Jump to content
BlueChronicle

Malwarebytes blocking an IP from time to time

Recommended Posts

Hello,

Recently, Malwarebytes is blocking an IP (due to Trojan) which seems to be trying to connect (or perhaps trying to attack?) my system from time to time. I have scanned my computer from normal Scan to complete full scan, also scanned using AdwCleaner, and a full scan using Windows Defender - which all results came up clean. and there are no signs of my computer being infected...
I do not have any Peer-To-Peer program (such as uTorrent and etc...) and I haven't been in some internet places to catch a malware (as far as I know), and the computer I'm using isent even a month old.

All I want to know, is this something I should be concerned about? or is it safe to ignore it...?

Cheers.

10-30-18.txt

11-5-18.txt

11-6-18.txt

Share this post


Link to post
Share on other sites

Hello BlueChronicle and welcome to Malwarebytes,

The logs from FRST do not show the presence of any Malware or Infection. The three block logs you attach are all inbound, all have the same IP address.

The following URL gives basic information for the IP https://whois.domaintools.com/196.52.43.99

The following URL indicates the IP is not to be trusted: https://www.abuseipdb.com/check/196.52.43.99?page=4

Malwarebyts is just doing its job, I`d also recommend that all passwords currently used on your PC are changed. Also reset your router and set a fresh strong password..

https://www.techadvisor.co.uk/how-to/internet/create-strong-password-3357177/

Next,

Run the following scan to double check FRST results:

Download Sophos Free Virus Removal Tool and save it to your desktop.

If your security alerts to this scan either accept the alert or turn off your security to allow Sophos to run and complete.....

Please Do Not use your PC whilst the scan is in progress.... This scan is very thorough so may take several hours...
 
  • Double click the icon and select Run
  • Click Next
  • Select I accept the terms in this license agreement, then click Next twice
  • Click Install
  • Click Finish to launch the program
  • Once the virus database has been updated click Start Scanning
  • If any threats are found click Details, then View log file... (bottom left hand corner)
  • Copy and paste the results in your reply
  • Close the Notepad document, close the Threat Details screen, then click Start cleanup
  • Click Exit to close the program
  • If no threats were found please confirm that result....



The Virus Removal Tool scans the following areas of your computer:
  • Memory, including system memory on 32-bit (x86) versions of Windows
  • The Windows registry
  • All local hard drives, fixed and removable
  • Mapped network drives are not scanned.



Note: If threats are found in the computer memory, the scan stops. This is because further scanning could enable the threat to spread. You will be asked to click Start Cleanup to remove the threats before continuing the scan.

Saved logs are found here: C:\ProgramData\Sophos\Sophos Virus Removal Tool\Logs

Thank you,

Kevin...

 

Edited by kevinf80
typing error

Share this post


Link to post
Share on other sites

Thanks for the update BlueChronicle,

Continue to clean up:

Uninstall Sophos AV http://www.askvg.com/how-to-completely-uninstall-remove-a-software-program-in-windows-without-using-3rd-party-software/

Also delete this folder if still present: C:\ProgramData\Sophos

Next,

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

If your security program alerts to Delfix either, accept the alert or turn your security off.

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

 
  • Remove disinfection tools <----- this will remove tools we may have used.
  • Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created.
  • Reset system settings <--- this will reset any system settings back to default that were changed either by us during cleansing or malware/infection


Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any remnant files/logs from tools we have used can be deleted…

Next,

Run Windows Disk Clean Up Utility - https://neosmart.net/wiki/disk-cleanup/

Read the following links to fully understand PC Security and Best Practices, you may find them useful....

Answers to Common Security Questions and best Practices

Do I need a Registry Cleaner?

Take care and surf safe

Kevin... user posted image

 

Share this post


Link to post
Share on other sites

It has been 2 days I believe, everything is running OK! no suspicious connections.
Thank you, kevinf80. you've been a major help.


This issue has been resolved.

Cheers

Share this post


Link to post
Share on other sites

Thanks for the update BlueChronicle, good to hear your system is back to normal for you...

Regards,

Kevin...

Share this post


Link to post
Share on other sites

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Share this post


Link to post
Share on other sites

Hello again,

Everything seem'd to be calm in the past week - until the same IPs poping up again, and as usual Malwarebytes doing a good job blocking these IPs. its starting to get annoying now.


I see this one particular IP which isn't the first time trying to connect to my system, so I've done a small research about this IP, and it seems that Malwarebytes Labs has this IP on their database. (Pictures below)
First it tried to connect via svchost.exe, second via Nvidia programs, and third which is unknown (assuming it tried to connect via svchost again)...and with different ports.

I updated my router framework, changed the router passwords, and checked and tweaked all the security settings. I also scan my PC regularly via Scan Schedule, and even full scanned the whole C:/ drive. no threats detected.

 

1.png

2.png

3.png

11-19-18.txt

11-23-18.txt

Share this post


Link to post
Share on other sites

Hello BlueChronicle,

Those website blocks you quote are "inbound" Malwarebytes is just doing its job....

Quote

-Website Data-
Category: Malware
Domain:
IP Address: 89.248.169.24
Port: [445]
Type: Inbound
File:

If you have a look at my reports you will see similar website inbound blocks, that is very much normal.... If the constant tray notification bugs you, mine bugs me so I turn the alert off...

https://support.malwarebytes.com/docs/DOC-1207

If you still believe your system is exploited in anyway run a scan with ESET online AV scanner, see what the log has to say...

Go here and click 'SCAN NOW' under 'ESET Online Scanner' save to your Desktop.
 
  • You will be prompted to download and install esetonlinescanner_enu.exe. Click on the link and save the file to a convenient location.
  • Double-click on esetonlinescanner_enu.exe to install and a new window will open. Follow the prompts.
  • Turn off the real-time scanner of any existing antivirus program before performing the online scan. Here's how
  • At the bottom of the Terms of use window, tick the option Download latest version of ESET Online Scanner then click Accept
  • When/if prompted by UAC, 'Do you want to allow this app to make changes to your PC?', please choose Yes
  • Tick the option Enable detection of potentially unwanted applications
  • Click on Advanced settings
  • Make sure that the option Clean threats automatically is unticked.
  • Ensure these options are ticked:
 
  • Enable detection of potentially unsafe applications
  • Enable detection of suspicious applications
  • Scan archives
  • Enable Anti-Stealth technology
 
  • Click Scan
  • Wait for the scan to finish.
  • When the scan is done, if it shows a screen that says Threats found, click Save to text file... then name it and save it to your desktop.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Please copy/paste the contents of the log in your next reply.
  • To close ESET Online Scanner, select Do not clean then Finish

Cheers,

Kevin....

 

WSBlock.JPG

Share this post


Link to post
Share on other sites
1 hour ago, kevinf80 said:

You`re very welcome BlueChronicle, are we ok to close out your thread...?

Regards,

Kevin...

Yes, you may close the thread. thanks again.

Share this post


Link to post
Share on other sites

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.