Take the 2-minute tour ×

Just some time ago I had this unusual popup from Malwarebytes Anti-Malware (MBAM):
Unusual popup from Malwarebytes Anti-Malware

I did a quick Google of the IP address and found this thread where the OP is complaining of MBAM blocking svchost.exe from this same IP.
I am wondering why is vmware-hostd.exe` connecting to that IP?

Earlier today I had this:
Malwarebytes Anti-Malware uTorrent.exe warning
after which I did a full scan (no malicious items detected) and uninstalled uTorrent.

Am I being hacked?

share|improve this question
add comment

closed as too broad by Scott Pack, Iszi, tylerl, Xander, TildalWave Jun 28 '13 at 21:06


1 Answer

Considering you have been downloading torrents there is a chance that you downloaded some malicious code (which was spotted by your MBAM) through the torrent network.

vmware-hostd.exe is a process used to share virtual machines over the network. It's quite possible that the a scanner was running on the listed remote IP (the IP address is one from China) and that it picked up the VMWare service and tried to log in several times or do something malicious with it (which MBAM picked up and blocked).

If you are directly connected with your computer to the internet I would suggest running your services on non-standard ports, this will reduce the internet background noise. This means that I doubt you are specifically being targeted but more a victim of scanners which scan the whole internet in the hopes of finding an exploitable machine.


After a chat on the DMZ it was confirmed that the host is running a machine with a public IP address.

share|improve this answer
add comment
