MBAM detects outgoing connections, but scan says it's clean

[FlavioB]

Hello everybody.

I get notifications on the system tray from MBAM telling me that there are suspicious outgoing connections (see attachments).

I've updated MBAM and run a scan: it says it's clean.

What should I look for?

Thanks in advance,

F.

[Mainard]

Hello Flavio,

Do you experience this balloon while surfing the Internet?

What exactly are you doing when you receive this balloon notification?

Thank you.

[FlavioB]

Hello Flavio,

Do you experience this balloon while surfing the Internet?

What exactly are you doing when you receive this balloon notification?

Thank you.

Hello Mainard, thanks for getting back to me.

Actually I experience those ballons simply while connected to my LAN (which is of course connected to the internet through my DSL modem/router).

No programs are open (no IE, nothing except for those starting up automatically).

What can you suggest?

Thanks,

F.

[lmpiper]

I am having the same problem, (different IP addresses). Scans do not find anything.

[Guest spc3rd]

Hi lmpiper!

Just out of curiousity...which AV software are you using? I have been using McAfee for several years now and have noticed that when MBAM displays a balloon over the Taskbar stating it has blocked an IP address, with the TYPE shown as OUTGOING, my McAfee Firewall INBOUND Events Log records the same IP address as being blocked from making a connection to a system port!

Like you, I ran full scans with both McAfee & MBAM, as well as, Microsoft's Security Analyzer Tool and nothing was found.

[Mainard]

Hello flavio, Impiper, and Spc3rd,

Are you using any Peer-to-peer software? (Skype, torrent, etc...)

Thank you.

[Guest spc3rd]

Hi Mainard!

I'm not running any peer-to-peer on my computer. For whatever help it is, I received a reply back from Tom at MBAM support a short time ago in which he indicated there was likely no problem with being infected, given the scans showed nothing and these IP addresses in China have been repeatedly recorded in my McAfee Firewall Inbound Events Log for over 3 years now as well.

Thanks very much for following-up on this issue!

[FlavioB]

Hello flavio, Impiper, and Spc3rd,

Are you using any Peer-to-peer software? (Skype, torrent, etc...)

Thank you.

As you can see in the screenshots, yes: Skype is being used.

Thanks,

F.

[challam]

Hello, I'm another Newby and I have the same issue.

I've just upgraded to from the free MBAM to the Trial version and instantly I'm getting the same message.

I've completed a full system scan and currently there is nothing there, however, it found issues Last night and this morning.

I don't use P2P, and have the latest trend micro Internet Security.

As you can see below its almost constantly blocking something, and rather annoying and distracting.

I have attached the protection log and there are hundreds of blocked IP's in that last hour.

How can I find the infected file/s and get rid of them.

protection-log-2011-06-15.txt

Thanks in anticipation

Craig

[Guest spc3rd]

Hi Craig!

Which AV software are you using? Just for reference, I checked several of the IP addresses shown in the protection log you attached. All are malicious sites rated at high risk! The IP address locations include, The Netherlands, Russia, & Romania.

[FlavioB]

Hi Craig!

Which AV software are you using? Just for reference, I checked several of the IP addresses shown in the protection log you attached. All are malicious sites rated at high risk! The IP address locations include, The Netherlands, Russia, & Romania.

Hello spc3rd,

in my case I also saw the IP addresses relate to malicious sites.

My antivirus is Panda Antivirus (Corporate).

F.

[Guest spc3rd]

Hi Flavio,

Just a note here that my last posting (#10) was in response to Craig's post. Sorry for the miscommunication.

[FlavioB]

Hi Flavio,

Just a note here that my last posting (#10) was in response to Craig's post. Sorry for the miscommunication.

I know you were answering to Craig, but we have the same trouble... therefore...

F.

[Mainard]

Hello all,

Well this makes for hard support as each person's system will be set up differently and will have different root causes to create the same issue. Please as a reminder hijacking a post to post "I have this too" will not make it easier on the helper as it will confuse each user that is being assisted. Also, if an MBAM Employee is assisting a user please refrain from posting any assistance within the topic as it will also confuse the user being helped by getting two sets of instructions.

To ensure you get the complete and friendly assistance everyone receives, please create a new topic describing your issue in detail as well as including system specifications to allow the helper to assist you further.

Now to assist the original post of this topic,

Is this system used as a part of a business?

As a licensed reseller, affiliate, corporate, tech shop, non-profit or government user your current inquiry is eligible for Malwarebytes

[challam]

I'll open up a new post and start again

[FlavioB]

Now to assist the original post of this topic,

Is this system used as a part of a business?

No, it is not.

F.

[Mainard]

Hello Flaviob,

I appreciate the prompt replies and your patience.

I would like to give credit for the time and effort John A made within his post I suggest reading the reply he created Here. This will explain why we block some IPs while using Skype.

If you have any further questions I will be glad to assist you further.

Thank you.