Had some kind of break of security today so I installed Malware Anti-bytes. It detected Emby related things.

[Mkilbride 88]

Spyware.Stealer, I:\USERS\MKILBRIDE\APPDATA\ROAMING\EMBY-THEATER\SYSTEM\X64\ELECTRON\ELECTRON.EXE, Quarantined, 11135, 1385839, 1.0.114494, , ame, , 6AD3BB332B1657A90CD563735278AC2D, 18CB4C00C9EAC622A6C7265ADA3DBCF23CE750B028F905C9D78EA0384F5B3C8D

 

Later in the day, it attempted to connect to IP address, which Malware Bytes blocked. 

 

The IP is: 93.123.109.120

 

Googling it shows it being malacious. 

 

https://www.abuseipdb.com/check/93.123.109.120?page=1

 

What should I do? 

[ebr 16703]

10 hours ago, Mkilbride said:

Later in the day, it attempted to connect to IP address

Hi.  What is "it" in that sentence?

10 hours ago, Mkilbride said:

Spyware.Stealer, I:\USERS\MKILBRIDE\APPDATA\ROAMING\EMBY-THEATER\SYSTEM\X64\ELECTRON\ELECTRON.EXE, Quarantined

That has to be a false positive...

[Mkilbride 88]

Emby. Emby attempted to connect to that IP according to Malware Bytes. 

[Uncle_Frank 8]

Bro are you on windows ? do you have your modem/router ports open as 8096 & 8092

[Uncle_Frank 8]

9 minutes ago, ebr said:

Hi.  What is "it" in that sentence?

That has to be a false positive...

Nah he's getting port scanned because he has open ports 8096 & 8092 most likely and they are scanning for them ports setting off his malwarebytes 

[Uncle_Frank 8]

Listen, it's like this bro, if you want to open up ports at least go in and hide your emby users don't have them unHidden so a port scanner guy can attack them.

[Mkilbride 88]

I'm on Windows.  And 8096 is open to remote connect to Emby, yeah. 

 

I'm a little jumpy because I had my Discord hacked and some credit card charges made. I can't format the whole system right now so I did a deep clean of everything(99% sure I got rid of it) and have a few different AV running until I have the time to format, as well as changing all my passwords on a separate device that isn't compromised, so when this popped up I just got paranoid. I  have 2FA on everything as well, I was just curious because the link above says it's a known malacious actor. 

[Lessaj 565]

Looks like you're using the legacy Emby Theater app which itself is a honey pot of vulnerabilities since it bundles an old version of Electron. I'd recommend using Emby for Windows instead.

[Mkilbride 88]

I removed it. Just not sure what Frank means about the hide the ember users.  Should I not have the ports open, thought i needed them for remote viewing?

 

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 9/14/2026
Protection Event Time: 12:44 AM
Log File: ea7edfd6-aff6-11f1-bbb3-2cf05d390d60.json

-Software Information-
Version: 5.7.0.328
Components Version: 164.0.5736
Update Package Version: 1.0.114526
License: Trial

-System Information-
OS: Windows 11 (Build 26200.9445)
CPU: x64
File System: NTFS
User: System

-Blocked Website Details-
Malicious Website: 1
, C:\Users\Mkilb\AppData\Roaming\Emby-Server\system\EmbyServer.exe, Blocked, -1, -1, 0.0.0, 17CAE7966BAA7E7AD77BA2215A9C26C5, 3395C5F964031FA55CE126802EB832A246FD6B3D1A4855652AF44422EE4F8994

-Website Data-
Category: RiskWare
Domain: 
IP Address: 93.123.109.120
Port: 8096
Type: Inbound
File: C:\Users\Mkilb\AppData\Roaming\Emby-Server\system\EmbyServer.exe

(end)

Edited 50 minutes ago by Mkilbride

[Uncle_Frank 8]

3 minutes ago, Mkilbride said:

I removed it. Just not sure what Frank means about the hide the ember users.  Should I not have the ports open, thought i needed them for remote viewing?

 

[Uncle_Frank 8]

All 3 hide them

[Mkilbride 88]

Done.  But should I close 8096 off on my router? Or do I really need that for remote play?

