Question about Malwarebytes blocking IPs from hackers.

[TomDuffus]

Whenever a hacker IP or malicious IP attempts to get into my machine (usually through svchost.exe) Malwarebytes blocks their attempt. This, obviously, is awesome. But please help me understand, before I installed Malwarebytes were these attacks still going on? Was my PC's firewall blocking them without notifying them, and all thats changed is Malwarebytes is also blocking them but its telling me so? I just want to know if its normal to have these attack notifications daily, as I've flushed my PC of any malware (I've taken it to these forums, and we're pretty sure after lots of scans, that i'm malware free). Is malwarebytes the only thing stopping these things getting to my pc, or has there always been something blocking these things? Thankyou for the help!

[fivealive]

i think you might still be infected because as far as i know nothing should be trying to use svchost,exe so please :

-----------------------------------------------------------------

Sorry to hear you might be infected.

We cannot work on malware removal in this sub-section of the forum, so please read below for assistance with cleaning your system.

IMPORTANT: Please do NOT use any temporary file cleaners unless instructed to do so - they can cause data loss, making it hard to recover your system.

There are some excellent, self-help tutorials on getting MBAM to run on an infected system in the FAQ: HERE.

IF YOU PREFER EXPERT ASSISTANCE WITH MALWARE REMOVAL, PLEASE CHOOSE ONE OF THE FOLLOWING 3 OPTIONS:

OPTION 1: Free, one-on-one, expert assistance in the Malware Removal Forum.

OPTION 2: For paid users of MBAM PRO, free, one-on-one, expert assistance from MBAM support.

OPTION 3: Fee-based, one-on-one, expert assistance from Premium Support.

OPTION 1:

• Please print out, read and carefully follow the instructions in the "I'm Infected - What Do I Do Now?" article.
  
• If the infection has so crippled the computer that you cannot complete some or all of the steps, then just do the best you can and start a new topic as described below.
  

• Then please start a new post in the Malware Removal Forum.
  
• When starting your new post, please note the following:
  
• Please do NOT post in a topic started by someone else, even if their problem sounds similar.
  
• Please COPY/PASTE the requested logs into your post, rather than attaching them.
  
• Under options, please be sure to select "track this topic" and "immediate email notification", so you'll know when a helper responds.
  

• An authorized, trained malware expert will provide free, one-on-one assistance as soon as one becomes available.
  

• Please be patient - it may be 48 hours or more before a helper can assist you, especially when the forum is very busy.
  
• Please do NOT "bump" your topic or reply back to it for at least 48 hours.
  
• Doing so may cause your topic to be overlooked, as it will appear that you are already being helped.
  

OPTION 2:

If you are a paid user of MBAM PRO and would like support via the helpdesk, please contact them here.

OPTION 3:

If you prefer the Malwarebytes Premium Services (comprehensive solutions to all your computer support needs – from installation and set-up to troubleshooting and tune-ups), please go to the Premium Support site here.

Please be patient – someone will assist you as soon as possible.

Thank you very much,

fivealive

[daledoc1]

Hi, fivealive:

The OP is actually already being assisted by MrC here.

He referred the OP here for answers to this particular question about the IP blocking module: http://forums.malwar...ndpost&p=550933

:)

daledoc1

[TomDuffus]

....So wait, I just ran another scan with MrC and he declared me completely clean...

....but you said nothing should be able to get to svchost.exe??????? What does this mean!?

Any clearing up of this would be much appreciated!!!

[fivealive]

I said as far as I know. I could be wrong but that does bring me to the question are you running any p2p software? Because if so that maybe the cause

[TomDuffus]

Nope, no p2p.

[Porthos]

I would reset your windows firewall to default.

http://windows.microsoft.com/en-us/windows7/Restore-Windows-Firewall-settings

[TomDuffus]

Thanks Porthos, gonna do that now. Is that because you think the previous virus attack may have changed some of the settings? Many thanks.

[Porthos]

Uninstalling p2p programs dont close the open ports left over.

[goldhound]

Are you connected to Skype?

[TomDuffus]

Yeah I've got skype- I don't run it on startup though and I usually don't leave it running for longer than my conversations (1-2 hours or so) but I didn't think that Skype left me vulnerable to attack??

[goldhound]

Yeah I've got skype- I don't run it on startup though and I usually don't leave it running for longer than my conversations (1-2 hours or so) but I didn't think that Skype left me vulnerable to attack??

It is just that Skype uses so many IP connections. MBAM often blocks some, it does not mean a problem and Skype is not affected.

If not running on startup then not a problem. Just had to ask.

[TomDuffus]

I just got an IP alert from an IP in the netherlands, trying to get into spotify.exe. I assume that it was another false positive, or does some malware try to get into spotify? Since I turned my firewall settings to default, the chinese IPs have not been trying to contact me, which is great!