Malwarebytes Constant blocked "outgoing" to 112.175.243.23

[union122]

Windows 7 pro, 64bit.
Malwarebytes pro and MSE running.

I tried Combofix, malwareytes is safe mode, SAS, D7 malware removal.

Any ideas ?

thanks

 

[DavidE]

That is just a warning that you are trying to access a site or server that is known for malware...
It doesn't mean you have any malware on your PC.

You can ignore the block/warning and go to the web site.
After the block message, Rt. click on the MBAM tray icon and click Add to ignore list

You can also disable IP Blocking completely in the MBAM options.

 

[Petey7]

If I were you, I would disable the notification, not the IP Blocker itself. You can do this by unticking the box next to "Show tooltip balloon" in the protection tab. I always leave the notifactions off and expect it to do its thing. While using Skype or other chat clients, it will block some IPs but not most (meaning the program works fine while not potentially exposing you to malware), and when using a web browsers it will regularly block IPs of ads that may be potentially dangerous. Unless you regularly visit free porn sites or something like that, the IP blocker will rarely prevent you from doing anything, but the notifications are annoying.

 

[DavidE]

i agree, if you get a lot of notifications disabling them would be better.
It depends on the programs a person uses...torrents, p2p, etc.
I rarely get a block, so i prefer to know when i do hit one, and what program / site caused it.

 

[union122]

But this one is too the same ip address all the time.

 

[Petey7]

What are you using when it pops up?

 

[DavidE]

You can read about MBAM IP blocking here ( Section G - IP Protection Module )

FAQ - Common Issues, Questions, and their Solutions - Malwarebytes Forum

 

[Borg 386]

A check of the IP address says it's located in The Republic of Korea. By any chance are you using GOM Player? GOM player is nice, but it it will report back on anything you watch unless you block it.

 

[union122]

I am using POT player !! no GOM

 

[Borg 386]

Interesting. looking at POT Player I find this:

PotPlayer is a free advanced multimedia player. Done by the same Korean author as The KMPlayer.

And the addy checks out as being Korean. It may have put something on your PC you're unaware of.

 

[Petey7]

Did some looking online. I want to start off by saying that you seem to have posted about this on several different sites about this issue. While it is not wrong to do so, we like to know because you have people telling you to do stuff we don't know about, which makes it harder for us to help you in the long run.

More importantly, it seems that the IP Address you mention is used in several DDOS attacks. I'm not sure if this means you are currently infected or not, but it does indicate that MBAM is doing its job. Please go to the Logs tab in Malwarebytes and scroll down to the protection module logs. Open one of the logs and copy and paste it's contents into your next post. The log should tell us exactly what is trying to access that IP address. It may be your media player, it might not, but we need to find out.

 

[Layback Bear]

This Korean player must a call home program and IMHO it's good it's being blocker by MAM.

 

[union122]

Did some looking online. I want to start off by saying that you seem to have posted about this on several different sites about this issue. While it is not wrong to do so, we like to know because you have people telling you to do stuff we don't know about, which makes it harder for us to help you in the long run.

More importantly, it seems that the IP Address you mention is used in several DDOS attacks. I'm not sure if this means you are currently infected or not, but it does indicate that MBAM is doing its job. Please go to the Logs tab in Malwarebytes and scroll down to the protection module logs. Open one of the logs and copy and paste it's contents into your next post. The log should tell us exactly what is trying to access that IP address. It may be your media player, it might not, but we need to find out.

Sorry, yes I did, well only on technibble.. that and sevens is my constant read when I can. I didn't know MBAM had that feature, log tab and protection module.. thanks for the heads up I will look at that and post back.

 

[union122]

2012/06/21 08:12:19 -0400 THINK SLC IP-BLOCK 112.175.243.24 (Type: outgoing, Port: 52204, Process: svchost.exe)
2012/06/21 08:12:19 -0400 THINK SLC IP-BLOCK 112.175.243.21 (Type: outgoing, Port: 52205, Process: svchost.exe)
2012/06/21 08:18:27 -0400 THINK SLC IP-BLOCK 112.175.243.21 (Type: outgoing, Port: 52226, Process: svchost.exe)
2012/06/21 08:18:27 -0400 THINK SLC IP-BLOCK 112.175.243.21 (Type: outgoing, Port: 52227, Process: svchost.exe)
2012/06/21 08:21:31 -0400 THINK SLC IP-BLOCK 95.215.1.248 (Type: outgoing, Port: 52238, Process: svchost.exe)
2012/06/21 08:21:31 -0400 THINK SLC IP-BLOCK 95.215.1.248 (Type: outgoing, Port: 52239, Process: svchost.exe)
2012/06/21 08:24:28 -0400 THINK SLC IP-BLOCK 112.175.243.22 (Type: outgoing, Port: 52251, Process: svchost.exe)
2012/06/21 08:24:28 -0400 THINK SLC IP-BLOCK 112.175.243.22 (Type: outgoing, Port: 52252, Process: svchost.exe)
2012/06/21 08:27:25 -0400 THINK SLC IP-BLOCK 93.170.52.31 (Type: outgoing, Port: 52282, Process: svchost.exe)
2012/06/21 08:27:34 -0400 THINK SLC IP-BLOCK 93.170.52.31 (Type: outgoing, Port: 52284, Process: svchost.exe)
2012/06/21 08:30:32 -0400 THINK SLC IP-BLOCK 112.175.243.23 (Type: outgoing, Port: 52291, Process: svchost.exe)
2012/06/21 08:30:32 -0400 THINK SLC IP-BLOCK 112.175.243.23 (Type: outgoing, Port: 52292, Process: svchost.exe)
2012/06/21 08:33:30 -0400 THINK SLC IP-BLOCK 93.170.52.31 (Type: outgoing, Port: 52301, Process: svchost.exe)
2012/06/21 08:33:30 -0400 THINK SLC IP-BLOCK 93.170.52.31 (Type: outgoing, Port: 52302, Process: svchost.exe)

 

[Petey7]

The fact that it says "svchost.exe" means that it is a service excessing that IP address. In the start menu search bar, type "msconfig" and press enter. Go to the services tab and check the box saying "Hide all Microsoft services". Please provide us a list of the names of all remaining services.