Is his a hidden malware?

[brianm]

Two of my computers picked up Trojan malware. Malwarebytes apparently cleaned both but now they are operating differently.

I have the paid version of MB with real time protection. My laptop now runs without a glitch including no, none at all, IP blocking in the browser. However, whenever I connect to the internet with my browser on the desktop I get an immediate IP block on 91.212.226.42, which is somewhere in Russia, and frequent blocks on other IP addresses. This is not an accident, the 91.212.226.42 address appears immediately, EVERY time, I enter the browser.

One computer is a laptop, the other is a desktop, both run Windows XP Pro, both use Firefox as a browser, both are protected by McAfee and Malwarebytes. Both computers connect to the internet through a Linksys router, the desktop by wired LAN and the laptop via wireless.

It does not seem possible that one computer is continually hit by IP blocking and the other has no activity at all. I would greatly appreciate opinions, Thanks.

[DarkSnakeKobra]

Hi brianm and welcome to malwaebytes'!

It sounds like you could be infected which may be causing the ip blocks.

I recommend checking this out http://forums.malwarebytes.org/index.php?showtopic=9365

If you really think you are infected download Hijack this here http://free.antivirus.com/hijackthis/ download version 2.0.2 not 2.0.3 as its still a beta.

You need to right click and select run as administrator if you are using Vista/7. Then do a system scan and save a log file then post here

http://forums.malwarebytes.org/index.php?showforum=7

As we don't work in malware removal in the general forms. Someone should assist you there. If you need anything else don't hesitate to replay

[AdvancedSetup]

Hello , and welcome to Malwarebytes.org

We don't work on Malware removal in the general forums.

Please print out, read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.

One of the expert helpers there will give you one-on-one assistance when one becomes available.

After posting your new post make sure under options that you select Track this topic and choose one of the Email options so that you're alerted when someon has replied to your post.

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org

[noknojon]

From a quick search -

Geographic Information about 91.212.226.42:

Country: RU (Russian Federation)

Region: 84

Latitude: 48.6458

Longitude: 42.9181

http://forums.malwarebytes.org/index.php?s...st&p=162100

The quick link above is in regards to IP protection - Please read it to familiarise your self as to its operation -

Thank You -

[brianm]

Thanks Guys, I do not want to work on the problem in "General" I just wanted an opinion on whether I had a problem and if anybody recognized it. Thank you.

[brianm]

Please understand that I am not trying to fix my present problem in these posts, I can do that later, I am trying to think through this situation logically and perhaps better understand the internet so that I can avoid future problems. Expert comment will be highly valued.

As I wrote in my first post, I have two systems identical except in the hardware. Software is identical so under normal circumstances you could expect identical operation of both systems. Not so. The desktop system is continually blocking IP addresses, the laptop never shows an IP being blocked. This means that;

A. The IP address blocking is working correctly on the desktop and not on the laptop.

b. The desktop has malware that is attracting malicious sites and the laptop does not.

Answer to simple questions please;

A. Is it typical to receive very frequent notice of IP blocking (average about 1 event per 30 seconds)? If so it would seem to be my desktop that is operating correctly and the laptop has a problem.

B. Why would the same IP address try to contact my desktop, immediately and consistently, if it was not being "paged" from my desktop?

hanks for helping my learning experience,

Brian

[lordpake]

A. Is it typical to receive very frequent notice of IP blocking (average about 1 event per 30 seconds)? If so it would seem to be my desktop that is operating correctly and the laptop has a problem.

Unless you use P2P software in that PC, no it is not typical in my experience to have so many notifications.