

If I remember correctly, there have been a number of malware issues associated with Bit Torrent applications, so I would suspect that AAP has identified some behaviour for your uTorrent application that suggested it might be seeing the same?

This is the expected behaviour of AAP in trying to protect against new or emerging threats and the initial impact (on performance) is most likely due to protection measures that AAP was applying to ensure your data was safe guarded.

The good news is that you have been able to tell AAP to trust this application and thus remove that performance impact.

Personally, whenever I have used uTorrent or similar applications, I never have it running unless I am actually using it to transfer something but that is a choice for each user to make.

I've been using uTorrent for years and during this time I had used Bitdefender, Kaspersky, Malwarebytes and currently Windows Defender and no of them accused some suspect activities caused by uTorrent.

This way  I can state that AAP seems to be reporting a false positive.

The difference between AAP and products like you mention is that AAP uses AI to track behavior by applications that are common to behaviors in ransomware.  Now you can call your experience a false positive if you like but the fact remains that the uTorrent behavior, whatever that behavior is, was noted as like behavior of ransomware.  When this occurs AAP stops the process and awaits your intervention before allowing processes to continue on your PC.  In that respect APP is performing as designed/expected.

The fact that this applies to other user logons indicates that AAP is working the same for all users of your PC which is also expected.

I would suggest that you find out if there may be an update to your uTorrent app that may change the behavior.  In this way you can be assured that nothing is going on under the hood that should concern you.

The question is, both ATI and uTorrent are together for years and just today I got this issue...

But I'm learning, ATI is mystical. ATI means Artificial Transcendental Intelligence...  :(

Roger, it really depends on the application behavior. 

As an example of my own use case where AAP stepped in... I use command prompt all the time, without issue. 

However, at various times, when I have run command prompt with robocopy to sync large directories of changed data and modifying entire folder structures in rapid succession, AAP has flagged CMD as a potential risk and paused the script from continue..

Although it may seem annoying because CMD and robocopy are default Windows system applications, and because I already know what's going on in this situation, the protection is working as intended because it recognized a significant and rapid change to the folder structure of the destination disk and halted the process until I allowed it to continue.  

Had this not been my own doing, but a piece of malware/ransomeware using command prompt and/or robocopy to use a blank folder to wipe out other folders, I would be very grateful for AAP halting the process and allowing me to recover the modified files that already got impacted. 

Better to be safe than sorry, at the cost of having to allow the application to continue on without some checks-and-balances.  Torrent applications are far from secure and are frequently known to be vectors for malware to enter a system.  

Bobbo_3C0X1 wrote:

Although it may seem annoying because CMD and robocopy are default Windows system applications, and because I already know what's going on in this situation, the protection is working as intended because it recognized a significant and rapid change to the folder structure of the destination disk and halted the process until I allowed it to continue.  

Had this not been my own doing, but a piece of malware/ransomeware using command prompt and/or robocopy to use a blank folder to wipe out other folders, I would be very grateful for AAP halting the process and allowing me to recover the modified files that already got impacted. 

Better to be safe than sorry, at the cost of having to allow the application to continue on without some checks-and-balances.  Torrent applications are far from secure and are frequently known to be vectors for malware to enter a system.  

 

I couldn't agree more!

After this discussion, I searched in Google for Utorrent crypto mining and it seems AAP is correct because there are many reports about crypto mining using uTorrent.

I'll uninstall uTorrent.

Thank you all.

You are quite welcome.

Just for an update, many people recommended qBittorrent as a fair replacement for uTorrent, and I did it, I completely uninstalled uTorrent and installed qBittorrent.

However...

AAP shows: Possible crypto-miner detected for qBittorrent...

Maybe uTorrent was innocent... or maybe both are guilty... 

or: AAP is paranoic... 

But I'll live now with qBittorrent and observe it.

As stated by some advanced qBittorrent forum users, it's impossible that qBittorrent is using crypto-mining, and once it's open-source software, this can be proved.

So, the ATI AAP AI must improve a little.

I disagree that AAP needs to improve. Personally, I'm think every torrent program should be flagged all the time!

Mustang wrote:

I disagree that AAP needs to improve. Personally, I'm think every torrent program should be flagged all the time!

If a program has proven to have no malicious code, why should it be marked like this?

Well, I did some looking and it appears that almost every ransomware utility on the planet flags qBittorent and uTorrent.  This indicates that the behavior of these applications mimics the behavior of ransomware.

That tells me that the detection is not false but indicates that the behavior is questionable and so if you mark these apps as trusted and you subsequently become infected by ransomware, you asked for it.

To each there own. 

The problem with Torrents, is that the payloads are not verified and most of the files being "shared" through torrents are pirated music, movies and software.  In some cases, you don't even get the actual files you expect, but instead get a malicious file that goes to town. In other cases, you get the file, along with an additional malicious payload, or in other cases you get a modified or "cracked" version of software that has malicious code in it. 

Yeah, there are some legitimate files out there too, but that seems to be far less than all the pirated stuff and the risk for compromise if pretty high.  Unfortunately, the torrent hosting sites, really don't check the files anymore.  There are far too many now and most are already zipped (and encrypted with a password - winzip, 7zip, winrar, etc) that makes scanning the true contents possible.  Plus, the scanning, doesn't really go very deep.  

Hey there, thanks for sharing your experience with uTorrent and Acronis Active Protection. It's always good to hear about how different security measures are working in practice.