Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just some time ago I had this unusual popup from Malwarebytes Anti-Malware (MBAM):
Unusual popup from Malwarebytes Anti-Malware

I did a quick Google of the IP address and found this thread where the OP is complaining of MBAM blocking svchost.exe from this same IP.
I am wondering why is vmware-hostd.exe` connecting to that IP?

Earlier today I had this:
Malwarebytes Anti-Malware uTorrent.exe warning
after which I did a full scan (no malicious items detected) and uninstalled uTorrent.

Am I being hacked?

share|improve this question

closed as too broad by Scott Pack, Iszi, tylerl, Xander, TildalWave Jun 28 '13 at 21:06

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 3 down vote accepted

Considering you have been downloading torrents there is a chance that you downloaded some malicious code (which was spotted by your MBAM) through the torrent network.

vmware-hostd.exe is a process used to share virtual machines over the network. It's quite possible that the a scanner was running on the listed remote IP (the IP address is one from China) and that it picked up the VMWare service and tried to log in several times or do something malicious with it (which MBAM picked up and blocked).

If you are directly connected with your computer to the internet I would suggest running your services on non-standard ports, this will reduce the internet background noise. This means that I doubt you are specifically being targeted but more a victim of scanners which scan the whole internet in the hopes of finding an exploitable machine.


After a chat on the DMZ it was confirmed that the host is running a machine with a public IP address.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.