AlfaVitaY2K2 Posted September 1, 2023 ID:1586346 Share Posted September 1, 2023 Malwarebytes Browser Guard blocked an extension called VeePN. It's a free VPN for Chrome. MB said it contains a trojan. I've checked on Google Play store and this extension has many users. It's quite popular. No other browser security extensions blocked it. Is it possible to check if this extension VeePN really contains a trojan, or if it's a false positive? Link to post
Staff BjelakovicL Posted September 1, 2023 Staff ID:1586349 Share Posted September 1, 2023 Hi, Can you post a screenshot of the block please? Thank you! Link to post
AlfaVitaY2K2 Posted September 1, 2023 Author ID:1586352 Share Posted September 1, 2023 5 minutes ago, BjelakovicL said: Hi, Can you post a screenshot of the block please? Thank you! Sorry, I can't. I've got scared and deleted the extension right away. MB said: Extension blocked because contains a trojan. This is the extension: https://chrome.google.com/webstore/detail/free-vpn-for-chrome-vpn-p/majdfhpaihoncoakbjgbdhglocklcgno Link to post
Staff BjelakovicL Posted September 1, 2023 Staff ID:1586355 Share Posted September 1, 2023 8 minutes ago, AlfaVitaY2K2 said: MB said: Extension blocked because contains a trojan. Unfortunately, I'm not able to replicate this issue. Link to post
AlfaVitaY2K2 Posted September 1, 2023 Author ID:1586356 Share Posted September 1, 2023 2 minutes ago, BjelakovicL said: Unfortunately, I'm not able to replicate this issue. Well, you have to activate the extension's VPN to be blocked. MB blocked the extension only when I clicked on the button to activate the VPN. MB did not block the extension when it's not working. There is a big green button when you click on extension icon, you need to click on that button to activate the VPN working. Link to post
Staff BjelakovicL Posted September 1, 2023 Staff ID:1586358 Share Posted September 1, 2023 I did all of that the first time I tried. Can you check for DB updates in Browser Guard and try to install the VPN again? If you encounter any blocks please take a screenshot and post it here. Link to post
AlfaVitaY2K2 Posted September 1, 2023 Author ID:1586362 Share Posted September 1, 2023 6 minutes ago, BjelakovicL said: I did all of that the first time I tried. Can you check for DB updates in Browser Guard and try to install the VPN again? If you encounter any blocks please take a screenshot and post it here. Where is your menu from? My MB extension doesn't have this menu. Link to post
Staff BjelakovicL Posted September 1, 2023 Staff ID:1586363 Share Posted September 1, 2023 Click on the three dots in the top right corner, then click on Support and you should be able to see the update button. Link to post
AlfaVitaY2K2 Posted September 1, 2023 Author ID:1586364 Share Posted September 1, 2023 1 minute ago, BjelakovicL said: Click on the three dots in the top right corner, then click on Support and you should be able to see the update button. Yes. The menu is there. It says the updates are OK. I will try to repeat as you said. Link to post
AlfaVitaY2K2 Posted September 1, 2023 Author ID:1586365 Share Posted September 1, 2023 2 minutes ago, BjelakovicL said: Click on the three dots in the top right corner, then click on Support and you should be able to see the update button. BTW. I installed your MB extension from Google Play, but Malwarebytes AV says it's not installed. Is this normal? Link to post
AlfaVitaY2K2 Posted September 1, 2023 Author ID:1586368 Share Posted September 1, 2023 9 minutes ago, BjelakovicL said: Click on the three dots in the top right corner, then click on Support and you should be able to see the update button. This is weird. Installed it again and switched on, but your extension is not blocking anymore. What does it mean? Link to post
AlfaVitaY2K2 Posted September 1, 2023 Author ID:1586413 Share Posted September 1, 2023 5 hours ago, BjelakovicL said: Click on the three dots in the top right corner, then click on Support and you should be able to see the update button. Hi. I figured out what happened. MB blocks this extension only if you choose Russia for VPN address. Does this mean the Russian address has a trojan, like MB says? Link to post
