Worrying BLOCK reports - mostly Outgoing

[ausgumbie]

Today, I suddenly seem to be getting logts of the following reports:

2013/02/23 18:00:18 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: incoming, Port: 49167, Process: firefox.exe)

2013/02/23 18:04:03 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 58682, Process: outlook.exe)

2013/02/23 18:07:57 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 49168, Process: firefox.exe)

2013/02/23 18:10:21 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 49899, Process: firefox.exe)

2013/02/23 19:02:38 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 49918, Process: firefox.exe)

---------------------------------------------------------------------------------------------------------------------------

(*NOTE: INTERNET SESSION DISCONNECTED 7:10 PM. (ISP WINDOW, “SESSION LOG”))

---------------------------------------------------------------------------------------------------------------------------

2013/02/23 19:49:29 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 49214, Process: bootstrap.exe)

2013/02/23 19:49:29 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 49215, Process: bootstrap.exe)

2013/02/23 19:49:29 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 49216, Process: bootstrap.exe)

2013/02/23 19:49:29 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 49217, Process: bootstrap.exe)

2013/02/23 19:49:29 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 49218, Process: bootstrap.exe)

2013/02/23 19:49:29 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 49219, Process: bootstrap.exe)

2013/02/23 21:03:59 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 55566, Process: iexplore.exe)

2013/02/23 21:04:39 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 53272, Process: iexplore.exe)

2013/02/23 21:13:15 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 64536, Process: iexplore.exe)

2013/02/23 21:17:32 +1000 (COMPUTER NAME)-PC (COMPUTER NAME) IP-BLOCK 127.0.0.1 (Type: outgoing, Port: 51202, Process: winword.exe)

While one of the BLOCKs was an Incoming, the rest are Outgoing. Also, the computer is "127.0.0.1", either my computer OR every computer.

I've just had another block reported when I opened a new link.

Is my computer trying to contact a malicious computer and if so, why?

Could I have a rootkit? What could it be MWB is blocking? Additionally, the Internet seems unusually slow. I had to exit IE (without logging out of the forum!) typing this and trying to preview it. I got another block notice when I opened Firefox.

Worried,

ausgumbie

[daledoc1]

Hi, ausgumbie:

This was a false positive for the IP block on 127.0.0.1.

See here: http://forums.malwar...howtopic=123025

and here: http://forums.malwar...howtopic=123024

and here: http://forums.malwar...howtopic=123022

and here: http://forums.malwar...howtopic=123023

It was fixed already, with the current database v.2013.02.23.04.

>>> Please temporarily disable IP blocking, update the database & then re-enable IP blocking. That should resolve the issue for you.

fixed in database 2013.02.23.04 Please disable ip blocking temporarily and update the database. You can reenable after you get this update or later. http://forums.malwar...ndpost&p=650139

>>> If you are still experiencing IP blocks after updating the database, then please refer to this KB topic for advice on how to proceed: What does it mean when I get an IP alert about blocking a 'malicious' site?

HTH,

daledoc1

[ausgumbie]

This was a false positive for the IP block on 127.0.0.1.

daledoc1

Hi daledoc1

Seems to have fixed it. Many thanks! (Reading the posts, I gather I certainly wasn't alone.)

Cheers

ausgubie

[daledoc1]

Great, thanks for letting us know.

Cheers, daledoc1