Skype & Svchost.exe Inbound Connections

[UrgotCosplayer]

Malwarebytes Anti-Malware

www.malwarebytes.org

 

 

Protection, 23/04/2014 15:34:36, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malware Protection, Starting, 

Protection, 23/04/2014 15:34:36, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malware Protection, Started, 

Protection, 23/04/2014 15:34:36, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, Starting, 

Protection, 23/04/2014 15:34:44, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, Started, 

Update, 23/04/2014 15:41:35, SYSTEM, WIN-MEINTJNRMJ0, Scheduler, Malware Database, 2014.4.22.6, 2014.4.23.6, 

Protection, 23/04/2014 15:41:43, SYSTEM, WIN-MEINTJNRMJ0, Protection, Refresh, Starting, 

Protection, 23/04/2014 15:41:43, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, Stopping, 

Protection, 23/04/2014 15:41:43, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, Stopped, 

Protection, 23/04/2014 15:41:48, SYSTEM, WIN-MEINTJNRMJ0, Protection, Refresh, Success, 

Protection, 23/04/2014 15:41:48, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, Starting, 

Protection, 23/04/2014 15:41:49, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, Started, 

Detection, 23/04/2014 17:49:21, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, IP, 89.28.18.88, 8591, Inbound, C:\Program Files (x86)\Skype\Phone\Skype.exe, 

Detection, 23/04/2014 17:49:22, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, IP, 89.28.18.88, 8591, Inbound, C:\Program Files (x86)\Skype\Phone\Skype.exe, 

Detection, 23/04/2014 17:49:26, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, IP, 89.28.18.88, 8591, Inbound, C:\Program Files (x86)\Skype\Phone\Skype.exe, 

Detection, 23/04/2014 17:49:31, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, IP, 89.28.18.88, 8591, Inbound, C:\Program Files (x86)\Skype\Phone\Skype.exe, 

Detection, 23/04/2014 17:49:31, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, IP, 89.28.18.88, 8591, Inbound, C:\Windows\System32\svchost.exe, 

Detection, 23/04/2014 17:49:36, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, IP, 89.28.18.88, 8591, Inbound, C:\Program Files (x86)\Skype\Phone\Skype.exe, 

Detection, 23/04/2014 17:49:36, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, IP, 89.28.18.88, 8591, Inbound, C:\Windows\System32\svchost.exe, 

Detection, 23/04/2014 17:49:41, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, IP, 89.28.18.88, 8591, Inbound, C:\Program Files (x86)\Skype\Phone\Skype.exe, 

Detection, 23/04/2014 17:49:41, SYSTEM, WIN-MEINTJNRMJ0, Protection, Malicious Website Protection, IP, 89.28.18.88, 8591, Inbound, C:\Windows\System32\svchost.exe, 

 

(end)

 

I've been getting inbound connections from that IP for a few days now, but I haven't really thought anything, until this happened. I've also noticed that within the past few days, an svchost.exe process has been taking up 200 K whereas no svchost.exe process would even take over 50 K before. This hasn't been affecting my connection really but the IP resolves to starnet.md (in Moldova) which I have no relation (at all) with.

[Firefox]

Hello and

IP blocks can indicate a number of things:

• They could indicate that MBAM is doing its job of blocking bad content on websites.

• They can also occur when running Skype and certain P2P programs, such as torrents. For example, please see this help desk topic about Skype and this one about P2P.

• In some cases the blocks are a false positive.

• However, they can also be a sign of infection, especially if the blocks are outgoing and they occur when no browsers are open.

--> There is more information about the IP blocking module in the in the Help Desk topics HERE and HERE and HERE, and in the FAQ - Section G.

They also contain instructions on how to determine what process might be trying to make the connections.

You may also research the IP in question at www.ip-lookup.net or a similar site.

On the other hand, if you think the IP blocks might be a false positive, then please read this pinned topic before starting a new topic in the Website False Positives sub-forum.

Alternatively, if you think you might be infected (and probably your best choice right now due to the blocks from Svchost.exe), based on the IP blocks and/or other suspicious computer behavior, then please read the following for the available options to have a malware expert assist you with the cleaning process Available Assistance For Possibly Infected Computers.

Thanks!