Someone recently posted about Avast stopping an attack from the address 126.96.36.199. Avast will catch the site as having a virus on it - which it does in 188.8.131.52/pldr/test.jpg. In order to determine if Avast is doing a 10 minute check (yes, it happens every 10 minutes), I disabled Avast and simply watched my firewall (I have the entire range 184.108.40.206-220.127.116.11 blocked - since they are all the same owner). Sure enough, my firewall is continuing to block access to this site every 10 minutes! The virus on the site is Vitumonde. I did get this virus last week and was successful in getting rid of "most" of it. However, I think I may still have some remnant of it since my computer is attempting to connect to 18.104.22.168 every 10 minutes. What would cause svhost.exe to try to connect to 22.214.171.124 every 10 minutes?
By the way, all scans I have done (Avast and MBAM) show I am virus clean and with my firewall blocking access to the offending site, I feel pretty secure. The attempted access to 126.96.36.199 is still disturbing me though. Any thought on what could cause this?
Edited by Orange Blossom, 22 February 2010 - 03:10 PM.
Move to AII. ~ OB