Torrent9.so: is it safe? Redirects, ads and how to remove them
Torrent9.so is a French-language torrent website, not a program, and opening a page installs nothing. In our October 2026 test it sent a clean browser through advert click trackers to another site on its own, so the risk is in its adverts, the notification requests it can show, and the files downloaded from torrents.
Facts checked October 14, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If redirects to torrent9.so keep coming back, a free scan can check extensions, programs and browser settings in one pass.
Do it yourself · free Remove Torrent9.so yourself 1 step, about 5 minutes, no software needed.
Torrent9.so: summary
| Type | Torrent website that shows third-party adverts and sent our test browser to another site; not malware. The redirects, pop-ups and notifications seen around it are what people call the virus |
|---|---|
| Risk | Medium to high: the page installs nothing, but its adverts, redirects, notification requests and the files downloaded from torrents are the risk |
| Symptoms | Tabs or adverts that lead to other sites you did not choose, notifications from the site, pop-up windows, a changed start page or search engine, a slow browser |
| How to get rid of it | Block the site in Chrome's notification list, remove unknown extensions and programs, run a Microsoft Defender full and offline scan if you ran a file, reset the browser |
| Our check (6 October 2026) | Passed through two advert click trackers to a removed file page on load, with no click; no notification request on that one visit, which is not proof it never asks |
| First seen | Our report of 9 December 2020 (updated 17 June 2021); the domain's own registration date is not available, the .so registry has no public record we could read |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 10 more facts
| Installed on the PC | Nothing: visiting a website installs no program; files from the adverts, extension pages or bundled installers that sent you there are what to remove |
|---|---|
| Microsoft detection | None: Microsoft Defender has no detection name for the website, because nothing is installed by visiting it |
| Distribution | A website that people find by searching for films and files, and that passes visitors on through advert networks |
| Evidence | Our test of the site, the Chrome, FTC, Emsisoft and Malwarebytes pages, and our 2020 report and its pictures |
| Name | Torrent9.so |
| Domains | torrent9.so |
| Ads shown as | Redirects through ad pages |
| Browsers | Chrome, Edge and Firefox |
| Damage | Redirects to scam pages, fake updates and tech support scams |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against our own test of the site in desktop Chromium from Lithuania (one visit, which ended on another site), and the Chrome, FTC, Emsisoft and Malwarebytes pages. The .so registry gave no public registration record. We did not see the site's own page, and a quiet result on one visit is not proof that it never asks for notifications.
What Torrent9.so is and why people call it a virus
Torrent9.so is a website, not a program: a French-language torrent index, a list of links to films, series, music, e-books, software and games that other people share. Opening a web page installs nothing by itself. The "Torrent9.so virus" people search for is the redirects, advert pop-ups and notification requests around sites of this kind, and the files they lead to.
- 1
You search or browse
Our 2020 picture shows a search box in French ("Votre recherche ici"), menus for films, series, music, e-books, software and games, and a list of film torrents with size and seed and leech counts. The page addresses a French-speaking audience, which is why the old report called France its target.
- 2
You open a listing
A listing points to a file a stranger uploaded. The site does not make the file, and a name such as "WEBRIP 1080p" tells you nothing about what is inside.
- 3
The adverts and the file are the risk
The page earns from advertising. Adverts can open new tabs, send the current tab to another site, ask to show notifications or offer a "VPN", "player" or "update", and a downloaded file can carry more than the film or program it claims to be.
- What it is
- A torrent website, not an installed program or a Windows file
- What people call the virus
- Redirects to other sites, pop-up adverts, notification alerts and a changed start page or search engine, seen after visiting or after installing something offered on the way
- Language and audience
- French; our 2020 report named France as the targeted country
- What we know about who runs it
- Nothing: the registry for .so domains gave no public registration record we could read, and the site names no operator in what we saw
- Detection names
- None for the website itself: Microsoft Defender has no detection name for a web address
Our 2020 guide called the site "deceptive". That is fair for the adverts it showed, as the pictures below prove, but it is a judgement about the ad chain, not a finding that the page itself carries a virus. We did not see the page itself on our 2026 visit, so we say nothing about its listings today.
