Portable Torrent Client with uTorrent

[Midas]

Great info! Thanks again, looks like we're getting quite a complete overview of uTorrent tweaking here...

[webfork]

This isn't something we generally do so wanted to make a post in forums about it: I'm linking the "disable advertisements" bit to the recent FWG article on this.

[giulia]

Thanks, Userfriendly. The reg key gets recreated every time uTorrent is run, even if one deletes it manually.

So, for the time being the best way to achieve stealthiness is to run a cleaning reg file afterwards...

Code: Select all

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\BitTorrent\uTorrent]

or with a batch file...

Code: Select all

REG DELETE HKEY_CURRENT_USER\Software\BitTorrent\uTorrent /f

But even after doing the settings above, uTorrent always recreates some files inside its sub-folders...

In 'apps':

Code: Select all

3609FC884502A1DF0AA5D9D160C827BB1BD51FC9.btapp
featuredContent.btapp
player.btapp
plus.btapp
welcome-upsell.btapp

In 'dlimagecache':

Code: Select all

32F529521A3DEC709F97F761F192AABF29BDC408

Since I haven't requested any torrents yet, those are mostly certainly adware related, right?

i run it under a hips , the last version and it creates lots of registry keys

[Midas]

Thanks for reporting, giulia.

[Userfriendly]

What exactly is it changing? Ran it in sandboxie and it only writes 2 registry keys and both are cleaned up by the PAF launcher:
[HKEY_CURRENT_USER\Software\BitTorrent\uTorrent]
[HKEY_CURRENT_USER\Software\Classes\FalconBetaAccount]

Other than that, utorrent also seems to read internet related certificates and such in the registry but doesn't really change anything there.

Anyway, I also figured out that the dlimagecache folder just contains the image files for the search bar website favicons and maybe the RSS feed favicons.'

Additional advanced settings you probably want to tweak. Don't know exactly what it does but disabling or dismissing something called "offers" sounds good.
offers.404_disable (true)
offers.404_dismiss (true)

And for the super paranoid, you can add these in your hosts file... or use a different torrent client...
127.0.0.1 ads.bittorrent.com
127.0.0.1 offers.bittorrent.com
127.0.0.1 apps.bittorrent.com
127.0.0.1 pr.apps.bittorrent.com
127.0.0.1 update.bittorrent.com
127.0.0.1 cdn.ap.bittorrent.com
127.0.0.1 bundles.bittorrent.com
127.0.0.1 bench.utorrent.com
127.0.0.1 utclient.utorrent.com
127.0.0.1 update.utorrent.com
127.0.0.1 search.utorrent.com
127.0.0.1 utorrent.inspsearch.com

[giulia]

What exactly is it changing? Ran it in sandboxie and it only writes 2 registry keys and both are cleaned up by the PAF launcher:
[HKEY_CURRENT_USER\Software\BitTorrent\uTorrent]
[HKEY_CURRENT_USER\Software\Classes\FalconBetaAccount]

how did you know it?
have you an hips?
try to run in clean system with hips enabled

[Userfriendly]

giulia dude... a little more information would help other than saying "I used hips and found problem, you figure out what it is. Good Luck!". What software did you use to detect the system changes for starters and what exactly were the registry keys added or changed.

http://www.sandboxie.com/ isolates the changes done by an application and puts it in a sandbox. I can see all the file and registry changed within the sandbox easily.

Tried to figure out what the heck "HIPS" is and found software recommended from here http://www.techsupportalert.com/best-free-hips.htm. From what I can tell, your hips thing is probably detecting utorrent accessing a lot of registry keys related to internet settings and other windows stuff. Nothing out of the ordinary like adding extra regkeys.

[giulia]

giulia dude... a little more information would help other than saying "I used hips and found problem, you figure out what it is. Good Luck!". What software did you use to detect the system changes for starters and what exactly were the registry keys added or changed.

http://www.sandboxie.com/ isolates the changes done by an application and puts it in a sandbox. I can see all the file and registry changed within the sandbox easily.

