mewnlite

Since I posted, I happened to notice that BitComet was running in my task manager. It was *not* showing the the system tray as it usually does when I'm knowingly running it (which is rarely.) I then checked msconfig and discovered it had been added to my startup list. Anyway, I killed it and the problem went away. I wish I'd caught that before I posted! Thanks for the reply.

I've had the paid version of MBAM like forever. Maybe once or twice a Week I'll get a popup that an IP was blocked. I rarely run any torrents. The times that I do, I'll notice an increase in blocking activity. I haven't run any at all for several weeks. Starting yesterday for no apparent reason, MBAM started blocking IP's right and left. It'll block a whole bunch of them back to back, and then rest for a while. Here's a log from the time since I rebooted last night about 1 AM. ----------------------------------------------------------------------------------------------------------------------------- 2012/04/05 00:52:24 -0500 MOHAWK MESSAGE Starting protection 2012/04/05 00:52:31 -0500 MOHAWK MESSAGE Protection started successfully 2012/04/05 00:52:34 -0500 MOHAWK MESSAGE Starting IP protection 2012/04/05 00:53:14 -0500 MOHAWK Ben MESSAGE IP Protection started successfully 2012/04/05 00:58:27 -0500 MOHAWK Ben IP-BLOCK 67.215.246.204 (Type: outgoing) 2012/04/05 00:58:30 -0500 MOHAWK Ben IP-BLOCK 67.215.246.204 (Type: outgoing) 2012/04/05 00:58:36 -0500 MOHAWK Ben IP-BLOCK 67.215.246.204 (Type: outgoing) 2012/04/05 01:08:24 -0500 MOHAWK Ben IP-BLOCK 212.117.178.202 (Type: incoming) 2012/04/05 01:25:46 -0500 MOHAWK Ben IP-BLOCK 121.125.244.115 (Type: outgoing) 2012/04/05 01:37:01 -0500 MOHAWK Ben IP-BLOCK 222.64.5.235 (Type: incoming) 2012/04/05 01:38:55 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 01:57:35 -0500 MOHAWK Ben IP-BLOCK 213.55.114.199 (Type: outgoing) 2012/04/05 02:02:35 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 02:11:18 -0500 MOHAWK Ben IP-BLOCK 188.130.177.6 (Type: incoming) 2012/04/05 02:43:04 -0500 MOHAWK Ben IP-BLOCK 58.240.199.169 (Type: outgoing) 2012/04/05 02:53:15 -0500 MOHAWK Ben IP-BLOCK 91.188.46.113 (Type: incoming) 2012/04/05 02:56:59 -0500 MOHAWK Ben IP-BLOCK 58.240.74.235 (Type: outgoing) 2012/04/05 02:57:03 -0500 MOHAWK Ben IP-BLOCK 89.28.45.214 (Type: outgoing) 2012/04/05 02:58:18 -0500 MOHAWK Ben IP-BLOCK 188.124.31.60 (Type: outgoing) 2012/04/05 02:58:19 -0500 MOHAWK Ben IP-BLOCK 89.28.61.225 (Type: outgoing) 2012/04/05 03:07:15 -0500 MOHAWK Ben IP-BLOCK 195.161.7.7 (Type: incoming) 2012/04/05 03:20:43 -0500 MOHAWK Ben IP-BLOCK 222.65.244.44 (Type: incoming) 2012/04/05 03:26:56 -0500 MOHAWK Ben IP-BLOCK 79.135.150.78 (Type: outgoing) 2012/04/05 03:35:08 -0500 MOHAWK Ben IP-BLOCK 89.28.121.186 (Type: incoming) 2012/04/05 03:57:38 -0500 MOHAWK Ben IP-BLOCK 218.8.10.31 (Type: outgoing) 2012/04/05 03:57:38 -0500 MOHAWK Ben IP-BLOCK 58.241.214.65 (Type: outgoing) 2012/04/05 03:58:53 -0500 MOHAWK Ben IP-BLOCK 222.71.134.249 (Type: incoming) 2012/04/05 04:11:10 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 04:12:15 -0500 MOHAWK Ben IP-BLOCK 195.161.7.29 (Type: outgoing) 2012/04/05 04:16:34 -0500 MOHAWK Ben IP-BLOCK 188.130.177.2 (Type: incoming) 2012/04/05 04:19:00 -0500 MOHAWK Ben IP-BLOCK 188.243.231.43 (Type: incoming) 2012/04/05 04:34:03 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 04:35:24 -0500 MOHAWK Ben IP-BLOCK 58.240.230.98 (Type: incoming) 2012/04/05 04:43:32 -0500 MOHAWK Ben IP-BLOCK 89.28.54.135 (Type: incoming) 2012/04/05 04:43:34 -0500 MOHAWK Ben IP-BLOCK 93.174.89.185 (Type: outgoing) 2012/04/05 04:51:18 -0500 MOHAWK Ben IP-BLOCK 213.55.114.199 (Type: incoming) 2012/04/05 04:52:03 -0500 MOHAWK Ben IP-BLOCK 98.142.251.24 (Type: incoming) 2012/04/05 04:55:59 