TrueSpec’s file checks cut false alarms but leave blind spots
TorrentClaw’s TrueSpec feature partially downloads torrents to check file labels and consults VirusTotal for malware verdicts. A new investigation traces the shift from thousands of mostly false alarms to a narrower set of flagged files, including malicious components bundled with genuine video players. Large executables and inaccessible swarms remain outside the checks, limiting what the results can establish.
Artificial Intelligence··Midday
Partial downloads connect file labels with actual contents
TorrentClaw is a torrent search engine developed with AI tools and launched in February. Its TrueSpec feature examines file listings and takes a small portion of a download to check video contents with ffprobe, a media-analysis tool. Developers say each torrent needs a download of roughly 10–20 megabytes. Suspicious file hashes are looked up using VirusTotal, which collects malware-scanner results; sufficiently small files can be submitted for a scan. TorrentFreak’s new investigation includes developer interviews and checks of linked results.[1]
The narrower malware count removes harmless scripts
A July dataset listed 6,450 malware cases, but many alarms involved harmless warning files or scripts that changed audio languages or opened websites. By late September, TorrentClaw counted only cases confirmed through VirusTotal, leaving 34. TorrentFreak checked some against the linked evidence. In 31 cases, a renamed executable appeared alongside libvlc.dll and a playable video. TorrentClaw describes the executable as a signed genuine VLC player; scanner warnings concern the DLL it loads on startup.[1]
Large files and inactive swarms remain outside the checks
The checks prioritize well-seeded torrents, skip large executable downloads and cannot inspect dead swarms. A total of 1,265 among 687,057 probed torrents received a deceptive label, including programs disguised as videos and incorrect resolution labels. Subtitles omitted from release names form a separate category. Flagged malware stays listed with its download button disabled. The developer says downloaded fragments are deleted after analysis and valid takedown notices are processed.[1]
Related columns
For more information on this topic, you can read the related columns.
