Malwarebytes Constant blocked "outgoing" to 112.175.243.23

Page 2 of 2 FirstFirst 12

  1. Posts : 2,963
    Windows 7 Professional SP1 64-bit
       #11

    Did some looking online. I want to start off by saying that you seem to have posted about this on several different sites about this issue. While it is not wrong to do so, we like to know because you have people telling you to do stuff we don't know about, which makes it harder for us to help you in the long run.

    More importantly, it seems that the IP Address you mention is used in several DDOS attacks. I'm not sure if this means you are currently infected or not, but it does indicate that MBAM is doing its job. Please go to the Logs tab in Malwarebytes and scroll down to the protection module logs. Open one of the logs and copy and paste it's contents into your next post. The log should tell us exactly what is trying to access that IP address. It may be your media player, it might not, but we need to find out.
      My Computer


  2. Posts : 25,847
    Windows 10 Pro. 64/ version 1709 Windows 7 Pro/64
       #12

    This Korean player must a call home program and IMHO it's good it's being blocker by MAM.
      My Computer


  3. Posts : 10
    7 pro 64 nit
    Thread Starter
       #13

    Petey7 said:
    Did some looking online. I want to start off by saying that you seem to have posted about this on several different sites about this issue. While it is not wrong to do so, we like to know because you have people telling you to do stuff we don't know about, which makes it harder for us to help you in the long run.

    More importantly, it seems that the IP Address you mention is used in several DDOS attacks. I'm not sure if this means you are currently infected or not, but it does indicate that MBAM is doing its job. Please go to the Logs tab in Malwarebytes and scroll down to the protection module logs. Open one of the logs and copy and paste it's contents into your next post. The log should tell us exactly what is trying to access that IP address. It may be your media player, it might not, but we need to find out.

    Sorry, yes I did, well only on technibble.. that and sevens is my constant read when I can. I didn't know MBAM had that feature, log tab and protection module.. thanks for the heads up I will look at that and post back.
      My Computer


  4. Posts : 10
    7 pro 64 nit
    Thread Starter
       #14

    2012/06/21 08:12:19 -0400 THINK SLC IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 52204, Process: svchost.exe)
    2012/06/21 08:12:19 -0400 THINK SLC IP-BLOCK 112.175.243.21 (Type: outgoing, Port: 52205, Process: svchost.exe)
    2012/06/21 08:18:27 -0400 THINK SLC IP-BLOCK 112.175.243.21 (Type: outgoing, Port: 52226, Process: svchost.exe)
    2012/06/21 08:18:27 -0400 THINK SLC IP-BLOCK 112.175.243.21 (Type: outgoing, Port: 52227, Process: svchost.exe)
    2012/06/21 08:21:31 -0400 THINK SLC IP-BLOCK 95.215.1.248 (Type: outgoing, Port: 52238, Process: svchost.exe)
    2012/06/21 08:21:31 -0400 THINK SLC IP-BLOCK 95.215.1.248 (Type: outgoing, Port: 52239, Process: svchost.exe)
    2012/06/21 08:24:28 -0400 THINK SLC IP-BLOCK 112.175.243.22 (Type: outgoing, Port: 52251, Process: svchost.exe)
    2012/06/21 08:24:28 -0400 THINK SLC IP-BLOCK 112.175.243.22 (Type: outgoing, Port: 52252, Process: svchost.exe)
    2012/06/21 08:27:25 -0400 THINK SLC IP-BLOCK 93.170.52.31 (Type: outgoing, Port: 52282, Process: svchost.exe)
    2012/06/21 08:27:34 -0400 THINK SLC IP-BLOCK 93.170.52.31 (Type: outgoing, Port: 52284, Process: svchost.exe)
    2012/06/21 08:30:32 -0400 THINK SLC IP-BLOCK 112.175.243.23 (Type: outgoing, Port: 52291, Process: svchost.exe)
    2012/06/21 08:30:32 -0400 THINK SLC IP-BLOCK 112.175.243.23 (Type: outgoing, Port: 52292, Process: svchost.exe)
    2012/06/21 08:33:30 -0400 THINK SLC IP-BLOCK 93.170.52.31 (Type: outgoing, Port: 52301, Process: svchost.exe)
    2012/06/21 08:33:30 -0400 THINK SLC IP-BLOCK 93.170.52.31 (Type: outgoing, Port: 52302, Process: svchost.exe)
      My Computer


  5. Posts : 2,963
    Windows 7 Professional SP1 64-bit
       #15

    The fact that it says "svchost.exe" means that it is a service excessing that IP address. In the start menu search bar, type "msconfig" and press enter. Go to the services tab and check the box saying "Hide all Microsoft services". Please provide us a list of the names of all remaining services.
      My Computer


 
Page 2 of 2 FirstFirst 12

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 06:49.
Find Us