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 04:57:49 -0500 MOHAWK Ben IP-BLOCK 89.28.101.38 (Type: incoming) 2012/04/05 05:05:58 -0500 MOHAWK Ben IP-BLOCK 58.240.39.205 (Type: incoming) 2012/04/05 05:12:49 -0500 MOHAWK Ben IP-BLOCK 58.240.189.22 (Type: outgoing) 2012/04/05 05:19:20 -0500 MOHAWK Ben IP-BLOCK 58.240.74.236 (Type: incoming) 2012/04/05 05:22:07 -0500 MOHAWK Ben IP-BLOCK 58.240.39.111 (Type: incoming) 2012/04/05 05:24:12 -0500 MOHAWK Ben IP-BLOCK 222.186.94.121 (Type: incoming) 2012/04/05 05:28:54 -0500 MOHAWK Ben IP-BLOCK 218.8.26.235 (Type: incoming) 2012/04/05 05:30:38 -0500 MOHAWK Ben IP-BLOCK 77.78.213.199 (Type: outgoing) 2012/04/05 05:34:25 -0500 MOHAWK Ben IP-BLOCK 194.165.0.6 (Type: incoming) 2012/04/05 05:39:36 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 05:39:53 -0500 MOHAWK Ben IP-BLOCK 87.248.190.121 (Type: incoming) 2012/04/05 05:48:03 -0500 MOHAWK Ben IP-BLOCK 89.28.104.30 (Type: incoming) 2012/04/05 06:11:18 -0500 MOHAWK Ben IP-BLOCK 89.28.103.11 (Type: incoming) 2012/04/05 06:29:17 -0500 MOHAWK Ben IP-BLOCK 213.55.114.199 (Type: outgoing) 2012/04/05 06:37:50 -0500 MOHAWK Ben IP-BLOCK 222.65.95.69 (Type: incoming) 2012/04/05 06:38:18 -0500 MOHAWK Ben IP-BLOCK 213.182.204.136 (Type: incoming) 2012/04/05 06:44:19 -0500 MOHAWK Ben IP-BLOCK 89.28.121.31 (Type: outgoing) 2012/04/05 06:48:59 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 06:52:16 -0500 MOHAWK Ben IP-BLOCK 212.113.47.219 (Type: incoming) 2012/04/05 06:55:13 -0500 MOHAWK Ben IP-BLOCK 222.71.201.145 (Type: incoming) 2012/04/05 06:59:05 -0500 MOHAWK Ben IP-BLOCK 222.65.164.207 (Type: outgoing) 2012/04/05 07:10:09 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 07:15:19 -0500 MOHAWK Ben IP-BLOCK 222.71.201.145 (Type: incoming) 2012/04/05 07:15:35 -0500 MOHAWK Ben IP-BLOCK 58.241.131.202 (Type: outgoing) 2012/04/05 07:17:46 -0500 MOHAWK Ben IP-BLOCK 121.10.234.120 (Type: incoming) 2012/04/05 07:27:59 -0500 MOHAWK Ben IP-BLOCK 89.28.28.121 (Type: outgoing) 2012/04/05 07:30:39 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 07:44:08 -0500 MOHAWK Ben IP-BLOCK 222.71.32.94 (Type: incoming) 2012/04/05 07:46:56 -0500 MOHAWK Ben IP-BLOCK 219.153.97.168 (Type: incoming) 2012/04/05 07:51:48 -0500 MOHAWK Ben IP-BLOCK 58.241.123.4 (Type: incoming) 2012/04/05 07:55:28 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 08:12:44 -0500 MOHAWK Ben IP-BLOCK 222.71.67.121 (Type: incoming) 2012/04/05 08:45:00 -0500 MOHAWK Ben IP-BLOCK 218.8.166.111 (Type: outgoing) 2012/04/05 08:45:54 -0500 MOHAWK Ben IP-BLOCK 89.28.22.187 (Type: incoming) 2012/04/05 08:46:04 -0500 MOHAWK Ben IP-BLOCK 83.128.87.173 (Type: outgoing) 2012/04/05 08:48:49 -0500 MOHAWK Ben IP-BLOCK 83.128.125.18 (Type: incoming) 2012/04/05 08:53:20 -0500 MOHAWK Ben IP-BLOCK 89.28.54.138 (Type: incoming) 2012/04/05 09:06:12 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 09:10:04 -0500 MOHAWK Ben IP-BLOCK 195.78.123.17 (Type: incoming) 2012/04/05 09:19:58 -0500 MOHAWK Ben IP-BLOCK 58.240.255.85 (Type: incoming) 2012/04/05 09:22:38 -0500 MOHAWK Ben IP-BLOCK 124.125.251.41 (Type: incoming) 2012/04/05 09:30:34 -0500 MOHAWK Ben IP-BLOCK 87.248.172.221 (Type: incoming) 2012/04/05 09:48:03 -0500 MOHAWK Ben IP-BLOCK 89.28.33.204 (Type: incoming) 2012/04/05 09:48:28 -0500 MOHAWK Ben IP-BLOCK 222.65.158.109 (Type: incoming) 2012/04/05 09:52:26 -0500 MOHAWK Ben IP-BLOCK 58.241.123.4 (Type: incoming) ----------------------------------------------------------------------------------------------------------------------- So why the sudden increase? I run XP Pro SP3 with free Avira and Malwarebyte's real time protection. I haven't done a full scan with either for a while, but when I do I never come up with anything. I am not having any symptoms of anything being awry. Thanks for any insight.

