[ RESOLVED ] Multiple IPs blocked when using qBittorent

[Odysseas]

The executable is clean

VirusTotal - File - abd2de991217918943083ce9c91d306c34ac6599c4607f1c8e9c3a24cb974d0a

[EndangeredPootisBird]

Technically it is an true positive, its just the way P2P software works; they need to connect networks together, including ones known to host malware.

[Odysseas]

18 minutes ago, EndangeredPootisBird said:

Technically it is an true positive, its just the way P2P software works; they need to connect networks together, including ones known to host malware.

But I'm not downloading anything 

[Porthos]

55 minutes ago, Odysseas said:

The executable is clean

As for why Malwarebytes blocks Torrent based software, this is because Torrent based software, are what are known as Peer-to-Peer (P2P) applications meaning it connects to many different servers/IP addresses (this is how files are downloaded through Torrent based software) and because of this, sometimes Torrent based software will connect to a server that is also known for hosting malicious content.  This is because servers/IP addresses are often shared by multiple sites, so while what you are downloading through Torrent based software may be perfectly safe, some of the sites hosted on some of the IP addresses that Torrent based software connects to may be malicious.  Such connections are not a threat however, and you may exclude Torrent based software from the Web Protection component in Malwarebytes to stop the blocks from happening without compromising your protection (your web browser and other critical web facing programs will still be fully protected from malicious websites and other malicious content).  To do so, add your Torrent based software.exe to your exclusions using the method described under the Exclude an Application that Connects to the Internet section of this support article.

 

File sharing involves using technology that allows internet users to share files that are housed on their individual computers. Peer-to-peer (P2P) applications, such as those used to share music files, are some of the most common forms of file-sharing technology. However, P2P applications introduce security risks that may put your information or your computer in jeopardy.  Risks of File-Sharing Technology

I hope this helps, and if there is anything else we might assist you with please let us know.

[Odysseas]

1 minute ago, Porthos said:

As for why Malwarebytes blocks Torrent based software, this is because Torrent based software, are what are known as Peer-to-Peer (P2P) applications meaning it connects to many different servers/IP addresses (this is how files are downloaded through Torrent based software) and because of this, sometimes Torrent based software will connect to a server that is also known for hosting malicious content.  This is because servers/IP addresses are often shared by multiple sites, so while what you are downloading through Torrent based software may be perfectly safe, some of the sites hosted on some of the IP addresses that Torrent based software connects to may be malicious.  Such connections are not a threat however, and you may exclude Torrent based software from the Web Protection component in Malwarebytes to stop the blocks from happening without compromising your protection (your web browser and other critical web facing programs will still be fully protected from malicious websites and other malicious content).  To do so, add your Torrent based software.exe to your exclusions using the method described under the Exclude an Application that Connects to the Internet section of this support article.

 

 

File sharing involves using technology that allows internet users to share files that are housed on their individual computers. Peer-to-peer (P2P) applications, such as those used to share music files, are some of the most common forms of file-sharing technology. However, P2P applications introduce security risks that may put your information or your computer in jeopardy.  Risks of File-Sharing Technology

 

I hope this helps, and if there is anything else we might assist you with please let us know.

 

I understand how P2P works but the problem is that I'm not downloading anything at all

[Porthos]

Just now, Odysseas said:

but the problem is that I'm not downloading anything at all

Does not matter, it will block IP's even without downloading  or sharing anything.

Use the instructions and exclude the program.

[Odysseas]

26 minutes ago, Porthos said:

Does not matter, it will block IP's even without downloading  or sharing anything.

Use the instructions and exclude the program.

First of all, telling me to add it to the allow list it's like saying "everything is fine, there is no virus". So it's a false positive. 

Second, Malwarebytes is literally the only av that does this, Kaspersky/Bitdefender/ESET don't detect anything at all

[Porthos]

12 minutes ago, Odysseas said:

First of all, telling me to add it to the allow list it's like saying "everything is fine, there is no virus". So it's a false positive. 

