Know what you are about to download

Every file sharing network has them: the film that turns out to be a different film, the album that is a program, the release that wants a password nobody has. Classic eMule leaves you to find out after the download. eMule Qt weighs the evidence beforehand and tells you what it thinks — and why.

A Confidence column

Search results, indexer results and the download list each have a Confidence column. Every file gets a fake score from 0 to 100 and one of six verdicts:

The column is coloured and sorts worst-first or best-first, so the doubtful results of a search can be pushed out of sight with one click. The web interface shows the same column, and the REST API and the MCP tools return the verdict with its reasons.

What it looks at

• Names that disagree — one file shared under names that describe different content, or as different kinds of file (a video here, an archive there). The words you searched for are ignored, since they are in every name.
• Disguises — a program or an archive named like a media file, or a published file type that does not fit the extension.
• The first bytes — once a download has its beginning, the content is compared with what the extension claims.
• Media data that cannot be true — a length or bitrate that does not fit the size, or an artist, album and title that appear in none of the names.
• What other users say — ratings, comments, Kad notes that call a file a fake, and the spam filter’s own rating.
• Hashes that disagree — sources reporting different AICH hashes for the same file.
• Locked releases — a Usenet release listed as password protected with no password supplied.

Each reason counts once, and popularity alone proves nothing: a popular fake has many sources too.

It tells you why

Hover a verdict and the tooltip gives the score and one line per reason — “It is a program named like a media file”, “Sources disagree on the AICH hash”. You are shown the evidence, not just a colour.

Marks beside the file name

The download list, the search results and the shared files list can also show small marks right after a file’s type icon. Two of them belong to fake detection, and they answer different questions. A file can carry both at once.

The exclamation mark: the file contradicts itself

Mark	What it means
	Red — the first bytes of the file are not the media its name promises. Either they match no media format at all (“Named .avi but matches no media container we recognise — very likely a fake”), or they are another kind of media, such as a video name on a file that holds only sound (“Named .avi but the contents are WAVE”).
	Yellow — only the extension is wrong. The file is the right kind of media in a different format: a video in another video format, or audio in another audio format (“Named .avi but the contents are MP4. Only the extension is wrong — most players still open it.”). Players that look at the content, such as VLC or mpv, play it, and renaming it to the right extension removes the mark.

This is eMule Qt’s own check of the file’s content, not anyone’s opinion. It needs the beginning of the file, so it shows on downloads that have their first bytes and on shared files, never on search results. It is always drawn and cannot be switched off. The red mark also raises the fake score in the Confidence column; the yellow one counts for much less, since the file is still what it claims to be.

Each finding is written once per session to the normal Log tab: “File header check: name — what was found“. Downloads are always logged. Shared files are checked again at every start, so they are logged only when Options → Extended → Log fake-file header warnings for shared files too is on. When a download reaches Suspect or worse, the log also gets a “Fake check:” line with its verdict, score and reasons.

The two figures: what other users say

Mark	What it means
	Fake — other users rated the file as a fake.
	Poor
	Fair
	Good
	Excellent
	Not rated, but somebody left a comment worth reading.

The more red in the figures, the worse the rating. These come from the ratings and comments other users attach to the file, collected from sources and from Kad. Double-click a file and open the Comments tab to read them. The marks are the classic eMule ones and follow the same switch: Options → Messages and Comments → Indicate downloads with comments/rating by icon.

A red exclamation with no ratings behind it is normal: the bytes speak for themselves even when nobody has commented on the file yet.

It remembers

The names a file has gone by are kept across restarts, so a fake that shows a different name in every search is still recognised as one file with many stories. The memory is bounded: entries nobody has seen again for half a year are dropped.

A warning, never a filter

The detector hides nothing and blocks nothing. A file marked “Likely fake” stays in the list and can be downloaded like any other. The decision is yours.

Back to all features