Having lots of IP Protection blocking warnings.

[idd00jea]

From some days ago I am having lots of IP Protection blocking warnings. Much more than was having before.

Does it means that something is going wrong in my PC?. The intrussions signaled comes from MANY different IPs, and not doing any browsing or actions with my PC.

BTW, I have also found that I can not download files from accepted websites as http://www.spywareterminator.com because when trying to do so, a warning always tell me that "Malwarebytes' Anti-Malware has blocked access to IP 64.135.77.30 that contains malware" and the download does not initiate. (see attached screenshot)

Are both problems related?.

Thanks.

[GT500]

Check your HOSTS file, and your DNS settings. Make sure that they have not been tampered with.

[idd00jea]

Check your HOSTS file, and your DNS settings. Make sure that they have not been tampered with.

Hi GT500, I have checked my HOSTS file, and it looks OK.

About DNS settings, ....what do you mean abut 'DNS settings'?. What is the way to check that?

Thanks.

[Porthos]

I have also found that I can not download files from accepted websites as http://www.spywareterminator.com because when trying to do so, a warning always tell me that "Malwarebytes' Anti-Malware has blocked access to IP 64.135.77.30 that contains malware" and the download does not initiate. (see attached screenshot)

Are both problems related?.

Thanks.

A look here will answer this issue

http://www.malwarebytes.org/forums/index.p...mp;#entry170686

[GT500]

About DNS settings, ....what do you mean abut 'DNS settings'?. What is the way to check that?

Assuming you are on Windows XP, you will need to go into the properties for your network adapter (or dialup connection, if you are on one), on the General tab select Internet Protocol (TCP/IP) from the list and click Properties. Make sure that it is set to Obtain DNS server address automatically or you can alternately choose to use a service like OpenDNS.

If you do not know how to get into the properties for your network adapter or dialup connection, then here are directions:

1) Click the Start button.

2) Open the Control Panel.

3) If it is not already in Classic View, then on the left near the top of the blue area, click the link to Switch to Classic View.

4) Double-click on Network Connections.

5) Find the one that is connected (see screenshot below), right-click on it, and select Properties.

[idd00jea]

Assuming you are on Windows XP, you will need to go into the properties for your network adapter (or dialup connection, if you are on one), on the General tab select Internet Protocol (TCP/IP) from the list and click Properties. Make sure that it is set to Obtain DNS server address automatically or you can alternately choose to use a service like OpenDNS.

If you do not know how to get into the properties for your network adapter or dialup connection, then here are directions:

1) Click the Start button.

2) Open the Control Panel.

3) If it is not already in Classic View, then on the left near the top of the blue area, click the link to Switch to Classic View.

4) Double-click on Network Connections.

5) Find the one that is connected (see screenshot below), right-click on it, and select Properties.

Thanks GT500.

You can see exactly what I have in the attached screenshot. So I think that it is OK too.

[GT500]

Thanks GT500.

You can see exactly what I have in the attached screenshot. So I think that it is OK too.

Well, that looks OK. It's possible that you have an infection that is causing this.

Your avatar says you are a member of the Spybot S&D team. I assume you have run ComboFix and analyzed the log?

[idd00jea]

Well, that looks OK. It's possible that you have an infection that is causing this.

Your avatar says you are a member of the Spybot S&D team. I assume you have run ComboFix and analyzed the log?

No, I have not run ComboFix. I have tried to get ComboFix from Bleepingcomputer.com but it is not possible to get it now as told by http://download.bleepingcomputer.com/sUBs/ComboFix.html

Can I use other tool to help diagnose this problem?.

Thanks.

[idd00jea]

A look here will answer this issue

http://www.malwarebytes.org/forums/index.p...mp;#entry170686

Thanks Porthos.

I think this answers my question about http://www.spywareterminator.com program download problem.

A different problem could be the TOO FREQUENT IP protection warning messages appearing without any browsing or program action in my PC.

You can see an example of warning message in the attached screenshot.

[GT500]

No, I have not run ComboFix. I have tried to get ComboFix from Bleepingcomputer.com but it is not possible to get it now as told by http://download.bleepingcomputer.com/sUBs/ComboFix.html

Can I use other tool to help diagnose this problem?.

Thanks.

Normally sUBs replaces ComboFix with a version that only replaces a log. I guess he decided to pull it completely this time. Try something like DDS, which will produce a ComboFix-like log:

http://download.bleepingcomputer.com/sUBs/dds.scr

[idd00jea]

GT500, here is an attached ZIP file including the two text files generated by "dds.scr" software.

Drive_C.zip

[GT500]

You're in luck. sUBs has a beta version of ComboFix that is working, and he says it is stable enough for use by forum helpers, so here's the link:

http://download.bleepingcomputer.com/sUBs/Beta/KittyFix.exe

[idd00jea]

Thanks GT500.

I have downloaded this beta program KittFix.exe. Now, I will search for some instructions about its use, and will post here the results in my PC.

[idd00jea]

Hi GT500,

I have completed to run KittyFix.exe. I do not have experience with it, so I do not know if I did correctly.

Here is the result file ( enclosed in a ZIP file ) attached to this posting.

ComboFix.zip

[GT500]

I have a feeling that this has something to do with the IP protection notifications:

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14726:TCP"= 14726:TCP:uTorrent - Puerto TCP
"14726:UDP"= 14726:UDP:uTorrent - Puerto UDP

I don't see it in your startup items, but

[idd00jea]

Hummm, ...yes, it could be.

I do not have it to automaticaly load at Windows starting, but sometimes I open it, and let it work alone.

Thanks, GT500. I will check if when uTorrent is not being used there will no IP blocking, or at least will have less ocurrences.

[GT500]

Thanks, GT500. I will check if when uTorrent is not being used there will no IP blocking, or at least will have less ocurrences.

OK. Let me know if it turn out to not be the culprit.