Second, Malwarebytes is literally the only av that does this, Kaspersky/Bitdefender/ESET don't detect anything at all

The web protection is blocking IP's not the actual file. The program is not the issue it is the IP's it connects to. Malwarebytes has its own web protection that is different from the other AV programs.

[Odysseas]

1 minute ago, Porthos said:

The web protection is blocking IP's not the actual file. The program is not the issue it is the IP's it connects to. Malwarebytes has its own web protection that is different from the other AV programs.

You told me to add it to the allow list which allows the *IPs*

[Porthos]

1 minute ago, Odysseas said:

You told me to add it to the allow list which allows the *IPs*

Yes it allows the torrent program full access to the internet. The torrent program being allowed does not risk the computer. It will be the downloaded content when completed that is the issue and infect the computer when accessed.

[leo3487]

On 8/11/2022 at 3:15 PM, Odysseas said:

You told me to add it to the allow list which allows the *IPs*

Allow the IPs at this program, not at browsers

( @Porthossaid you use the option exclue a program, no exclude an website)

[remark3d]

Hello,

I have exactly the same problem with Qbittorrent

Malwarebyte keeps popping up windows warning me about banned IP addresses, even though Qbittorrent is not downloading or uploading anything at all, the IP addresses are changing every day. When I ignore Qbittorrent.exe or even the whole folder with the program content, Malwarebytes ignores it and keeps popping up windows, I don't know what the problem is, with other programs the ignoring works without any problem, can you advise me?

Thank you Martin

[Porthos]

2 minutes ago, remark3d said:

When I ignore Qbittorrent.exe

You have to add it here.

Allow an application to connect to the Internet

To prevent Malwarebytes for Windows from blocking an application you trust, add the application executable.

1. Click Allow an application to connect to the Internet.
2. To find the application, click Browse.
3. Select the application executable you want to add, then click Open.
4. Click Done to confirm your changes.

[guthrie]

Thanks for all the support and information.

I have the same issue, as wold all MBytes users of torrents -

As I understand it, whitelisting the application does not solve the problem, and one would have to try to remember all the blocked IPs from the pop-up messages, and individually white-list them each?

Is there some table/log where they are listed for easier access?

[Porthos]

37 minutes ago, guthrie said:

As I understand it, whitelisting the application does not solve the problem

It does if you do it correctly.

On 9/25/2023 at 9:11 AM, Porthos said:

ou have to add it here.

Allow an application to connect to the Internet

To prevent Malwarebytes for Windows from blocking an application you trust, add the application executable.

1. Click Allow an application to connect to the Internet.
2. To find the application, click Browse.
3. Select the application executable you want to add, then click Open.
4. Click Done to confirm your changes.

File sharing involves using technology that allows internet users to share files that are housed on their individual computers. Peer-to-peer (P2P) applications, such as those used to share music files, are some of the most common forms of file-sharing technology. However, P2P applications introduce security risks that may put your information or your computer in jeopardy.  Risks of File-Sharing Technology

Edited February 27 by Porthos

[leo3487]

14 hours ago, guthrie said:

Thanks for all the support and information.

I have the same issue, as wold all MBytes users of torrents -

As I understand it, whitelisting the application does not solve the problem, and one would have to try to remember all the blocked IPs from the pop-up messages, and individually white-list them each?

Is there some table/log where they are listed for easier access?

@Porthos let me try a better explanation

Allow a file or folder and Allow an application to connect to internet are 2 different options that tell what to do to 2 different shields

First option you add a file or folder to no be detected by Real Time Protection when you open or execute it (also exclude from manual scans)

Second option say to Web Shield allow all connections originated by the application you add at this list. Due it, here you never should include a browser or a vpn, only games and other programs you trust and had connection problems due Web Shield

 

[guthrie]

Yes, got it - I had misread the earlier descriptions. Thanks.

[Porthos]

Closing this topic as it's been resolved.