Solved Malwarebytes Blocking IP address

[mhhack]

Hi,
Malwarebytes(1.70) is returning "successfully blocked access to a potentially malicious website 91.235.128.161, type outgoing, port 53041, Process: explorer.exe. I've run some p2p software recently, but have uninstalled it, and cannot understand why explorer.exe is the process implicated. I've since run Microsoft Security Essentials and Malwarebytes on my whole system, but they return no errors. Can anyone help?

 

[tman69]

Hi,
Malwarebytes(1.70) is returning "successfully blocked access to a potentially malicious website 91.235.128.161, type outgoing, port 53041, Process: explorer.exe. I've run some p2p software recently, but have uninstalled it, and cannot understand why explorer.exe is the process implicated. I've since run Microsoft Security Essentials and Malwarebytes on my whole system, but they return no errors. Can anyone help?

the message means the MBAM blocked something from accessing Windows Explorer (or kept windows explorer from connecting to that website) in other words...it did what it's supposed to do.

IF you would like more info see:

Malwarebytes Forum

 

[A Guy]

Welcome to Seven Forums mhhack. IP address in the Ukraine the-pirate-bay.biz

the-pirate-bay.biz - Ukraine IP. Detailed location, ISP and more info.

91.235.128.161 IP Address WHOIS | DomainTools.com

A Guy

 

[Phone Man]

A lot of times a site you have opened has links to other sites to load advertisments and MB is blocking one of these links.

Jim

 

[mhhack]

Thanks for your info, though I still don't see the solution to the fact that even when my computer is doing nothing malwarebytes will popup the blocking message. Remember that the type is outgoing, which I think means that my PC is initiating the request to connect. It's that that I want to stop.

 

[DBone]

If I were you, I would at least try a scan with Hitman Pro ( Home - SurfRight ). Also, you made it sound as though you did a full scan with Malwarebytes, but I would do another. Make sure it's up to date first, also make sure that in the settings tab, that you have PUP set to "show in results and check for removal"....... Actually, make sure that all 3 choices are set that way.

Start with that, and see if they can sniff something out.

 

[mhhack]

Thanks for your suggestions. I've rerun MB, full scan, and it turns up nothing, with the settings you suggested. I've also run SurfRight with nothing found.
Somehow or other something is prompting exlorer.exe to try to reach that malicious website, even though at the time nothing is running actively except for background tasks.
Just noticed looking at the MB logs that this attempt is made every 15 minutes, with the same URL but a different port.

 

[DavidE]

Someone reported the same type of issue on the Malwarebytes forum.
If you're interested, MBAM stated they could help determine the cause of the blocks.

Malwarebytes detects outgoing attempt from explorer.exe - Malwarebytes Forum

 

[mhhack]

This finally turned out to be a rootkit infection. One or another of those p2p sites downloaded a rootkit that mimicked explorer.exe. Luckily it was blocked by Malwarebytes and finally removed, though it wasn't detected in previous runs. Go know.

 

[DavidE]

Hello mhhack,

Glad you got this sorted out.
Can you tell us how you found out you had a rootkit infection?
It could help others if they run into this.

Did a Malwarebytes (MBAM) scan find and remove it?

Malwarebytes does have a new Anti-Rootkit tool (MBAR), but that is still in BETA (as far as I know).
Malwarebytes : Malwarebytes Anti-Rootkit

Thanks,
David

 

[mhhack]

RootkitsRepair

The rootkit was found by Malwarebytes, but it was strange indeed. This root kit was attempting to reach a malicious site, which Malwarebytes Pro was blocking every 15 minutes, which I could see from the Mbam log. After not finding the rootkit for several hours, it suddenly, after another 15 minute, found the rootkit, which it removed. Since that time the IP block has not occurred.
I opened a case on Mbam, and they did a very thorough job of helping, including scanning logs of my system, and suggesting various pieces of software to monitor my system, and helping me to use Combofix.
I can only say the buying Mbam Pro was really worth it.
The help at Mbam also suggested amending the host file. Take a look at: http://www.funkytoad.com/content/view/13/31/

 

[DavidE]

Thanks for posting back with that info!

I find it interesting they suggest using the HOST file for additional protection with the Pro version.
I wondered about that...if it's worth it to use MBAM Pro Website blocking AND HOST file "exclusions".
I wasn't sure if it's overkill and unnecessary redundant protection (paranoia).

If they suggest using it...well, they know better than me!
I agree, MBAM Pro is a a great value and well worth the cost.

Great to hear you are cleaned up and the problem is solved.

 

[mhhack]

What's interesting is that there now exist black lists and white lists! I used to use Comodo Firewall, but they were set up so that you couldn't change the white lists. As of this moment I'm using Windows 7 Firewall Control. It's the free version, but allows you to control outbound and inbound traffic. I suspect that if Mbam hadn't blocked that malicious site then the firewall would have popped up asking for permission.

 

[DavidE]

I just use the built in Windows firewall, and a router firewall.

If you haven't heard of it, another Product I use and like is WinPatrol 2013

I use the free version, and it works well for me - no issues here...

 

[Layback Bear]

This might be of some interest.

 

[mhhack]

All three of my grown sons say "Dad, get yourself an Apple".

 

[Layback Bear]

Why pay that kind of money just for more problems. Apple systems have problems just like Windows. In your case it wasn't Windows but a infection that got in. That happens to all operating system.

 

[Phone Man]

All three of my grown sons say "Dad, get yourself an Apple".

Tell them it would make a good Christmas or Birthday gift from them and that will shut them up.

Jim

 

[Jacee]

Your Hosts File is very important to use, as it has abilities to block malicious programs!
See the explanation here: The Hosts File and what it can do for you

 

[Layback Bear]

Thank you Jacee for the information on Host File. Very informative.