MalwareBytes PRO

[Giggsteve]

Hi guys --

Just curious as to how I can get more information on the outgoing connection blocking that MalwareBytes PRO is doing. It's nearly ALWAYS the same address, and I'd like to look into this more. Thanks for the suggestions!

[exile360]

Greetings

Please take a look at Section G of our FAQ, in particular the section Use TCPView to Determine what Process is Connecting to a Malicious IP Address. That will enable you to discover the process that is connecting to the IP (assuming you're running Windows XP because on Vista and 7, Malwarebytes does show the process connecting to an IP address).

[Giggsteve]

Thank you, Exile! I've gotten that far as I do have Windows 7; it's usually coming from Skype or Firefox. I'm just baffled as to what could continually be outgoing from either of those two that's so malicious.

[exile360]

With Skype, it's because of the fact that Skype uses peer-to-peer technology, meaning it connects to the computers of many servers/users in order to function, some of which might be on IP's that are also known to host malicious content. For Firefox, if a website you're trying to visit is blocked, then the same reasoning applies, either the site you're visiting is known to host malicious content, or the IP address the site is on is shared with many other domains that host malicious content. This can also occur if an advertisement on a webpage is blocked because it is hosted on an IP address that is blacklisted by Malwarebytes.

If you see the same IP blocks every time you open your browser and visit any website using Firefox, then that can be a sign of infection, such as a browser hijacker. If that is the case, then you should follow the instructions in this post and create a new topic in that section of the forum to have an expert take a look at your system and remove any infections that might be present.