leo3487 Posted September 2, 2023 ID:1586566 Share Posted September 2, 2023 (edited) 17 hours ago, AlfaVitaY2K2 said: This is weird. Installed it again and switched on, but your extension is not blocking anymore. What does it mean? You had an old version of MB extension. Or for some reason your MB extension was broken and needed a factory reset Reinstall it did both, a fresh install and last version Edited September 2, 2023 by leo3487 Link to post
AlfaVitaY2K2 Posted September 2, 2023 Author ID:1586567 Share Posted September 2, 2023 2 minutes ago, leo3487 said: You had an old version of MB extension No. MB extension blocks the VPN only when I switch to Russian address from St. Petersbourgh. You need to switch to this address and you will see it blocked. Link to post
Staff BjelakovicL Posted September 2, 2023 Staff ID:1586620 Share Posted September 2, 2023 8 hours ago, AlfaVitaY2K2 said: No. MB extension blocks the VPN only when I switch to Russian address from St. Petersbourgh. You need to switch to this address and you will see it blocked. Please post a screenshot of the block. I'm not able to replicate the issue again. Link to post
AlfaVitaY2K2 Posted September 2, 2023 Author ID:1586648 Share Posted September 2, 2023 3 hours ago, BjelakovicL said: Please post a screenshot of the block. I'm not able to replicate the issue again. Sorry, but the block message is very fast and disappears automatically. Can't do a screenshot. The only way to replicate is to switch to the Russian address of St. Petersburg and see it blocked by MB eextension. Here is the address from my MB log: credibility-ru.tlsext.com This is all I've got from the MB logs of blocked addresses. Link to post
Porthos Posted September 2, 2023 ID:1586651 Share Posted September 2, 2023 @AlfaVitaY2K2 You keep saying Browser Guard. That address is blocked by Malwarebytes Premium. @BjelakovicL Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 9/2/23 Protection Event Time: 11:15 AM Log File: fec7103a-49ab-11ee-97a3-4439c43a4aa3.json -Software Information- Version: 4.6.2.281 Components Version: 1.0.2131 Update Package Version: 1.0.74769 License: Premium -System Information- OS: Windows 10 (Build 19045.3324) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , C:\Program Files\Mozilla Firefox\firefox.exe, Blocked, -1, -1, 0.0.0, , -Website Data- Category: Malware Domain: IP Address: 50.87.110.165 Port: 80 Type: Outbound File: C:\Program Files\Mozilla Firefox\firefox.exe (end) 1 Link to post
AlfaVitaY2K2 Posted September 2, 2023 Author ID:1586657 Share Posted September 2, 2023 36 minutes ago, Porthos said: @AlfaVitaY2K2 You keep saying Browser Guard. That address is blocked by Malwarebytes Premium. @BjelakovicL Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 9/2/23 Protection Event Time: 11:15 AM Log File: fec7103a-49ab-11ee-97a3-4439c43a4aa3.json -Software Information- Version: 4.6.2.281 Components Version: 1.0.2131 Update Package Version: 1.0.74769 License: Premium -System Information- OS: Windows 10 (Build 19045.3324) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , C:\Program Files\Mozilla Firefox\firefox.exe, Blocked, -1, -1, 0.0.0, , -Website Data- Category: Malware Domain: IP Address: 50.87.110.165 Port: 80 Type: Outbound File: C:\Program Files\Mozilla Firefox\firefox.exe (end) So it's not a false positive? It's a real trojan? Link to post
Porthos Posted September 2, 2023 ID:1586662 Share Posted September 2, 2023 23 minutes ago, AlfaVitaY2K2 said: So it's not a false positive? It's a real trojan? I DID NOT say that, I only provided a log for staff to review. Link to post
Staff BjelakovicL Posted September 5, 2023 Staff ID:1587147 Share Posted September 5, 2023 On 9/2/2023 at 7:06 PM, AlfaVitaY2K2 said: Here is the address from my MB log: credibility-ru.tlsext.com This is a valid IP block. https://www.virustotal.com/gui/ip-address/77.73.69.59/detection On 9/2/2023 at 7:21 PM, Porthos said: Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 9/2/23 Protection Event Time: 11:15 AM Log File: fec7103a-49ab-11ee-97a3-4439c43a4aa3.json -Software Information- Version: 4.6.2.281 Components Version: 1.0.2131 Update Package Version: 1.0.74769 License: Premium -System Information- OS: Windows 10 (Build 19045.3324) CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , C:\Program Files\Mozilla Firefox\firefox.exe, Blocked, -1, -1, 0.0.0, , -Website Data- Category: Malware Domain: IP Address: 50.87.110.165 Port: 80 Type: Outbound File: C:\Program Files\Mozilla Firefox\firefox.exe (end) This IP is not in the database. Link to post
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now