[MWB keeps flagging Private Internet Access and random IP addreses]

I had this problem late last year and apparently it is still going on. The (slightly) funny part is that when I opened a ticket with PIA about this issue they basically sent me a link to my own thread on here about it and said "its a known issue already." Of course they couldn't have known I was the one that started the topic but I didn't get much else out of them after that. I now use a different VPN instead that doesn't seem to have any rogue IP warnings pop up every once in a while like PIA used to.

 

[Private Internet Access being blocked as a worm]

I'm seeing the same thing again but with a different IP address this time around. I've attached a screenshot of the events from last night and yesterday. I'm also posting the latest event report below:

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 2/18/21
Protection Event Time: 6:12 PM
Log File: f3d5c7b2-7257-11eb-aa01-3c970e169675.json

-Software Information-
Version: 4.3.0.98
Components Version: 1.0.1173
Update Package Version: 1.0.37271
License: Premium

-System Information-
OS: Windows 10 (Build 19041.804)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Program Files\Private Internet Access\pia-service.exe, Blocked, -1, -1, 0.0.0, , 

-Website Data-
Category: RiskWare
Domain: 
IP Address: 212.102.52.87
Port: 0
(No malicious items detected)
Type: Outbound
File: C:\Program Files\Private Internet Access\pia-service.exe

(end)

[Private Internet Access being blocked as a worm]

Hmm, I see that now that I've looked up the IP. I put a support ticket into PIA to ask why their client would be trying to connect to this particular address and will post here when I get a reply. Because of the randomness of where the PIA app wants to communicate it makes me even more wary of simply whitelisting it all.

[Private Internet Access being blocked as a worm]

34 minutes ago, ccodes said:

I have been running them both for years and this was my first time getting this alert.

Same here. I got an update to the app on my android device earlier today and I'm thinking the blocked address might be the update server for PIA because I've had the same error every five minutes or so for the past hour. At this point I'm going to wait for an answer from someone at MWB because its not my anti virus that is causing the problem in my eyes.

[Private Internet Access being blocked as a worm]

I just had a popup from MWB concerning PIA which I use for their VPN service. It alerted me that it was blocking a worm.

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 11/22/20
Protection Event Time: 5:44 PM
Log File: 724a971e-2d2d-11eb-bd2a-3c970e169675.json

-Software Information-
Version: 4.2.3.96
Components Version: 1.0.1112
Update Package Version: 1.0.33286
License: Premium

-System Information-
OS: Windows 10 (Build 19041.630)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Program Files\Private Internet Access\pia-service.exe, Blocked, -1, -1, 0.0.0, , 

-Website Data-
Category: Worm
Domain: 
IP Address: 31.171.154.67
Port: 0
(No malicious items detected)
Type: Outbound
File: C:\Program Files\Private Internet Access\pia-service.exe

(end)

[Driver Easy being listed at malware]

A program I use to update my drivers called Driver Easy got flagged but the real time protection module at malware this evening.

Here is their website: https://www.drivereasy.com

And I have attached a copy of the report from a scan I just did on my notebook.

drivereasy.txt