Malwarebytes started to detect random IP as trojan/malware in cs1.6 [hl.exe

[zex019]

-Website Data-
Category: Trojan
Domain: 
IP Address: 178.175.88.12
Port: 29003
Type: Outbound
File: C:\Program Files (x86)\Steam\steamapps\common\Half-Life\hl.exe
How to fix and should i be worried?

[Porthos]

31 minutes ago, zex019 said:

File: C:\Program Files (x86)\Steam\steamapps\common\Half-Life\hl.exe

As for why Malwarebytes blocks Steam and other games, this is because Steam is Torrent based software, are what are known as Peer-to-Peer (P2P) applications meaning it connects to many different servers/IP addresses (this is how files are downloaded through Torrent based software) and because of this, sometimes Torrent based software will connect to a server that is also known for hosting malicious content.  This is because servers/IP addresses are often shared by multiple sites, so while what you are Playing/downloading through Torrent based software may be perfectly safe, some of the sites hosted on some of the IP addresses that Torrent based software connects to may be malicious.  Such connections are not a threat however, and you may exclude Torrent based software from the Web Protection component in Malwarebytes to stop the blocks from happening without compromising your protection (your web browser and other critical web facing programs will still be fully protected from malicious websites and other malicious content).  To do so, add the game exe to your exclusions using the method described under the Exclude an Application that Connects to the Internet section of this support article.

[zex019]

Thanks for replying fastt..So if i exclude xl.exe it meants that it wont show again as threat but it will block it ?

[Porthos]

5 minutes ago, Porthos said:

hl.exe

Just exclude the above with instructions in my post. When using the game it is harmless to the computer. The computer is still protected.

[Zynthesist]

IP is blocked for mozi:

https://www.virustotal.com/gui/ip-address/178.175.88.12/relations

 

[zex019]

Thanks for fast reply,i will exclude hl.exe

[Zynthesist]

 Mozi is a P2P botnet. Please see this article for more details.

https://www.zdnet.com/article/this-is-why-the-mozi-botnet-will-linger-on/#:~:text=Mozi%20is%20a%20P2P%20botnet,among%20other%20internet%2Dconnected%20products.&text=However%2C%20the%20botnet%20lives%20on,provided%20its%20opinion%20on%20why.

 

[zex019]

So should i exclude hl.exe or let malwarebytes blocking that ip adress... and can something happen to me? im a bit scared and why is this even happening..

[Porthos]

Just now, zex019 said:

why is this even happening..

 

28 minutes ago, Porthos said:

This is because servers/IP addresses are often shared by multiple sites

If are that worried, I would have no issue excluding it knowing how games with p2p connections work, Can use Gamemode to keep the detection's from poping up during game play.

Be aware you will be bombarded with notifications after you close the game.

 

 

[zex019]

yes but staff above say its mozi botnet ip,ad why should i allow it if antivirus blocks it and it doenst harm me?

im so sorry for asking these "Stupid" questions and spamming,i just want to fix it ffs...

[Porthos]

16 minutes ago, zex019 said:

why should i allow it if antivirus blocks it and it doenst harm me?

Then use the Play mode like I posted last with out the the other exclusion. It will be blocked but you will not see the warning until after you close the game.

[zex019]

i didnt do anything and no more showing and blocking on malwarebytes when i start the game

[Porthos]

3 minutes ago, zex019 said:

i didnt do anything and no more showing and blocking on malwarebytes when i start the game

If you have it come back you will know what to do.