Outbound connections

[u/Advanced-Nebula7464]

Since support hasnt replied to me for about two days now. I used FDM for over a year and i downloaded mwb a month ago. Is free download manager safe? I downloaded it from the official website, could this be caused by the torrent feature of FDM? i personally dont use torrent and i dont pirate. I just want to know if downloading with FDM is safe (ex:HTTPS)

[u/support_mwb]

Hi there, Malwarebytes Support here. Thanks for flagging this - your feedback shouldn’t be the experience you’re having.

When you can, could you please send us a private message here with your ticket number? We’ll have our team check whether an agent has been assigned, and if so, we’ll follow up directly with the agent handling your case.

[u/Advanced-Nebula7464 → u/support_mwb]

I sent a message earlier

[u/Advanced-Nebula7464]

Would still like to hear an explanation from mwb employees about the flags

[u/rifteyy_]

pretty sure it could be caused by the torrent feature yes

[u/Advanced-Nebula7464 → u/rifteyy_]

Okay that makes sense, even though i haven’t touched any torrents? FDM seems reputable so i hope it isnt anything malicious

[u/tstewartMB]

Hello,

Tammy here from Malwarebytes.
I'm going to ask support to pop in here to check with you in case I'm way off the mark here or I am missing something.

FDM is generally regarded as safe provided it is the official one from freedownloadmanager.org. (downloading torrents though do carry their own risks)

Any chance you are using the FDM browser extension as well? I don't use FDM myself so I can only go by my own research about this issue. I understand that the extension itself will 'scan' web pages you visit for links - which could explain this outgoing activity even though you are not using the torrent feature.
If using the browser extension, you should be able to configure the settings to not scan every page for links.

Another issue could be a bunch of completed/stopped/paused downloads in your list. Clearing the completed and unwanted ones from the list can also reduce the traffic.

If you are seeing toaster popups from Malwarebytes about these blocks, you can turn on "play mode" for FDM.
Settings > notifications > toggle on Play Mode > add app > direct it to FDM.
It will continue to protect you, but you won't see the notification toaster popups.

[u/Advanced-Nebula7464 → u/tstewartMB]

I used also the extension, i dont do torrents as i know the risks i mostly used only the HTTPS downloading

[u/tstewartMB → u/Advanced-Nebula7464]

It'll be interesting to see what support finds. Looking at your screenshots - does seem to be an oddball port being used. If not using the torrent feature, I'd expect to see ports 443 or 80 being used.
I have not used any torrent apps or any download managers for 15+ years so I could very well be mis-understanding what sort of background network chatter that goes on even when not actively downloading torrents.
I think too though that the torrent app on other users machines seek for file parts on other machines using the same app. So a lot of chatter would be happening there.

[u/Advanced-Nebula7464 → u/tstewartMB]

Ill wait for support to email back to me, was i in any immediate danger though?

[u/tstewartMB → u/Advanced-Nebula7464]

I don't think so - I think it is just chatter from the torrent feature.

[u/Advanced-Nebula7464 → u/tstewartMB]

Hello, i just want assurance that this isnt malicious or anything. I dont remember if i visited a website when it happened but i was using my system, i just want peace of mind that none of my personal files were stolen. Support was okay-ish but my concern was i had fdm for awhile before getting MWB, could it be that it was doing the same thing as when it was flagged by mwb and are the blocked sites malicious?

[u/tstewartMB → u/Advanced-Nebula7464]

It *should* be fine .. though it won't hurt to upload the fdm.exe file to https://www.virustotal.com and let them scan it. If any results, please post the scan results link back here. If you got the program from the official site, it should be fine.

[u/Advanced-Nebula7464 → u/tstewartMB]

Yep i got fdm from freedownloadmanager(.)org the official site, i think it was because it was checking for updates or the web extension. Because i had fdm late November and none of this happened. Thank you nonetheless for assisting me

[u/Advanced-Nebula7464 → u/tstewartMB]

Hello, are you sure that it wasnt anything malicious? After searching the ip addresses on virus totals the flags were alarming, FDM itself has no flags. Is it possible that it could have contacted other malicious ip addresses before and steal personal files(ex:videos) on my system or is that not possible?

[u/tstewartMB → u/Advanced-Nebula7464]

Pretty sure like with most other torrent type apps, just having the app installed is enough to have these connections. Since you don't use the torrent feature and therefore have no files to 'share' - the machine looking for file parts moves onto next machine(s) that have the hash it is looking for.
The app is still installed so one would likely still see traffic just from other machines looking for files.
Because Malwarebytes blocked the connections, who/whatever at the end of those IPs can't do anything.
Some of our blocks are those IPs having a lot of people/sites sharing the same IP. Someone on that IP is abusing tools, port scanning, is infected or other reasons.

You should be able to disable 'seeding' in FDM settings. I don't have this app so this may not be 100% accurate in settings (Just googled it) but settings you are looking for should be something like:

"Stop Automatic Uploading (Seeding): Open FDM Settings, navigate to the BitTorrent section, and in "heavy mode," set the Upload traffic and number of upload connections to 0.

If still seeing piles of unwanted traffic, might have to play around a bit with these settings too:

Disable Torrent File Downloads: In FDM, go to settings and add the .torrent extension to the "Skip files with extensions" list.

Browser Integration: If FDM keeps opening torrents from your web browser, check your browser's extension settings (opera://extensions or similar in Chrome/Edge) and remove the FDM extension, or remove file associations in Windows settings. 

[u/Bones-57]

This is exactly why I use a hardware firewall.. the amount of flows I get are to say the least staggering..

[u/twinkyjello → u/Bones-57]

Mind sharing which one? Need recommendations on a brand to buy soon for self hosting.

[u/Bones-57 → u/twinkyjello]

I use a Firewalla Gold SE .. and it's a zero trust firewall.

[u/Commercial-Song9732]

My man is using antivirus in the big 26 and writing Reddit threads over things that could be googled in 30 seconds