VLC download site blocked

[BillH99999]

I tried to download the latest version of VLC and got this block.

Why is this being blocked?  I've used VLC for years.

Thanks,
Bill

[David H. Lipman]

I totally agree.  VLC Player is great for playback and to record.  However you should ALWAYS get VLC Player from the source which is VideoLAN

https://www.videolan.org/vlc/index.html

 

 

[BillH99999]

Dave,

I don't know.  I went to the VLC website, clicked on the download button, and that is the site it took me to.  Just tried it again and it was blocked again.

Bill

[dcollins]

@BillH99999 can you link the page you're downloading from? My downloads are coming directly from videolan.org, and I don't see any indication of there being mirrors on their site. 

[David H. Lipman]

When I choose the download from VideoLAN the download emanates from the Oregon State University Open Source Lab...

https://ftp.osuosl.org/pub/videolan/vlc/3.0.4/win32/vlc-3.0.4-win32.exe

[BillH99999]

@dcollins

I went to this site, https://www.videolan.org/vlc/index.html, and clicked on the orange button labeled "Download VLC".

When I click on that button it takes me to http://videolan.mirror.pacificservers.com/vlc/3.0.4/win64/vlc-3.0.4-win64.exe which is the one being blocked.

Thanks
Bill

Edited September 1, 2018 by BillH99999

[dcollins]

Interesting... are you using normal Google Chrome, or a special build? Are you connected through a VPN or proxy of any kind?

[exile360]

Yep, based on the URL it looks like a CDN/hosting provider being used by VLC/VideoLAN much like what Malwarebytes themselves and many other software vendors use; for example:

https://data-cdn.mbamupdates.com/web/mb3-setup-consumer/mb3-setup-consumer-3.5.1.2522-1.0.441-1.0.6595.exe

That said, using IE (just to make sure it wasn't blocked and because its built in download manager allows one to easily grab the direct URL for files being downloaded) I just downloaded 2 versions of VLC direct from VLC's website (assuming it is www.videolan.org), the 32 bit ZIP package/portable version and the 64 bit installer (why no 64 bit ZIP/portable version VideoLAN, come on man ) and here are the URLs where the actual downloads came from:

https://mirror.lstn.net/videolan/vlc/3.0.4/win32/vlc-3.0.4-win32.zip
https://mirror.clarkson.edu/videolan/vlc/3.0.4/win64/vlc-3.0.4-win64.exe

It looks to me like, as with many open source/freeware tools/programs, they are relying on charitable third parties and non-profits to host their files/downloads for them.

I got my downloads from mirrors too and when you select the build you want from the drop-down menu (the small arrow on the right side of the big orange Download VLC button) on this page it takes you to the page where the download comes through from a mirror that I assume it semi-randomly selects:

https://get.videolan.org/vlc/3.0.4/win64/vlc-3.0.4-win64.exe
https://get.videolan.org/vlc/3.0.4/win32/vlc-3.0.4-win32.zip

Edited September 1, 2018 by exile360

[dcollins]

Ahh yep, ok, now I can reproduce this. Thanks

[BillH99999]

I'm guessing you no longer need this info, but since I'm not absolutely sure... here it is.  I am using normal Google Chrome, no VPN, and no proxy.

Bill

[rakka]

whitelisted 

[BillH99999]

@rakeshsejwal

Thanks!

Bill

[bhabel]

VLC is still being flagged.

vlc-3.0.4-win32.exe
vlc-3.0.4-win64.exe

Exploit payload process blocked                BLOCK           C:\Users\jhay\AppData\Local\Temp\vlc-3.0.4-win32.exe             jhay       VLC Player           C:\Program Files (x86)\VideoLAN\VLC\vlc.exe   Attacked application: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe; Parent process name: SpillmanClient.exe; Layer: Application Behavior Protection; API ID: 205; Address: ; Module: ; AddressType: ; StackTop: ; StackBottom: ; StackPointer: ; Extra:

Exploit payload file blocked         BLOCK           C:\Users\jhay\AppData\Local\Temp\vlc-3.0.4-win32.exe             jhay       VLC Player           C:\Program Files (x86)\VideoLAN\VLC\vlc.exe   Attacked application: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe; Parent process name: SpillmanClient.exe; Layer: Application Behavior Protection; API ID: 205; Address: ; Module: ; AddressType: ; StackTop: ; StackBottom: ; StackPointer: ; Extra:

Let me know what you need

 

[exile360]

On 9/25/2018 at 12:51 PM, bhabel said:

VLC is still being flagged.

vlc-3.0.4-win32.exe
vlc-3.0.4-win64.exe

Exploit payload process blocked                BLOCK           C:\Users\jhay\AppData\Local\Temp\vlc-3.0.4-win32.exe             jhay       VLC Player           C:\Program Files (x86)\VideoLAN\VLC\vlc.exe   Attacked application: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe; Parent process name: SpillmanClient.exe; Layer: Application Behavior Protection; API ID: 205; Address: ; Module: ; AddressType: ; StackTop: ; StackBottom: ; StackPointer: ; Extra:

Exploit payload file blocked         BLOCK           C:\Users\jhay\AppData\Local\Temp\vlc-3.0.4-win32.exe             jhay       VLC Player           C:\Program Files (x86)\VideoLAN\VLC\vlc.exe   Attacked application: C:\Program Files (x86)\VideoLAN\VLC\vlc.exe; Parent process name: SpillmanClient.exe; Layer: Application Behavior Protection; API ID: 205; Address: ; Module: ; AddressType: ; StackTop: ; StackBottom: ; StackPointer: ; Extra:

Let me know what you need

 

That detection is actually coming from the Exploit Protection component in Malwarebytes 3, not the Malwarebytes browser extension being discussed in this thread.  To get that issue resolved please create a new topic in the Malwarebytes Exploit false positive area by clicking here and a member of the Research team will assess the situation and take the necessary measures to correct the FP.

Thanks

[Arthi]

Hi bhabel,

Thanks for posting. What version of Malwarebytes are you running?