7

I have ExpressVPN installed and keep getting strange warnings from Malwarebytes anti-malware.

First odd fact is that XVPND.exe is always running, even after a reboot. I have set ExpressVPN to not auto start at boot. There is no systray icon whatsoever. So first of all, does anyone have any clue why that file is running and listening on port 2015 (TCP)?

Second I keep getting warnings from Malwarebytes anti-malware that XVPND.exe connects to malicious IP-adresses (e.g. 199.19.94.101). When looking up that IP it seems to belong to a Canadian e-commerce service: Yesup Ecommerce Solutions Inc.

I would like to monitor the .exe to see what other connections it makes, any suggestions on how to (on Windows)?

Improve this question
3
  • While we appreciate your concern, this is off-topic here. This is either a question for ExpressVPN support or for SuperUser.
    – schroeder ♦
    Jan 29, 2016 at 15:44
  • @schroeder just to make it clear, you mean questions about spyware are off topic on this site? I don't personally care and not active here, just wondering.
    – Shadow Wizard Love Zelda
    Feb 12, 2019 at 11:24
  • @ShadowWizard questions of the type "this commercial product is behaving unexpectedly - why?" is a question for the vendor's support. This stance is justified by the vendor's support showing up below and answering the question. Because it is closed source, we can only guess. The vendor knows. Even if they are lying, they are the ones who will have facts. Not us.
    – schroeder ♦
    Feb 12, 2019 at 11:27

1 Answer 1

Reset to default
10

I work for ExpressVPN. No, this is not malware. Here’s what’s happening:

  1. The ExpressVPN app for Windows is composed of two parts: the UI and the “engine”. The UI runs as a regular Windows app. The engine (xvpnd.exe) runs as a Windows service and is responsible for controlling the VPN. One benefit of this design is that the VPN is not affected if the app crashes, and that the VPN killswitch can start as early as possible on boot.
  2. The app and engine communicate with each other using http. That’s why you see the engine listening on port 2015. Important: the engine binds to the local network only. No outside traffic can reach that port.
  3. When the user connects to the VPN, the engine is responsible for testing which of our VPN endpoints is likely to give the most reliable and fastest VPN connection. It does that by sending UDP packets to various VPN server IP addresses. The IP you mentioned (199.19.94.101) belongs to our “Canada - Toronto” VPN server location.
  4. It’s possible you encountered a bug here. The engine is only supposed to test VPN servers when you’re about to connect to a location, and it seems what you’ve reproduced is a case where the engine was testing VPN servers regardless. Our team is investigating and will fix once we determine the root cause. Thanks for raising the issue.
  5. We ourselves haven't been able to reproduce the warning yet in Malwarebytes, however we will contact them for further information. In the meantime you can add an exclusion for ExpressVPN by following these steps: https://support.malwarebytes.org/customer/portal/articles/1835329-how-do-i-stop-malwarebytes-anti-malware-from-blocking-scanning-a-file-or-program-that-i-trust-?b_id=6438
Improve this answer
2
  • Problem seems to continue. Today (and few days ago) another warning. Same story. Wondering if it connects to even more servers? Cant think of a reason why the canadian servers is choosen either, I'm in europe.
    – private
    Feb 8, 2016 at 22:47
  • if you had deleted the expressvpn parts I'm pretty sure it would have surfaced as a different name. thats what the malware does now. you can spot it with irregularities in process explorer.
    – Lassi Kinnunen
    May 5, 2016 at 13:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .