At what point does the Malicious Website "tool" kick-in?

[Martin_P]

Hi

I'm trying to clean a machine that I'm pretty sure is infected - the reason I believe it's infected is that an (unknown) application keeps attempting to connect to one of three IP addresses (each IP address is that of a broadband provider so it appears to be trying to connect to a remote machine).

The pop-up message that MalwareBytes shows just tells me the IP address, and that it's outgoing - there's no detail telling me what process/application/service is trying to connect.

A quick scan using the trial of the MB Pro version doesn't show an infection, the machine is currently undergoing a full scan but that's going to take some time as the disks are pretty large etc.

To try and pinpoint the location of the process attempting to make that remote (outgoing) connection I've used TCPWatch, Sniffer, Wireshark - none of which are showing an outgoing connection to the IP addresses shown by MB, so I assume that MB is stopping the connection attempt before any of those tools "see" the connection attempt. That's fine, but is there any way of finding out what process/service is doing this? I've checked the process list and all appears to be ok there (although I could have missed something of course).

Hopefully the full scan will reveal the issue, but just in case it doesn't - is there any way of tracking what application/process is attempting these connections (other than closing MB and letting the connection get caught by Wireshark or similar - which obviously I want to avoid as I have no idea what data it's going to attempt to transmit, or what it'll try to download onto the machine)?

Thanks in advance

Martin

[Firefox]

Hello and welcome to Malwarebytes

Sorry to hear that the computer is infected. By the sounds of it, it looks like this is on a computer with Windows XP, so the web blocker can not tell you the process due to limitations in the OS. That being said, you should seek assistance from the experts to get the computer cleaned up. Pick one of the options below.

If you think you are infected, here are the steps needed to get your computer cleaned....

Please read the following so that you can begin the cleaning process:

IMPORTANT: Don't use any temporary file cleaners unless requested - this can cause data loss and make recovery difficult

You have 3 Options that you can choose from as listed below:

• Option 1 —— Free Expert advice in the Malware Removal Forum
  
• Option 2 —— Paying customer -- Contact Support via email
  
• Option 3 —— Premium, Fee-Based Support

OPTION 1

As we don't deal with malware removal in the General Malwarebytes' Anti-Malware Forum, you need to start a topic in the

Malware Removal forum so a qualified helper can help you fix any malware related problems/infections you may have.

• Please read and follow the directions >>Right HERE<<, skipping any steps you are unable to complete.
  
• After posting your new post, make sure under options, you select Track this topic and choose Immediate Email Notification,
  so that you're alerted when someone has replied to your post.

NOTE: Please do not post back to (bump) your topic within the first 48 hours.

Replying to your own posts changes the post count and helpers are looking for topics with zero replies.

If you reply to your own post helpers may think that you're already being helped and thus overlook your post.

• If there is no reply from any experts after 48 hours, you can reply to the topic, asking for help again.
  Or
  
• You may send a Private Message to a Moderator asking for assistance.
  

OPTION 2

Alternatively, as a paying customer, you can contact the help desk by filling out the form located >>Right HERE<<

OPTION 3

If you would like to use our Malwarebytes Premium Services, Comprehensive solutions to all your computer support needs—from installation and set-up to troubleshooting and tune-ups go to our Malwarebytes Premium Services support site >>Right HERE<<

Please be patient, someone will assist you as soon as possible.

PS: Please use the "Reply to this Topic" or "More Reply Options" buttons (instead of the “Quote” and “MultiQuote” buttons) when replying here & at the other forums. That will make your topic easier to follow.

[Martin_P]

Thanks for the advice - much appreciated.

I've been doing a whackload of research on the issue that appears to have affected the pc and have managed to fix it. It appears that a rootkit had managed to sneak past my usual AV.

MWB blocked the rootkit from connecting to the remote PCs, TDSKiller managed to track it down and remove it, and a thorough scan using MWB and 2 other AVs cleaned everything up nicely (albeit a time consuming task).

Thankfully I'm pretty careful with my computers, and am fairly tech-savvy, so when MWB indicated an issue it was (double-thankfully) only a matter of time before it was resolved.

Thanks again - really appreciate the quick reply, and very happy it's sorted now (following a very restless night!)

Martin

[Firefox]

Your quite welcome, and I am glad to be of service..... Glad you got it sorted out. Should you have any further questions don't hesitate to ask.