95.143.192.11

[john18]

I am continuing to get IP-Block messages for 95.143.192.11 which, according to Google, is in Sweden. Google doesn't seem to know anything else about this address. Is it a false positive?

Thanks for any response.

[MysteryFCM]

This isn't an F/P, no. I'd recommend having your machine checked for infection;

http://forums.malwarebytes.org/index.php?showtopic=9573

[john18]

I already own the Pro version and I just updated its definitions and ran a quick scan and you can see the results below.. Nothing found. My Anti-Viruse is Norton 360 v4, fully updated and shows nothing. What else should I be checking?

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 5077

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

11/8/2010 6:52:13 PM

mbam-log-2010-11-08 (18-52-13).txt

Scan type: Quick scan

Objects scanned: 161472

Time elapsed: 3 minute(s), 14 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[john18]

BTW, here is my log from today.

15:25:55 John IP-BLOCK 95.143.192.211

15:25:55 John IP-BLOCK 95.143.192.211

15:25:55 John IP-BLOCK 95.143.192.211

15:27:39 John IP-BLOCK 95.143.192.211

15:27:39 John IP-BLOCK 95.143.192.211

15:44:53 John IP-BLOCK 95.143.192.211

15:44:53 John IP-BLOCK 95.143.192.211

15:47:01 John IP-BLOCK 95.143.192.211

15:47:01 John IP-BLOCK 95.143.192.211

18:33:45 John IP-BLOCK 95.143.192.211

18:33:45 John IP-BLOCK 95.143.192.211

18:45:22 John IP-BLOCK 95.143.192.211

18:45:30 John IP-BLOCK 95.143.192.211

18:48:40 John MESSAGE IP Protection stopped

18:48:40 John MESSAGE IP Protection started successfully

18:48:58 John MESSAGE IP Protection stopped

18:49:01 John MESSAGE Database updated successfully

18:49:01 John MESSAGE IP Protection started successfully

18:53:26 John IP-BLOCK 95.143.192.211

18:53:34 John IP-BLOCK 95.143.192.211

[MysteryFCM]

Please follow the instructions in the link I referenced above, and someone will assist in pinning down what's accessing it.

[john18]

Please follow the instructions in the link I referenced above, and someone will assist in pinning down what's accessing it.

OK, I am doing it.

Let me ask a quick question. I already have the Pro version of MBAM licensed and installed on two computers (and the other one has even more IP-Block messages). Is it critical that MBAM be run from the desktop rather than just the installed (and updated) version? If so do I need to uninstall MBAM for now and then re-install it later?

For now I am doing the rest of the steps and will report when I finish them. Thanks.

[MysteryFCM]

You should be able to use the installed version unless the helper advising you says otherwise (not usually required for systems that already have it installed)

[john18]

My first computer is done and I posted the results here.

I am working on the second computer now. GMER did not have any results. It found nothing.

Thanks.

[john18]

The second computer is done and I have opened a thread here.

The Storagecraft files that I saw in one of the logs is for Shadow Protect Desktop, which is backup software.

Again, thank you for any help.