What about torrent9.diy and other Torrent9 addresses?
Torrent9.diy is a different web address from Torrent9.so, and we have no test of it.
Our guide covers Torrent9.so only, checked on 6 October 2026, so we cannot say what the .diy address shows, who runs it or whether it is related to the .so site. Treat it as unverified until you have checked it yourself.
Our reading is that .diy is one more domain ending used by a site with the same name. Torrent sites often change address, and copies or imitations appear under new endings. We found no reliable source that links torrent9.diy to the site in this guide, so this is an assumption, not a confirmed fact.
Is torrent9.diy safe? Assume the same risks as for any torrent site until proven otherwise: adverts that redirect, notification requests and files that may carry malware. An imitation can be worse than the original, because nobody can vouch for it. A quiet visit does not clear an address, so do not download or run anything from it.
If you already visited torrent9.diy, close the tab and do not click Allow on any notification request. Then block the site in Chrome's notification list, remove unknown extensions and programs, and run a Microsoft Defender full scan if you ran a file. The steps in this guide were written for the .so site and apply here too.
Is Torrent9.so dangerous?
Our test on 6 October 2026
We loaded https://torrent9.so/ in a clean desktop Chromium browser from Lithuania, with no extension and no account. We did not click anything; the tool only waited and scrolled once. The browser did not stay on the site's own address: it was passed through two advert addresses and finished on a file page at another site. This is one visit from one place, so it shows what the address can do, not everything it does.
torrent9.so home page · desktop Chromium · Lithuania (EU) · 6 October 2026
- Where we ended upStatus 200, but the address bar finished on a MEGA file page (mega.nz) that said "File is no longer available", because the shared file had been reported or its account suspended. We did nothing to cause it.
- The routeThree steps were recorded: torrent9.so, then www.torroclk.com/feed/click/ (an advert click tracker; its address carries our site's name as a sub-ID, and it was reached over plain http), then xml-v4.oceanfall.xyz/click, and then the file page. The browser contacted seven addresses in all; one, movienetstream.cfd, we did not identify. We did not look into who runs them.
- What the redirect was forThe end point was a download link on a file-hosting service. We cannot say what the file was, because it was already gone. A click-tracker route that ends on a file is how adverts hand out downloads, but we did not see a download happen: our test downloads nothing.
- The real pageNot seen. We never saw the torrent list, so we know nothing of what the site itself shows now.
- Notification requestNone on this one visit, neither on the first page nor on the page we ended on.
- Pop-up windowsNone opened as separate windows on this one visit; the redirect replaced the page we were on.
- Service worker on the siteNone registered by torrent9.so itself. The page we ended on (mega.nz) registered its own, which belongs to that service.
- Ad networksNone named by our tool. That says nothing about the adverts other visitors get: networks choose by country, device, referrer, a delay, a second visit or a click, and many hide from automated browsers.
Sent us away on its own The address took a clean browser through advert click trackers to another site with no click, which is the redirect behaviour people describe. We saw no notification request, but that is nothing on this one visit: a quiet result is never proof that a site does not ask. Treat the address as one whose adverts and links can lead off it, as our 2020 pictures show.
What changed since our 2020 report
9 December 2020
Our first guide: a torrent site with notifications and redirects
We published the guide on 9 December 2020 and updated it on 17 June 2021. It called the site a French torrent website that uses deceptive advertisements and redirects and offers to subscribe to notifications. We said that push notifications of this kind are used to promote scams and phishing links, and that the redirects usually led to a VPN offer or to a download of an unwanted program. The domain's own registration date is not available to us: the .so registry has no public record that our lookup could read.
2020
An advert that claims to know your address
Our first picture shows a dotted box on the home page, "Attention! Vous devriez utiliser un VPN !", that prints the visitor's IP address and a city and says the provider and Hadopi are watching what you download. The text is an advert: a web page can read the address your connection shows and print it, which proves nothing about who is watching. The button leads to a VPN offer. Our old text called this a shady banner that promotes a VPN to become anonymous while downloading illegal content, as if that made it all right; the picture is the example.