I clean up other people's computers. I am a firm believer in realtime MalwareBytes. I have a customer right now who is all for it but he doesn't want to use his credit card. What's the best way for me to get it on his machine, using my own credit card and just billing him for it? I just want to make sure it's registered to him and not me. If it isn't all that difficult, I'll probably do the same for other customers. Actually, I've had my copy so long I forget what the procedure was! Thanks!

I previously looking in my own user folder instead of All Users. I've attached the one that shows the appropriate information. Also the quarantine folder under All Users had a file named BACKUP1.05388 which contained... 0=HackTool.Asterisk 1=6/8/2011 2=File 3=H:\utilities\AsterikPasswordReader.exe 4=05388 Thanks for helping me locate these files. protection-log-2011-06-08.txt

That was my problem. I couldn't find the logs, but I never looked under the quarantine tab you mentioned. It was listed there and it pointed to a file I had in a utility folder which was an asterisk password reader. I'm not sure what triggered it. I haven't used it for years and forgot I even had it. I can understand why it would tag that file if I indeed tried to execute it and who knows, maybe I accidentally double clicked it or something (highly unlikely). So now it's just a matter of curiousity. If it showed up under the quarantine tab, then where would the "log" be that you wanted me to attach? Evidentally the "Quarantine" folder I described was not the right place. This is no longer a top priority matter of course. I was just afraid that I had inherited a piece of malware and wanted to get to the bottom of it. Now that I know what triggered it I'm not concerned about it anymore. It's also a good indication that MBam is doing its job!

I running version 1.51.0.1200. Yesterday while I working on a project MBam popped up a message that something was trying to run or install or something. I can't really think of anything I had clicked on that might have prompted it but nevertheless I chose "quarantine". I was busy at the time but later I decided to go look at my logs. If I'm not mistaken in XP that should be at C:\Documents and Settings\User\Application Data\Malwarebytes\Malwarebytes' Anti-Malware under the Quarantine folder. That folder exists but it is empty. The Logs folder has three logfiles from way back when I ran some scans. I would like to know what triggered the alert. If I chose "Quarantine" and the window went away, then it should have stored it *somewhere". Where else might quarantine information be stored?

That was simple enough. Thanks!

OK, both files are attached. Thanks. mbamlogs.zip

If I don't manually check for updates, then about every week or so I'll get a popup that tells me my definitions are 7 days old and will prompt me to update. In my scheduler (under the protection tab), and under the update tab, it is set for "hourly". Why is it not updating? I'm running 1.50.1.1100 (paid).

I was not aware of the necessity for a license. I always download and install the latest version on each computer I clean up. And leave it installed on that computer. Something they could have done theirselves. I'm just a 73 year old retired fart that cleans people's computers up as a hobby. I am not a licensed technician. Does this mean I should quit helping people out? Or just quit using Malwarebytes to do it? I just downloaded and installed the latest version of CCleaner on the computer in question. The %#*&@#$ installation installed ^$*#@! Google Chrome. If I had any option to uncheck anywhere I missed it.

Although I have the paid version of MBam, I use the free version for cleaning up other people's computers. The first things I do before I run MBam is run Internet Explorer and remove temporary internet files, clear the Local Settings\temp folder and also the Windows\temp folder. In all too many cases, MBam will spend 15 minutes or more scanning the IE5 folder which tells me that deleting the Temporary internet files did NOT work although it may have taken a long time in supposedly doing so. CCleaner doesn't get them all either. When there's more than one user I can go into another user's account and the the subfolders of IE5 will show on the original account and I can delete all those subfolders. Even then there seems to be more showing when observing the MBam scan. On machines where the users use an alternate browser, MBam will usually do a QuickScan in 4-7 minutes. How do you REALLY get rid of IE's temporary internet files? Most of these computers all all Windows XP. I haven't really noticed if the same problem exists in Vista and Windows 7 but it probably does.

This evening Malwarebytes started blocking IP 78 . 26 . 179 . 244 repeatedly. I didn't have any browsers open and was in fact editing some pictures when it started doing it. I started closing things one at a time and when I closed Skype it quit. So after a bit I started Skype back up again and the IP blocking started up again. That IP resolves to host244-179-dynamic.26-79-r.retail.telecomitalia.it A quick scan (with mbam) turned up nothing. I'm just curious as to why Skype would be trying to access suck a site in the first place. I only use Skype once in a blue moon and then just for phone calls. But I would rather just shut it down than to have to see that damn popup over and over all the time. And I don't want to turn IP blocking off since I assume it's a "good thing." Other than checking for updates, I can't see why Skype would be trying to access *anything*. Anyone else had that problem with Skype?