lailah_uk86 Posted August 21, 2012 ID:588145 Share Posted August 21, 2012 IP-BLOCK 204.160.98.253 (Type: outgoing, Port: 49219, Process: svchost.exe)Turned my PC on for the first time in a week and got this while running updates. Checked with TCPview and pressed update again after a restart and went through a similar ip 204.160.x.x (can't remember if the 3rd part was the same). Link to post Share on other sites More sharing options...
MysteryFCM Posted August 21, 2012 ID:588311 Share Posted August 21, 2012 It's not an F/P I'm afraid, and not associated with Windows Updates. Please follow the advice in the following;http://forums.malwarebytes.org/index.php?showtopic=9573 Link to post Share on other sites More sharing options...
lailah_uk86 Posted August 21, 2012 Author ID:588361 Share Posted August 21, 2012 I've not been having any problems though and im sure this computer is clean.The IP is Level 3 which Microsoft use for windows updates sometimes.www.dslreports.com/forum/r10386699-Windows-Update-connects-to-Level3 Link to post Share on other sites More sharing options...
MysteryFCM Posted August 21, 2012 ID:588366 Share Posted August 21, 2012 Level3 is indeed used occasionally by Windows Updates, but not this IP. Link to post Share on other sites More sharing options...
lailahuk86 Posted August 21, 2012 ID:588378 Share Posted August 21, 2012 Is it possibility they added a range including this ip recently? As i really have no other signs of infection. I will make a post anyway though. Link to post Share on other sites More sharing options...
MysteryFCM Posted August 21, 2012 ID:588380 Share Posted August 21, 2012 It's certainly possible, yes, but it would've had to have been within the last week. Link to post Share on other sites More sharing options...
lailah_uk86 Posted August 22, 2012 Author ID:588611 Share Posted August 22, 2012 There was also another user who had this IP block during windows update.http://forums.malwarebytes.org/index.php?showtopic=114269http://forums.malwarebytes.org/index.php?showtopic=114277 Link to post Share on other sites More sharing options...
MysteryFCM Posted August 22, 2012 ID:588834 Share Posted August 22, 2012 I'm still not seeing any connection to 204.160.98.253 for Windows Update. I've sent an email to friends at Microsoft to see if they're now using it. Link to post Share on other sites More sharing options...
MysteryFCM Posted August 24, 2012 ID:589419 Share Posted August 24, 2012 I've heard back from friends at Microsoft and it's definitely not being used by them. Link to post Share on other sites More sharing options...
lailah_uk86 Posted August 24, 2012 Author ID:589447 Share Posted August 24, 2012 Ok, I was also updating Firefox addons at pretty much the same time it appeared (noscript updated) but i didn't think that would be svchost.exe.http://forums.malwarebytes.org/index.php?showtopic=114615 I posted here but he hasn't seen anything Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now