Malware Hxxp://pirates-Shack ... From Bitorrent.exe

[littlebit]

A few days ago I started getting my antivirus beeping to notify me that it blocked an infection.   It only happens when Bittorrent is running and has become as frequent as every five minutes.

 

The infection is listed as being from hxxp://pirates-shack.com/scrape.php?info_hash=N%da%14d%5c%96%8f%2a%7c%f2%04%1dW%cf%9dfZa%9c%b3, associated with process C:/....bittorrent.exe.

 

Each time it has some fake address that starts with hxxp://pirates-shack.com/.... but the rest can be different

 

Can anyone tell me how to stop this?   No luck with malwarebytes.

 

thanks

   

[Harold Feit]

Overparanoid antivirus blanket-declaring all traffic to a specific domain as malware.

It's to do with a torrent you've got loaded.

[littlebit]

Could you please be a little more specific as to what you mean by a torrent loaded ... which ones would it likely be?  

 

The ones in the que to download? .... I deleted all of those torrents (they were waiting to start or had partially completed).

 

The file that I last downloaded?  It is the first file I'd downloaded in a couple weeks and then this pirate-shack thing coming up since downloaded the program from the torrent..... I can't find the torrent file now so I must have already deleted it.  The AV still picks up the pirates-shack...

 

There are just the seeding torrents, or the others that are just listed as complete and have been there a while.

 

Is it safe to report as a false positive then? although the alerts might just continue because the fake url changes.

[Harold Feit]

ANY torrent you still have loaded could have the tracker in the list.

It's probably indeed safe to report a false positive given the information that is involved in a scrape request.