Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Successfully blocked access error


  • Please log in to reply
2 replies to this topic

#1 amoten

amoten

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:08:34 AM

Posted 21 August 2013 - 12:10 PM

I am getting Successfully blocked access to potentially Malicious website: 95.211.194.79.

I ran combo fix, Malwarebytes,Symantes Super anti-spyware, and Sbybot and nothing is stopping it from popping up. any ideas how to get rid of this besides reimaging the drive?

 

This shows in the Malwarebytes log:

 

2013/08/21 07:39:26 -0500 ANMOUS20 AnMoUS MESSAGE Starting protection
2013/08/21 07:39:26 -0500 ANMOUS20 AnMoUS MESSAGE Protection started successfully
2013/08/21 07:39:26 -0500 ANMOUS20 AnMoUS MESSAGE Starting IP protection
2013/08/21 07:39:28 -0500 ANMOUS20 AnMoUS MESSAGE IP Protection started successfully
2013/08/21 07:39:56 -0500 ANMOUS20 AnMoUS MESSAGE Stopping IP protection
2013/08/21 07:39:57 -0500 ANMOUS20 AnMoUS MESSAGE IP Protection stopped successfully
2013/08/21 07:39:57 -0500 ANMOUS20 AnMoUS MESSAGE Protection stopped
2013/08/21 07:40:01 -0500 ANMOUS20 AnMoUS MESSAGE Starting protection
2013/08/21 07:40:01 -0500 ANMOUS20 AnMoUS MESSAGE Protection started successfully
2013/08/21 07:40:01 -0500 ANMOUS20 AnMoUS MESSAGE Starting IP protection
2013/08/21 07:40:14 -0500 ANMOUS20 AnMoUS MESSAGE IP Protection started successfully
2013/08/21 07:40:29 -0500 ANMOUS20 AnMoUS MESSAGE Starting database refresh
2013/08/21 07:40:29 -0500 ANMOUS20 AnMoUS MESSAGE Stopping IP protection
2013/08/21 07:40:32 -0500 ANMOUS20 AnMoUS MESSAGE IP Protection stopped successfully
2013/08/21 07:40:34 -0500 ANMOUS20 AnMoUS MESSAGE Database refreshed successfully
2013/08/21 07:40:34 -0500 ANMOUS20 AnMoUS MESSAGE Starting IP protection
2013/08/21 07:40:35 -0500 ANMOUS20 AnMoUS MESSAGE IP Protection started successfully
2013/08/21 08:03:23 -0500 ANMOUS20 (null) MESSAGE Starting protection
2013/08/21 08:03:23 -0500 ANMOUS20 (null) MESSAGE Protection started successfully
2013/08/21 08:03:23 -0500 ANMOUS20 (null) MESSAGE Starting IP protection
2013/08/21 08:03:25 -0500 ANMOUS20 (null) MESSAGE IP Protection started successfully
2013/08/21 08:06:43 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54112, Process: explorer.exe)
2013/08/21 08:06:43 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54114, Process: explorer.exe)
2013/08/21 08:06:51 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54155, Process: explorer.exe)
2013/08/21 08:06:51 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54156, Process: explorer.exe)
2013/08/21 08:06:59 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54157, Process: explorer.exe)
2013/08/21 08:06:59 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54158, Process: explorer.exe)
2013/08/21 08:07:15 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54161, Process: explorer.exe)
2013/08/21 08:07:15 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54163, Process: explorer.exe)
2013/08/21 08:07:15 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54165, Process: explorer.exe)
2013/08/21 08:07:15 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54167, Process: explorer.exe)
2013/08/21 08:07:15 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54168, Process: explorer.exe)
2013/08/21 08:07:15 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54172, Process: explorer.exe)
2013/08/21 08:07:23 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54174, Process: explorer.exe)
2013/08/21 08:07:23 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54173, Process: explorer.exe)
2013/08/21 08:07:23 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54175, Process: explorer.exe)
2013/08/21 08:07:23 -0500 ANMOUS20 anmous IP-BLOCK 95.211.194.79 (Type: outgoing, Port: 54176, Process: ex

 

 

 

 



BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 32,748 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:09:34 AM

Posted 21 August 2013 - 12:39 PM

Malwarebytes Anti-Malware Malicious Website Blocking (IP Protection) is part of the Protection Module in the Pro version and works after it is enabled. When attempting to go to a potential malicious website, Malwarebytes will block the attempt and provide an alert. Notification that an IP address has been blocked does not necessarily mean the computer is infected. Some legitimate programs on your computer (i.e. iTunes, Instant Messenger client, P2P programs, web browsers)) have access to the Internet and that action can trigger an IP alert if it tried to access a malicious IP address. These events are stored in the "protection-log". Your firewall should be able to give you a list of such programs so you can confirm if they are legitimate. IP Protection is also designed to block incoming connections it determines to be malicious. Botnets and Zombie computers scour the net, randomly scanning a block of IP addresses, searching for vulnerable ports - commonly probed ports and make repeated attempts to access them. Hackers use "port scanning", a popular reconnaissance technique, to search for vulnerable computers with open ports using IP addresses or a group of random IP address ranges so they can break in and install malicious programs. Malwarebytes is doing its job by blocking this kind of traffic and alerting you about these intrusion attempts and the events are stored in the "protection-log".

More information about IP Protection can be found in the Malwarebytes Anti-Malware Malicious Website Blocking FAQs.

If you are using peer-to-peer (P2P) file sharing programs (i.e. Limewire, eMule, Kontiki, BitTorrent, uTorrent, BitLord, BitLord, BearShare, Azureus/Vuze, etc) or an Instant messaging (IM) client, be aware they can trigger Malicious Website Blocking alerts. Why? P2P programs are a security risk which can make your system susceptible to a smörgåsbord of malware infections and remote attacks. Malwarebytes IP Protection will block access to some of the peers a P2P client attempts connection to because they are classified or detected as malicious. Even the safest P2P file sharing programs that do not contain bundled spyware, still expose you to risks because of the very nature of the P2P file sharing process. By default, most P2P file sharing programs are configured to automatically launch at startup and to allow other P2P users on the same network open access to a shared directory on your computer.

Since you already ran Combofix, its log should be thoroughly reviewed by trained experts in order to ascertain what was detected/removed. A log should have been created and saved to the root directory, usually C:\ComboFix.txt.

Please follow the instructions in the Preparation Guide For Requesting Help starting at Step 6.
When you have done that, start a new topic and post the required logs to include your ComboFix log in the Virus, Trojan, Spyware, and Malware Removal Logs forum, NOT here, for assistance by the Malware Response Team Experts. After doing this, please reply back in this thread with a link to the new topic so we can closed this one.

After doing this, it would be helpful if you replied back in this thread with a link to the new topic so we can closed this one. Good luck and be patient.
Microsoft MVP - Consumer Security 2007-2014 MVP.gif

Member of UNITE, Unified Network of Instructors and Trusted Eliminators

#3 rotor123

rotor123

  • Moderator
  • 7,650 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:New Jersey
  • Local time:09:34 AM

Posted 03 September 2013 - 11:43 AM

http://www.bleepingcomputer.com/forums/t/506562/google-redirect/ was in General Security, I moved it to the AII forum

Roger


Fortune Cookie says: Fortune not Found: Abort, Retry, Ignore?

Sent from my All-In-One Desktop. Perfect for Internet, Not for heavy usage or gaming however.

How Does a computer get Infected? http://www.bleepingcomputer.com/forums/t/2520/how-did-i-get-infected/
Forum Rules,    The BC Welcome Guide

111 @ October 19





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users