Blocked Outgoing IP address 46.229.165.2

[coastalwanderer]

This may be the wrong location to note this, but, MalwareBytes forum on Malware Removal seems like a good place.

I have MalwareBytes Pro and started recieving a message that it was blocking Outgoing IP Address 46.229.165.2 yesterday afternoon. Thank you MalwareBytes, I do appreciate your detection and warning.

However, I seemed to be detect who/what was causing the problem. The problem appeared in Firefox and after moving through any 3 pages, including google, yahoo, or on any site (including this forum), the message was going out to 49.229.165.2.

Nothing was detected by MalwareBytes, AVG, Microsoft Essentials, Dr Web, TDKKiller, or 3 other tools I used. I am posting this because I did find a solution.

I turned off add-ons in firefox and the problem went away. I turned my add-ons back in groups to isolate the culprit. I located the add-on causing the problem.

It appears that sometime yesterday some software installed an add-on (perhaps I authorized it unwittingly or it installed itself as I browsed). The software was called ToolbarBrowser 1.3.2 by Trellian.

Browsing the web, I found sites saying this was a "quality tool," a non-spamming provider of tools and the random sites offered great praise of this "tool." I found one site indicating this add-on was created by Trellian and does collect your browsing habits.

Please be aware, I do not know if I had a virus attach itself to my addon or if the addon is designed to collect information. I do know that disabling it removed my problem. I have removed "ToolbarBrowser" 1.3.2 by Trellian from my add-ons.

If you are having a problem with blocked outgoing IP Address 46.229.165.2 on Firefox, I would suggest you examine your add-ons and test disabling ToolbarBrowser.

[MrCharlie]

Thanks for letting us know....MrC

[seosoldier]

Thanks for reporting what you found. My MB Pro also has been notifying me of blocking that outbound address so I came here after doing a search on that ip.

However I do not have that add on. So it seems that whatever this trojan or ? is, it is attaching itself to add ons, not just a particular add on. I'm no expert but that's the conclusion I have come to.

So I have to turn off each individual add on until I find the one it is attached to? Ugh. Hopefully malware bytes will report a better way to find and get rid of this trojan or whatever it is!

[seosoldier]

I don't see an option to edit my post above so here's an Update on this problem:

I went through all my AddOns with Firefox and after checking almost all of them, I finally found that it was SEO Doctor (a search engine optimization add on that marketers use) which the offending ip was attached to.

I disabled it and the problem disappeared.

I thought if I uninstalled the add on and then reinstalled it, that might allow me to use the add on which I do very much want to use and have used for a long time.

However uninstalling and re-installing did not get rid of the problem so i did have to uninstall the add on.

Can anyone tell me how to get rid of this "rider", trojan or whatever it is so I can get my Add On back without it? What steps do I need to take?

[MrCharlie]

@seosoldier, it's best if you start a new topic on the forum.

Start at the link below and someone will help you:

http://forums.malwarebytes.org/index.php?showtopic=9573

MrC

[LDTate]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!