ClamWin is finding Opencandy virus bundled with qbittorrent_3.3.7_setup.exe #4886

Closed
opened 2026-02-21 17:33:17 -05:00 by deekerman · 1 comment
Owner

Originally created by @tronster on GitHub (Nov 13, 2016).

The latest version of Clamwin for windows is detecting "Win.Adware.Opencandy-31" in qbittorrent_3.3.7_setup.exe. Currently it's unknown if this is legit or a false positive.

Also see this was found 4 month ago via a Reddit post:
https://www.reddit.com/r/torrents/comments/4qlmo6/qbittorrent_bundling_opencandy_with_their_software/

Originally created by @tronster on GitHub (Nov 13, 2016). The latest version of Clamwin for windows is detecting "Win.Adware.Opencandy-31" in qbittorrent_3.3.7_setup.exe. Currently it's unknown if this is legit or a false positive. Also see this was found 4 month ago via a Reddit post: https://www.reddit.com/r/torrents/comments/4qlmo6/qbittorrent_bundling_opencandy_with_their_software/
Author
Owner

@sledgehammer999 commented on GitHub (Nov 13, 2016):

It is a false positive. If you install in a VM and scan the extracted qbittorrent.exe you'll see it is clean. (7zip might be able to open the installer exe without having to use a clean VM).
I use NSIS for making the installer and apparently it writes the installer in a way that some (very few) AV programs misread it.

@sledgehammer999 commented on GitHub (Nov 13, 2016): It is a false positive. If you install in a VM and scan the extracted qbittorrent.exe you'll see it is clean. (7zip might be able to open the installer exe without having to use a clean VM). I use NSIS for making the installer and apparently it writes the installer in a way that **some** (very few) AV programs misread it.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/qBittorrent#4886
No description provided.