Torrent9.so as our 2020 report showed it: a list of films in French and, above it, a dotted advert box that prints the visitor's own IP address and city and tells them to get a free VPN. The box is an advert placed on the page, not a message from your provider or from Chrome. 2020
Redirects to a VPN offer and to a hijacker page
Our second picture shows where our 2020 clicks went: a Russian-language VPN advert page, and a page titled "Please add WebSearchConverter" with an ADD TO CHROME button. The small print on that page said that adding the extension would change the browser's default search. We called it a browser hijacker that brings no value; what we can show is the page's own words, that it changes the default search, and that it came from an advert, not from the user's choice.
Where its ads sent us in 2020: a Russian-language VPN advert page and, in the front window, a page asking to add the WebSearchConverter extension to Chrome (its small print says the default search will be changed). The woman is a stock photo added to the collage; she has nothing to do with the site. 17 June 2021
The last change to our old guide
The old guide was not updated after this date. Its Chrome steps (Menu > Settings > Advanced) no longer match Chrome's menus, which is corrected below.
6 October 2026
Our new check: a redirect on load
A clean browser was taken through two advert click trackers to a file page that was already removed, with no click. We saw no notification request on that one visit.
How an advert chain turns into a risk
Our 2020 guide said that adverts are one of the most common ways to pay for a site, that they let people read or watch for free, and that things change as soon as untrustworthy ad networks are used. That is still the heart of it: the site owner sells space, and what appears in it depends on who bought it that day.
- 1
The page sells its space
A torrent site has no product to sell. It sells clicks, opens and notification sign-ups to ad networks, often through resellers, so the site does not see most of what is shown.
- 2
The network passes the visitor on
The first address in our route, a click tracker, carries a sub-ID that names the site the visitor came from. This is how the network pays the site per visitor. It is also how the visitor ends up on a page the site's owner never chose.
- 3
The end point is whoever paid
In 2020 the end points were a VPN offer and an extension page. In 2026 it was a file page. Some networks are not particularly concerned about reputation, as our old text said, because they can stay anonymous, and some adverts carry malicious JavaScript that runs without a click. Whether it does depends on the day, the country and the browser.
Our 2020 guide added that insecure advert chains are usually not deliberate: threat actors keep finding new ways to inject their scripts into advert networks without permission. A site owner can be careless or can be in on it; from the visitor's side the result is the same, and it is why the safe choice is to keep your browser free of anything that lets an advert run without you clicking.
The real risks, from most to least serious
"Torrent9.so virus" is not an accurate name: loading a page installs nothing on its own. These are the ways a visit or a download can still go wrong, in the order we would worry about them. Our 2020 guide said the same things less carefully, and each of its points is covered here.
- High
Running a file from a torrent or an advert
There is no way to know whether every torrent hosted on a site like this is clean, and there is no one who checks. Torrents named as cracks, keygens or full versions of paid software are where adware and trojans are commonly hidden, and a fake player, scanner or update from an advert is the same trap. Distributing malware through third-party sites that host pirated installers is a common practice. The FTC lists unfamiliar websites that give away music, movies, shows or games, and peer-to-peer file-sharing sites, among the things that can expose you to malware.
- High
Ransomware inside cracks and pirated installers
Our 2020 guide named the creators of Nobu, Weui and other Djvu (STOP) variants, who use software cracks and pirated installers to infect people with ransomware, which locks personal files and demands money for a tool to return them. Emsisoft's malware lab said that STOP is spread almost exclusively through key generators and cracks, and that some versions bundle password-stealing trojans as well. A torrent listing is one place such a file can come from; we did not see one on torrent9.so.
- Medium
Adverts that can launch scripts
Our old text warned that adverts can launch automated scripts and that malware can be hidden in several parts of a site. Malwarebytes reported in April 2016 that The Pirate Bay served ransomware through a malvertising pop-under that silently sent visitors to the Magnitude exploit kit, which dropped Cerber ransomware, so the warning has a precedent on torrent sites. A script in an advert is a reason to keep your browser and operating system updated and to use an ad-blocking or protective setting in the browser, not a reason to click anything.
