MalwareBytes has blocked....

[lmod]

Hi, I am running Windows 7 Ultimate RTM as my OS, ESET Smart Security as AV, Anti-spyware & Firewall and MalwareBytes Anti-Malware. In the last week or so I have been getting frequent pop-ups from MalwareBytes that it has blocked access to IP 89.28.44.137, also 89.28.21.50. These IPs resolve to starnet.md I have never visited that site. MalwareBytes reports (today) that my machine is clean - ViprePCRescue, which I ran last night, found a suspicious entry in Recycle Bin, which it cleaned. I'm starting to wonder if this message should read that MalwareBytes has blocked access FROM (rather than TO) those IPs.

Any help and/or comments appreciated.

lmod

[GT500]

Neither of those are showing up as malicious in th hpHosts database, but Steven may have had other reasons for blocking them. I'll direct him to this topic, and see if he has any comments.

http://hosts-file.net/default.asp?s=89.28.44.137

http://hosts-file.net/default.asp?s=89.28.21.50

[MysteryFCM]

Unfortunately, both IP's reside on a Starnet range, a Moldova based company well known for housing malicious domains.

[lmod]

Thanks for the replies - yes , I gathered from Google that Starnet.md hosts what I think are undesirables. But I would like to know why I am seeing these pop-ups now - is it something on my system that is calling out? I have blocked that IP in my firewall, but I'm still getting these pop-ups from MalwareBytes. While I'm glad that MalwareBytes is preventing the connection, I'm puzzled!

thanks, lmod

[MysteryFCM]

The only way to determine where they are coming from, and what is trying to connect to it, is by analyzing your firewall logs and/or using a program such as Wireshark.

[GT500]

... a program such as Wireshark.

TCPView might be easier to use.