Malwarebytes not detecting upd-pct.info/ and pctupd.info/ threat

[matt23]

I keep getting a URL:Mal threat secured notification from my Avast antivirus software. When I run I scan using  Avast, it picks up no virus, malware or suspicious threat. When I run a scan in malware bytes it also picks up no malware, viruses or threats. How do i remove this? I am running mac. The threat keeps coming up as being from the following links i have i have never been on before: upd-pct.info/ or pctupd.info/ . I did some research on this, and found out it is coming from PopcornTime which is a P2P app for watching movies. I immediately deleted the app and all its contents but the pop still comes every 5 hours or so. I still have not been able to find any solid information on how to remove this threat. I fear this may be a new malware or virus that neither Avast or Malwarebytes is aware of, and it constantly trying to connect to the internet in the background, which is when avast blocks the attempt. I cannot fins any information on how to remove this threat, please help me.

[alvarnell]

There appears to be nothing on your Mac that needs to be removed. Avast is just preventing you from downloading anything from those web sites, presumably because they are known to distribute malware. VirusTotal also indicates there are problems with that first site: https://www.virustotal.com/gui/url/f1423a67e514c1d8f8964296d55ec0df99908be87717e2cc90f4c19f3a6c9307/detection. That happens quite frequently with sites that end in ".info".

If you believe these are a false positive blockages, you should contact Avast.

Edited July 15, 2020 by alvarnell

[treed]

That file and the domains that it contacts appear to be related to the Popcorn Time application. This is not something that Malwarebytes currently detects. We've looked at it in the past, as it's often used in conjunction with piracy of commercial video, but we have never made a decision to detect it. It may be worth investigating again, but I can't promise that we'll detect it. Just because it's often used by folks engaging in piracy doesn't mean it is malicious itself and should be detected; if it were, we'd also detect torrent clients like uTorrent, etc, which have legitimate uses.