Edited 45 minutes ago by Mkilbride

[Uncle_Frank 8]

Long story short your on windows and your pc is hacked/ratted/pwnt.   Your going to eventually need to format that pc wipe it clean so unplug from the net get all your pics family photos etc.... Do yourself a favor download Ubuntu and use linux and put windows behind you

[Uncle_Frank 8]

1 minute ago, Mkilbride said:

Done.  But should I close 8096 off on my router? Or do I really need that for remote play?

Listen to me, that port that you have open 8096 also 8092 is an open door to your entire network. Just that one computer with 8096 open what they do is gain control of that and use that pc to hack everything else in your house like cell phones tablets whatever, that pc with port 8096 open gave them a key to your house.

close all ports never open ports on a modem/router NEVER

[Uncle_Frank 8]

Only STUPID people open ports, you can use nordvpn meshnet free and have all ports closed and still use emby from outside your house

[crusher11 1297]

14 minutes ago, Uncle_Frank said:

Long story short your on windows and your pc is hacked/ratted/pwnt.   Your going to eventually need to format that pc wipe it clean so unplug from the net get all your pics family photos etc.... Do yourself a favor download Ubuntu and use linux and put windows behind you

No reason to believe that at this stage. The quarantine is a known false positive, which I reported to Malwarebytes months, perhaps years, ago. Apparently nothing has been done about it.

 

5 minutes ago, Uncle_Frank said:

Only STUPID people open ports, you can use nordvpn meshnet free and have all ports closed and still use emby from outside your house

You really need to calm down. Every thread you're in you're posting dozens of posts at a time, often inaccurate, and now you're escalating to abuse?

[Uncle_Frank 8]

Sorry

 

[Mkilbride 88]

Well, he may be overly aggressive, but he's not wrong about the first part, I do need to format, not because of Emby, but because of what happened. I just can't right at the moment so I'm not really using the PC it happened on. 

[crusher11 1297]

2 minutes ago, Uncle_Frank said:

Sorry

 

What in pluperfect hell does that video have to do with anything?

2 minutes ago, Mkilbride said:

Well, he may be overly aggressive, but he's not wrong about the first part, I do need to format, not because of Emby, but because of what happened. I just can't right at the moment so I'm not really using the PC it happened on. 

We have no idea, at this stage, what happened. Formatting may achieve nothing.

[Uncle_Frank 8]

2 minutes ago, Mkilbride said:

Well, he may be overly aggressive, but he's not wrong about the first part, I do need to format, not because of Emby, but because of what happened. I just can't right at the moment so I'm not really using the PC it happened on. 

Its ok bro dont mind them they are just people who run their mouth ignore them. So to fix your pc first you tell me what kind of modem router you have and we go from there

[crusher11 1297]

Just now, Uncle_Frank said:

Its ok bro dont mind them they are just people who run their mouth

A bizarre complaint coming from someone who keeps stringing together half a dozen consecutive posts, frequently without any actual content in them.

2 minutes ago, Uncle_Frank said:

So to fix your pc first you tell me what kind of modem router you have and we go from there

How on earth does the modem relate to fixing the PC?

[Uncle_Frank 8]

crusher11 is like a bad rash you get on your arse that keeps coming back, ignore that guy.

[Uncle_Frank 8]

How on earth does the modem relate to fixing the PC? shows your not smart enough for this convo GO away, thnx.

Modem has an open port the modem is the reason he got hacked 

[Uncle_Frank 8]

Lessaj you can anser this, why does an open port cause a threat ?   thought so

I'm not that guy just sayen

Edited 4 minutes ago by Uncle_Frank

[crusher11 1297]

8 minutes ago, Uncle_Frank said:

How on earth does the modem relate to fixing the PC? shows your not smart enough for this convo GO away, thnx.

Modem has an open port the modem is the reason he got hacked 

Opening ports is how you allow remote connections. Opening a port is not, in and of itself, a problem. And if there's malware or something on the machine closing the port will do nothing to remove it.

Stop giving bad advice, stop abusing other users.