- Medium
Clicking Allow on a notification request
One click lets the site send adverts to the desktop until the permission is removed. Push notifications come up at any time the computer is on, interrupt work and are used by sites like this to promote scams and phishing links, as our 2020 guide said. They keep arriving after the visit, and after the browser is closed if it runs in the background. Our 2026 visit showed no request, which proves nothing about other visits.
- Medium
Redirects and pop-up ads
Clicks on random places of the page can open another tab or take the current one to another address. Our 2020 clicks led to a VPN offer and to an extension page; our 2026 visit led to a removed file. Each end point is only as safe as whoever paid for the click that day.
- Medium
Warnings you click away
People who open torrent sites usually know what they are doing, but many click away the warnings their security software shows because they believe it is a false positive. As soon as a malicious file is launched, the infection routine begins, so a warning on a file from a torrent is a reason to delete it.
- Low
Copyright
Our 2020 guide said that torrenting is not illegal in itself. That is right: the technique is legal, and torrents of public-domain, open-source and openly licensed files are fine. Downloading a film, episode, album, game or program that the owner has not allowed infringes copyright in many countries, and some internet providers pass on warnings. Our old text called pirated programs "licensed (cracked)"; a cracked copy is one with its licence check removed, not a licensed one.
File types that a film, show or song torrent should never contain
- .exe
- .msi
- .scr
- .bat
- .cmd
- .lnk
- .js
- .vbs
A video torrent normally holds .mkv, .mp4 or .avi plus subtitles. Our 2020 guide pointed out that a video ending in .lnk is likely malware in disguise, and the same goes for any of the types above. If you only see one of them, delete it without opening it.
How adware and a changed browser arrive with a download
Programs that add toolbars, change the start page or search engine, or open pages like the ones above arrive inside installers and with downloads. The WebSearchConverter page from our 2020 picture is of this kind: it asks for an extension that changes the default search.
- 1
A "free" tool is offered
A VPN, a player, a converter, a downloader or a torrent "setup" file, offered by an advert or on a download page that is not the maker's. Software from official providers and developers does not use this bundling.
- 2
The setup hides a choice
The quick path (Recommended, Express or Next) accepts bundled add-ons, toolbars or a second program. The Custom or Advanced path lists everything included and lets you untick what you do not want.
- 3
The add-on changes the browser
It replaces the start page, search provider or new tab, adds extensions that watch and redirect your browsing, slows the browser down and sends visits to affiliate addresses.
- 4
A pop-up pushes a second install
Deceptive pop-ups can offer system tools, rogue applications, or a "scan" that finds a problem that does not exist. Running it installs the program the advert wanted you to have.
A web page cannot scan your computer, and neither Windows nor your browser is updated by a page. A message that says it does is an advert.
How to remove Torrent9.so
How to stop the Torrent9.so redirects
Work in this order and test a few links after each step, so you know which one was the cause.
Which browser shows the ads?
Remove extensions you do not recognise
Paste
chrome://extensionsinto the address bar and click Remove on anything you did not install yourself, especially torrent clients or tools, "search" or PDF helpers added recently.Full procedure with screenshots: Remove a browser extension
Clear the site data
Press Ctrl + Shift + Delete, choose All time, tick Cookies and other site data and Cached images and files, and click Delete data.
Reset Chrome
Open Settings > Reset settings > Restore settings to their original defaults and confirm with Reset settings. This resets the start page, search engine and pinned tabs and turns off extensions; bookmarks and saved passwords stay. To stop notifications after you close Chrome, also turn off Settings > System > Continue running background apps when Google Chrome is closed.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Remove extensions you do not recognise
Paste
edge://extensionsinto the address bar and click Remove under anything you did not install yourself.Full procedure with screenshots: Remove a browser extension
Clear the site data
Open Settings > Privacy, search, and services > Delete browsing data > Choose what to clear, set All time, tick Cookies and other site data and Cached images and files, and click Clear now.
