Jump to content

174.137.132.45 - why can't I get rid of this address block?

drssyoon
 Share

Recommended Posts

drssyoon

drssyoon

Posted
Posted

I've been getting a "successfully blocked 174.137.132.45" message from Malwarebyes. I googled and can't seem to find a way to get rid of it unless I can get some customized help (as seen on a Malwarebytes forum).

 

Can someone help me get rid of this?

 

Much thanks.

 

Steve

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Hello and post-32477-1261866970.gif

 

P2P/Piracy Warning:

 

   

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Hello Steve,

 

It depends what is making the call, also whether the call is inbound or outbound. Run the following:

 

Run Malwarebytes,  Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick scan

Make sure that everything is checked, and click Remove Selected on any found items.

 

Post the produced log

 

Next,

 

Download AdwCleaner by Xplode from here: http://www.bleepingcomputer.com/download/adwcleaner/ and save to your Desktop.

 


Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Uncheck any elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review.
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted (if necessary):
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

 

Next,

 

Download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.


Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

Kevin

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Do not see any obvious malware or infection in those logs, I did note that TDSSKiller and Zoek were used, did those tools locate/remove any malicious entries?

 

Can you run the system in a Clean Boot state and see if the problem continues:

 

http://support.microsoft.com/kb/929135

 

Expand the version relevant to your system and follow those instructions..

 

Kevin...

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

It could very well be legitimate software calling home and MB blocking. Can you post any logs that show the blocks happening:

 

Open Malwarebytes > select > Logs tab > recent logs are at the bottom of the list, have a look through the list, either double click to open a log, or single click and select "Open" tab...

Link to post
Share on other sites
drssyoon

drssyoon

Posted
  • Author
Posted

Do you mean like this?

 

2014/03/21 14:37:33 -0400 THINKPAD Yoon IP-BLOCK 174.137.132.45 (Type: outgoing, Port: 137)
2014/03/21 14:37:33 -0400 THINKPAD Yoon IP-BLOCK 174.137.132.45 (Type: outgoing, Port: 137)
2014/03/21 14:37:33 -0400 THINKPAD Yoon IP-BLOCK 174.137.132.45 (Type: outgoing, Port: 137)
2014/03/21 14:37:33 -0400 THINKPAD Yoon IP-BLOCK 174.137.132.45 (Type: outgoing, Port: 50954)
2014/03/21 14:37:33 -0400 THINKPAD Yoon IP-BLOCK 174.137.132.45 (Type: outgoing, Port: 8)
2014/03/21 14:37:33 -0400 THINKPAD Yoon IP-BLOCK 174.137.132.45 (Type: outgoing, Port: 8)
2014/03/21 14:37:33 -0400 THINKPAD Yoon IP-BLOCK 174.137.132.45 (Type: outgoing, Port: 137)
2014/03/21 14:37:41 -0400 THINKPAD Yoon IP-BLOCK 174.137.132.45 (Type: outgoing, Port: 137)
2014/03/21 14:37:41 -0400 THINKPAD Yoon IP-BLOCK 174.137.132.45 (Type: outgoing, Port: 137)
2014/03/21 14:38:05 -0400 THINKPAD Yoon IP-BLOCK 174.137.132.45 (Type: outgoing, Port: 50961
Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Thank you for the update, note with the following tool Chrome will be reset to Defaults as well as other actions. See if the problem still occurs after Zoek completes...

 

Download Zoek.zip from here http://www.hijackthis.nl/smeenk/220813/zoek.zip and save the zip file to your Desktop.

Double click zip file and extract to your  Desktop:

 

 

Zoekd.jpg

 

 

you will now have 3 versions of the tool on the Desktop:

 

 

%7Boption%7D http://i121.photobucket.com/albums/o239/kevinf80/Zoek%20Scanner/Capture.png[/img]

 

Before running Zoek make sure all Browsers are closed and Security is turned OFF. Check at the following link: http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/]

 

Double click on each in turn until one version of Zoek will run (accept UAC) The following window will open:

 

 

Zoekb.jpg

 

 

Copy and paste the following script from the code box and paste into the field.

 

 

standardsearch;autoruns;autoclean;emptyclsid;emptyalltemp;installedprogs;CHRdefaults; 

 

 

Select the "Run Script" tab. The following window will open:

 

 

 

Zoekc.jpg

 

 

 

Please be patient and do not use the PC when the scan is in progress.

 

When complete you maybe asked to re-boot your PC, if so please do

 

Zoekf.jpg

 

Post the produced log in your next reply…..

 

Kevin...

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Run Google Chrome, click on the stack of plates (top right hand corner) from the produced list scroll to and select "settings" In the new window select "Extensions" untick all extensions to disable. Restart Chrome, all extensions will be disabled, see if the MB alert still occurs...

