Malwarebytes blocking something related to Malwarebytes Privacy VPN?

[fspriggs]

Hello - the Malwarebytes software looks like it's blocking something related to the Malwarebytes VPN.  Please see the image.  Is that correct?  Why would the service do that?  I'm just trying to learn more.  Thank you!  

[thisisu]

Hi,

Thanks for your question. :)

Malwarebytes isn't blocking the VPN, but rather an attempt to connect to this IP address. It appears to be related to a threat known as Backdoor.AsyncRAT. You might want to visit our malware removal forums to make sure your system is clean.

Best regards

[fspriggs]

I ran Malwarebytes Premium 4.5.10 and it said no threats were detected.  Is there any further action I should take?  

 

[gonzo]

You are very likely in good shape.  You were using the VPN as your network connection, and the site you were on (or if on a Google search, a site that they showed) was on the IP address that was blocked.  The fact that it was blocked is a good thing, because whatever is there was prevented from becoming part of your world.  As a reference, many IP addresses provide service for multiple websites AND there are as many (or more) internet resources that have nothing to do with websites.  The internet is a much larger place than most people think, so a good protection product is essential.  As long as the bad guy was blocked, you're okay.

[fspriggs]

The block happens when the Malwarebytes Privacy VPN connects to certain servers in USA - Miami, FL.  It just happened again.

The file attempting the connection is the VPN.  The blocked IP address is awfully close to some of the private IP addresses the Malwarebytes VPN uses in Miami.

Why would the Malwarebytes VPN attempt to connect to something that the Malwarebytes Premium knows is malicious? 

Malwarebytes premium says the device is clean.  Thanks!    

[gonzo]

I just confirmed the behavior you mentioned.  The VPN pipe is going through a server that is also used by another user for malicious purposes - or it is a false positive.  It was mentioned earlier that malware is being hosted on this server as well.  As I mentioned, there is a lot more to the internet than what most of us are aware of.  This is a perfect example.  I will refer this thread to the Product Manager for the VPN so he can look into it further.

[fspriggs]

Thank you for the information!