Reset Edge
Open Settings > Reset settings > Restore settings to their default values and confirm with Reset. Extensions are turned off and the start page goes back to default; favourites, history and saved passwords stay. To stop notifications after you close Edge, turn off Settings > System and performance > Continue running background extensions and apps when Microsoft Edge is closed.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Remove add-ons you do not recognise
Paste
about:addonsinto the address bar, open Extensions, and choose Remove from the three-dot menu of anything you did not install yourself.Full procedure with screenshots: Remove a browser extension
Clear cookies and site data
Open Settings > Privacy & Security > Cookies and Site Data > Clear Data, tick both boxes and click Clear.
Refresh Firefox
Open the menu > Help > More troubleshooting information and click Refresh Firefox. Add-ons and custom settings are removed and the home page goes back to default; bookmarks, history and passwords stay.
Full procedure with screenshots: Reset a browser and fix a hijacked search engine
Take back the notification permission
Safari 18 and later on macOS: open Safari > Settings > Websites > Notifications, select
torrent9.soor any site you do not recognise and set it to Deny, or click Remove. Untick Allow websites to ask for permission to send notifications at the bottom so no site can ask again.Remove extensions you do not recognise
In Safari > Settings > Extensions, select anything you did not install yourself and click Uninstall.
Clear the site data
In Safari > Settings > Privacy > Manage Website Data, remove the site's data, or use History > Clear History > all history. To empty the cache as well, turn on Show features for web developers in Settings > Advanced and choose Develop > Empty Caches.
Check the Mac for apps from the ads
Ads also target Mac users with fake players and "cleaners". In Finder > Applications, move anything unknown to the Bin. In System Settings > General > Login Items & Extensions, remove unknown items. Then use Go > Go to Folder to check
/Library/LaunchAgents,~/Library/LaunchAgents,/Library/LaunchDaemonsand/Library/Application Supportfor folders and files with the same unknown names, and empty the Bin.
Then, whichever browser you use
Step 1: Scan the PC if you downloaded anything from the ads
Most people who only saw the notifications can skip this step. If a notification or the page it opened made you download or run a file, delete the file and run a full scan, then a Microsoft Defender Offline scan.
In Windows 11 and Windows 10 open Windows Security > Virus & threat protection > Scan options, select Microsoft Defender Antivirus (offline scan) and click Scan now. The PC restarts and the scan takes about 15 minutes, so save your work first.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
After removal: keep the ads from coming back
If you allowed notifications from Torrent9.so
If you clicked Allow on a request from the site, you can take the permission back in a minute. Our 2020 guide gave the steps for Chrome; its menu names are out of date, so these are the current ones. The steps for other browsers are similar: all you have to do is stop the site from showing notifications.
- 1
Open Chrome's notification list
In Chrome, open the three-dot menu > Settings > Privacy and security > Site settings > Notifications. (The old route, Menu > Settings > Advanced > Site Settings, no longer exists: Advanced was folded into the main menus.)
- 2
Find the site under Allowed
Look in the list headed Allowed to send notifications for
torrent9.so, or for any address you do not recognise. - 3
Block or remove it
Click the three dots (the old More actions) next to the address and choose Block, or Remove to delete the permission so the site has to ask again. To stop every site from asking, choose Don't allow sites to send notifications on the same page.
- 4
Check that it stopped
Notifications from a site you blocked stop at once. If adverts still appear when no browser tab is open, they are not from this permission: check the installed apps and browser extensions below, because an unwanted program on the PC can show adverts by itself.
If you clicked an advert, downloaded something or ran a file
The browser steps are enough if all you saw were notifications or redirects. If a page, an advert or a torrent led you to download and run something, there is a chance a program is installed on your machine. Do these steps soon: the longer an unwanted program stays, the more it can change. If you see adverts even with notifications blocked, that is also a sign of adware on the system.
- 1
Uninstall what came with it
Open Settings > Apps > Installed apps in Windows 11 (Apps & features in Windows 10), sort by install date and uninstall anything you installed on the day the problem began, and anything you do not remember choosing (Uninstall a program or app in Windows On uGetFix). Adware can also add entries that start it with Windows, so check Startup apps in Task Manager afterwards.
- 2
Scan, then scan offline
Run a Microsoft Defender Full scan, then the Microsoft Defender Antivirus (offline scan), which restarts the PC and checks it before Windows starts, where trojans and backdoors that hide in a running system are easier to see. If the scan names threats, follow the steps it gives and remove what it finds. A second scanner from a known maker, run on the same PC, can catch what the first did not; a full system scan lists everything it finds and leaves the decision to you.