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Ok i`m missing something here, run the following:

 

Read the following link before we continue and run Combofix:

 

ComboFix usage, Questions, Help? - Look here

 

Next,

 

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :-

 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

 

http://www.infospyware.net/antimalware/combofix/

 

  • Ensure that Combofix is saved directly to the Desktop <--- Very important
     
  • Disable all security programs as they will have a negative effect on Combofix, instructions available here  http://www.bleepingcomputer.com/forums/topic114351.html if required. Be aware the list may not have all programs listed, if you need more help please ask.
     
  • Close any open browsers and any other programs you might have running
     
  • Double click the combofix.gif icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)
     
  • Instructions for running Combofix available here http://www.bleepingcomputer.com/combofix/how-to-use-combofix if required.
     
  • If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.
     
  • When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

 

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

 

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read here  http://thespykiller.co.uk/index.php?page=20 why  disabling autoruns is recommended.

 

*EXTRA NOTES*


    If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
    If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
    If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

 

Post the log in next reply please...

 

Kevin

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the Codebox below into it:

FCopy::c:\windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll | c:\windows\System32\user32.dllClearJavaCache::

Save this as CFScript.txt, and as Type: All Files (*.*) in the same location as ComboFix.exe

CF3.jpg

CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

 

Next,

 

We need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

 

Run Eset Online Scanner

 

**Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin

 

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

 


Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings, ensure the options
Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

 

When the scan is complete

 


If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

 

If threats were found

 


click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

 

close program

 

Copy and paste the report in next reply.

 

Kevin...

Link to post
Share on other sites
kevinf80

kevinf80

Posted
Posted

Run the following and post the log..

 

Run the MGA Diagnostic Tool and post back the report it creates:


Download MGADiag from here: http://go.microsoft.com/fwlink/?linkid=52012 and save it to your desktop.
Double-click on MGADiag.exe to launch the program
Click "Continue"
Ensure that the "Windows" tab is selected (it should be by default).
Click the "Copy" button to copy the MGA Diagnostic Report to the Windows clipboard.
Paste the MGA Diagnostic Report back here in your next reply.

Link to post
Share on other sites
drssyoon

drssyoon

Posted
  • Author
Posted

Here it is.

 

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->
 
Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-PJW6W-9GK29-TMPWP
Windows Product Key Hash: s96ZjOX/L18svs5JSfzs8eCl/m0=
Windows Product ID: 00426-OEM-8992662-00537
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {2A2D74D6-27E0-41F7-B557-2D450D789BE5}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.130828-1532
TTS Error: 
Validation Diagnostic: 
Resolution Status: N/A
 
Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
 
Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002
 
OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002
 
OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: B4D0AA8B-604-645_025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3
 
Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed
 
File Scan Data-->
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385], Hr = 0x800b0100
 
Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{2A2D74D6-27E0-41F7-B557-2D450D789BE5}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-TMPWP</PKey><PID>00426-OEM-8992662-00537</PID><PIDType>2</PIDType><SID>S-1-5-21-1110885479-453038412-3084036872</SID><SYSTEM><Manufacturer>LENOVO</Manufacturer><Model>745496U</Model></SYSTEM><BIOS><Manufacturer>LENOVO</Manufacturer><Version>7XET72WW (3.22 )</Version><SMBIOSVersion major="2" minor="4"/><Date>20121122000000.000000+000</Date></BIOS><HWID>F6070D00018400F8</HWID><UserLCID>0409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>Eastern Standard Time(GMT-05:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>LENOVO</OEMID><OEMTableID>TP-7X   </OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>  
 
Spsys.log Content: 0x80070002
 
Licensing Data-->
Input Error: Can not find script file "C:\Windows\system32\slmgr.vbs".
 
Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: N/A
HealthStatus: 0x0000000000000000
Event Time Stamp: N/A
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Not Registered - 0x80070005
HealthStatus Bitmask Output:
 
 
HWID Data-->
HWID Hash Current: MAAAAAAAAQABAAIAAAABAAAABAABAAEAeqjGaeQs7PBkP8D20DpA9nJ0Ru2mwUbK
 
OEM Activation 1.0 Data-->
N/A
 
OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information: 
  ACPI Table Name OEMID Value OEMTableID Value
  APIC LENOVO TP-7X   
  FACP LENOVO TP-7X   
  HPET LENOVO TP-7X   
  BOOT LENOVO TP-7X   
  MCFG LENOVO TP-7X   
  SSDT LENOVO TP-7X   
  ECDT LENOVO TP-7X   
  SLIC LENOVO TP-7X   
  ASF! LENOVO TP-7X   
  SSDT LENOVO TP-7X   
  TCPA
  SSDT LENOVO TP-7X   
  SSDT LENOVO TP-7X   
  SSDT LENOVO TP-7X   
Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.