Tried to figure out what the heck "HIPS" is and found software recommended from here http://www.techsupportalert.com/best-free-hips.htm. From what I can tell, your hips thing is probably detecting utorrent accessing a lot of registry keys related to internet settings and other windows stuff. Nothing out of the ordinary like adding extra regkeys.

i used eset v7 smart security ,and i don't how export so many keys
i know Malware Defender

did you say you run inside the sandboxie , and after what software do you use to know which keys are created or modified?
Buster Sandbox Analyzer is old no more updated , it was great tool , i used in the past

[Userfriendly]

Mitec Windows Registry Recovery is what i used to view the RegHive.

Other Registry Viewers that i've tried that work.
Registry Viewer - http://www.gaijin.at/en/dlregview.php
YARU - https://www.tzworks.net/prototype_page.php?proto_id=3

[giulia]

Mitec Windows Registry Recovery is what i used to view the RegHive.

Other Registry Viewers that i've tried that work.
Registry Viewer - http://www.gaijin.at/en/dlregview.php
YARU - https://www.tzworks.net/prototype_page.php?proto_id=3

some keys ..blocked with the hips
i pasted some keys , from the utorrent log , about the hips i can capture so many screenshots

Code: Select all

[2014-04-04 11:35:50]  RegKey: Could not write DWORD valuename OfferAccepted value 0; Error 5

[2014-04-04 11:35:50]  RegKey: Could not write DWORD valuename OfferViaCAU value 0; Error 5

[2014-04-04 11:35:50]  RegKey: Could not write string valuename OfferProvider value ; Error 5

[2014-04-04 11:35:50]  RegKey: Could not write string valuename OfferName value ; Error 5

[2014-04-04 11:35:50]  RegKey: Could not write DWORD valuename OfferAccepted value 0; Error 5

[2014-04-04 11:35:50]  RegKey: Could not write DWORD valuename OfferViaCAU value 0; Error 5

[2014-04-04 11:35:51]  RegKey: Could not delete value uTorrent: 5

[2014-04-04 11:35:51]  RegKey: Could not write DWORD valuename uTorrent.exe value 9000; Error 5

[2014-04-04 11:35:51]  RegKey: Could not delete value uTorrent: 5

[Userfriendly]

Those are exactly the regkeys mentioned before so its nothing new.

Code: Select all

[HKEY_CURRENT_USER\Software\BitTorrent\uTorrent]
"OfferProvider"=""
"OfferName"=""
"OfferAccepted"=dword:00000000
"OfferViaCAU"=dword:00000000

[HKEY_CURRENT_USER\Software\Classes\FalconBetaAccount]
"remote_access_client_id"="1234567890"

Run a reg file with this or use the portableapps.com version for complete stealth.

Code: Select all

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\BitTorrent\uTorrent]
[-HKEY_CURRENT_USER\Software\Classes\FalconBetaAccount]

[SeanAtWork]

I was wondering, since BitTorrent and uTorrent are virtually identical, can BitTorrent be installed portably following the same installation directions?

[webfork]

BitTorrent and uTorrent are virtually identical

Really don't think so: uTorrent was under develop by a separate company with different goals until BitTorrent picked them up. I didn't get the sense that there was a major code revision to bring it in line with standard BitTorrent since the acquisition.

uTorrent entry
http://www.portablefreeware.com/index.php?id=483

Nothing on the BitTorrent page about portability:
http://www.bittorrent.com/downloads/win

[Userfriendly]

Bittorrent client is just a rebrand of utorrent. Different name, purple color scheme instead of green and different icon. Otherwise everything else is identical to utorrent. It just looks more 'Official'.

However if you want to test the beta/alpha/nightly builds, you'll want to go to the utorrent site where the development conversations seem to happen. Lately it has been real messy though. Lots of bugs and no changelogs for most build updates recently. It seems like they're trying to get the performance optimized but are failing at it...
http://www.utorrent.com/downloads/win_us
http://forum.utorrent.com/forum/13-announcements/

So yes you can do the same instructions for portable mode. Create settings.dat file in the same directory as the executable.

[webfork]

Bittorrent client is just a rebrand of utorrent

Yep ... I'm wrong. Although from a code perspective, BitTorrent is actually uTorrent despite the previous purchasing the latter:

since December 7, 2006, the code is owned and maintained by BitTorrent, Inc.[15] The code has also been employed by BitTorrent, Inc. as the basis for version 6.0 and above of the BitTorrent client, a re-branded version of µTorrent.

https://en.wikipedia.org/wiki/%CE%9CTorrent

I thought the purchase was much more recent, not 8 years ago.