- 3
Reset the browser
Use the reset step for your browser above, then check the start page and search engine once more by hand. Resetting removes the extensions that redirect and the changed settings.
- 4
Protect the accounts
If you typed a password, card number or other details into a page an advert opened, change that password now from another device and call your bank about the card, as the FTC advises: stop using the accounts the malware may have seen, update your security software, run a scan and change the passwords.
A removal does not always put the system back as it was: unwanted programs can leave files and settings behind. If the PC is slow or odd after the scan, look at the installed apps and the startup apps again, and use Windows's own Reset this PC only when nothing else helps. If your personal files were locked and a note demands payment, that is ransomware, a different problem with its own steps.
How to keep it from happening again
Do
- Turn off notification requests: in Chrome, Settings > Privacy and security > Site settings > Notifications > Don't allow sites to send notifications.
- Get programs only from their makers' sites or the Microsoft Store, not from a torrent or a download page; official providers do not bundle extra software.
- When an installer offers Custom or Advanced setup, choose it, read each step and untick extra programs and pre-ticked offers.
- Keep Microsoft Defender SmartScreen on, or Chrome's Enhanced protection: both warn before known malicious pages and downloads. A security program from a known maker also helps block malware before it runs, and when it warns you about a file, believe it and delete the file.
- Keep a current backup of your files (File History or OneDrive), so an infection or a failed disk does not cost you your documents; our old guide pointed to data recovery tools, but the backup is what saves the files.
- A VPN hides your IP address from the sites and ad networks you visit, which is the one true thing the VPN adverts say; it does not block adverts or malware, and it does not make a download safe. If you want one, pick it yourself from its maker's site, not from an advert on a torrent page.
Don't
- Click Allow on a page that says you must allow notifications to continue, to prove you are not a robot or to see a download.
- Install anything offered by a pop-up, banner or redirect, whether it calls itself a VPN, a cleaner, an update, a search tool or a security tool.
- Add an extension because a page says it is recommended: the WebSearchConverter page in our picture is an example.
- Run an
.exe,.msior.scrfile that a film, show or song torrent gave you. - Click the large "Download", "Play" or "Telecharger" buttons that sit around a torrent listing: they are adverts, not the file.
- Believe a box that prints your IP address and says someone is watching you: it is an advert.
Safer ways to get what you are looking for
Our 2020 guide said it is best to avoid torrent sites altogether and to find free alternatives instead of risking the computer, and the FTC says the same of unfamiliar download sites and file-sharing sites. The same goes for the other torrent sites our old text named, 1337x.to, Limetorrent.info and Thepiratebay.org: they live on the same kind of adverts. Start from the owner's own site, and you get the file the maker intended, with no third-party adverts between you and it.
| You want | Where to get it |
|---|---|
| A Linux system or open-source program | The project's own download page; many offer their own official torrent |
| Films and TV series | A licensed streaming or purchase service (our old text named Netflix; there are many), or your library's free lending service |
| Music | A licensed streaming or purchase service, or the artist's own page |
| Old films, books and recordings in the public domain | The Internet Archive |
| Games | The publisher's store or a store such as the Microsoft Store, Steam or GOG |
| Paid software | The maker's site; ask for a free trial or a free alternative instead of a crack |
If you do use a torrent site anyway, use a browser profile with notifications blocked, close every advert rather than click it, check file types before opening anything and scan a download before you run it.
Questions about Torrent9.so
Is Torrent9.so safe?
No site of this kind is safe to click around on, and Torrent9.so passed our test browser to another site on its own. In our October 2026 test, with no click, the browser went through two advert click trackers and ended on a file page at MEGA that said the file was no longer available.
That is one visit, which shows what the address can do, not everything it does. The page itself installs nothing, but its adverts can open tabs, ask for notifications or offer downloads, and the files in torrent lists are uploaded by strangers. If you must look, use a browser with notifications blocked and download nothing.
Does Torrent9.so have a virus?
