Does several blocked outbound ip calls a day mean I'm infected?

[struth]

Hi

I've not been getting anything found in the automated scans, but each day there is from 4 to 10 calls total to 1 or 2 different ip addresses a day that are blocked.

Is this a concern, or is there anything I should do?

Some ip addresses from the last week are:

77.78.208.76

203.200.180.196

94.96.83.55

62.45.89.237

222.64.57.78

89.28.47.238

194.143.137.146

87.248.186.82

Thanks

Struth

[1PW]

Hi

I've not been getting anything found in the automated scans, but each day there is from 4 to 10 calls total to 1 or 2 different ip addresses a day that are blocked.

Is this a concern, or is there anything I should do?

Some ip addresses from the last week are:

77.78.208.76

203.200.180.196

94.96.83.55

62.45.89.237

222.64.57.78

89.28.47.238

194.143.137.146

87.248.186.82

Thanks

Struth

Hello struth:

This could be a concern. Those IP addresses are in many different countries.

1. Please tell us what Windows OS your computer is running.

2. Do you have any file sharing applications running such as a torrent, P2P client, Skype or similar?

3. What is the name and version of your antivirus application and what are the results of its scans?

Based on your answers, it might be best to move your inquire to another sub-forum where possibly infected systems are troubleshot with the aid of a trained expert.

[struth]

Hi and thanks for the response,

The system is XP SP3 all updates applied.

The machine has no torrent clients, but does have skype (however set to offline as I don't use it).

There are 2 automated backup clients, mozyhome and crashplan.

It runs boinc (grid computing), hosted outlook and logmein (all run ok tho, meaning I can't see them failing because of false positives).

Antivirus is AVG (paid) which scans every night and has no record of anything.

It also has spybot (with immunisations aplied). Scans detect nothing.

Browsing is done via firefox with addons adblock plus, and noscript.

Thanks,

Struth

[1PW]

Hi and thanks for the response,

The system is XP SP3 all updates applied.

The machine has no torrent clients, but does have skype (however set to offline as I don't use it).

There are 2 automated backup clients, mozyhome and crashplan.

It runs boinc (grid computing), hosted outlook and logmein (all run ok tho, meaning I can't see them failing because of false positives).

Antivirus is AVG (paid) which scans every night and has no record of anything.

It also has spybot (with immunisations aplied). Scans detect nothing.

Browsing is done via firefox with addons adblock plus, and noscript.

Thanks,

Struth

You might consider running Microsoft's/Sysinternal's TCPView to check which application(s) are seeking outgoing communication.

You might also consult your MBAM logs to see if an outgoing port/application is specified when the blocking occurs and post it here.

If at anytime you believe malware may be the source of your IP blocks, you should move this thread to the Malware Removal - HijackThis Logs sub-forum for expert help.

[John A]

Hi Struth

It still could be Skype, which does a lot in the background even though you are off-line.

To test if it is Skype, either right click on the icon and choose Exit Skype, or set it so that it does not start with Windows:

Tools / Options / General - untick "Start Skype when I start Windows", then Save and reboot

[struth]

Thanks for the suggestions - I've disabled skypes start with windows capability. Plus will run TCPview to check.

Is there anywhere that lists the source ip addresses that are used as a reference and what they are? Or is that kept quiet so people don't know they are on the lists and then change their hosting?

Thanks, Struth

[struth]

I disabled auto startup of skype back 5 days ago, and there hasn't been any blocked ip calls since.

Thanks

[Firefox]

Well that will tell us that it was Skype that was causing your popups.... Glad you got it sorted out, If you have any further questions don't hesitate to ask....

[John A]

Following is the information received from Skype Support when I asked them why these ip addresses were being accessed. Blocking suspect ips by MalwareBytes does not cause any noticeable degradation of Skype's performance.

"We understand the inconvenience that might cause and we appreciate your patience and understanding. Skype is a peer-to-peer (P2P) application. Peer-to-peer makes it possible for multiple computers running the same P2P software to communicate and participate in traffic routing, processing and other bandwidth intensive tasks that are usually performed by a central server. P2P allows sharing files containing audio, video, data and real-time data.

Skype has no single

[happy_trunks]

Following is the information received from Skype Support when I asked them why these ip addresses were being accessed.

thanks john, good info!