The website is not a virus, because loading a web page installs nothing by itself. What people call the virus is the adverts, redirects and notification requests around it, and any file they download.
Our 2020 pictures show a free-VPN advert box on the page and a redirect to a page that asked to add the WebSearchConverter extension to Chrome, whose small print said it would change the default search.
A file from a torrent or an advert can be malware, so if you ran one, follow the Microsoft Defender full scan and offline scan steps above.
How do I stop Torrent9.so notifications and pop-ups?
Block the site in your browser's notification list. In Chrome, open the three-dot menu, then Settings, Privacy and security, Site settings, Notifications, find torrent9.so under the list of sites allowed to send notifications, click the three dots next to it and choose Block or Remove.
Our 2020 guide gave the old route through Advanced, which Chrome no longer has. Edge, Firefox and Safari have the same list under their own settings, and the removal chapter above has each. If adverts continue with the browser closed, check the installed apps for a program you did not choose.
Why does Torrent9.so redirect me to other sites?
Because the adverts on the page are sold through ad networks that pass visitors on. Our route in 2026 went from torrent9.so to a click-tracking address, then to a second click address, then to a file page; the first address carried the site's name in its link so the network can pay the site per visitor.
Where you land depends on who bought the click that day, your country and your browser. In 2020 our clicks led to a VPN offer and an extension page. Do not install or allow anything on those pages.
Did Torrent9.so ask me to allow notifications?
It can, but our own visit did not see a request. On 6 October 2026 neither the first page nor the page we ended on asked for notifications, and no service worker was registered by the site.
That is nothing on one visit: adverts and requests often change by country, device, referrer, a delay or a second visit, and many hide from automated browsers. Our 2020 guide said the site offered to subscribe visitors to notifications that promote scams and phishing links. If you clicked Allow once, take the permission back using the steps above.
Can I get ransomware from a torrent site?
Yes, files from torrents are one of the ways people get ransomware, and pirated software is the most common one. Our 2020 guide named the Nobu and Weui variants of Djvu (STOP) ransomware, which use cracks and pirated installers.
Emsisoft's malware lab wrote that STOP is spread almost exclusively through key generators and cracks, and that some versions bundle password-stealing trojans.
Malwarebytes reported in 2016 that adverts on The Pirate Bay dropped ransomware. We did not see ransomware on torrent9.so itself. Never run an installer, crack or keygen from a torrent, and keep a backup.
Is it legal to use Torrent9.so?
Torrenting is not illegal in itself, but downloading protected films, series, music, software or games without the owner's permission infringes copyright in many countries. Our 2020 guide made the same point. The law depends on your country and on the file, and some internet providers pass on warnings to people who download protected files.
Torrents of public-domain, open-source and openly licensed material are fine. We do not give legal advice. Licensed streaming and purchase services, the maker's own site and the Internet Archive carry no such risk.
What is WebSearchConverter and why did Torrent9.so send me there?
In our 2020 test, a Torrent9.so advert led to a page titled "Please add WebSearchConverter" with an ADD TO CHROME button. The small print on that page said that adding the extension would change the browser's default search.
We called it a browser hijacker, and the page's own words support the part about changing search. If you added it, open chrome://extensions, click Remove under anything you did not install yourself, then check the start page and search engine and reset Chrome if they were changed.
What is the safest way to watch or get what I am looking for?
Start from the owner's own site or a licensed service. For films, series and music, use a licensed streaming or purchase service; our 2020 guide named Netflix, but there are many. For open-source software, use the project's download page.
For paid software, ask for a free trial or a free alternative instead of a crack. Old films and books are on the Internet Archive. If you still use a torrent site, block its notifications, close adverts rather than click them, check file types and scan before you run anything.
Will Fortect remove Torrent9.so?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Torrent9.so, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Google Chrome Help: Use notifications to get alerts (no longer online) (read October 6, 2026)
- FTC: Malware: How To Protect Against, Detect, and Remove It (read October 6, 2026)
- Emsisoft: Emsisoft releases new decryptor for STOP Djvu ransomware (read October 6, 2026)
- Malwarebytes Labs: Malvertising on The Pirate Bay drops ransomware (read October 6, 2026)