Someone recently posted about Avast stopping an attack from the address 220.127.116.11. Avast will catch the site as having a virus on it - which it does in 18.104.22.168/pldr/test.jpg. In order to determine if Avast is doing a 10 minute check (yes, it happens every 10 minutes), I disabled Avast and simply watched my firewall (I have the entire range 22.214.171.124-126.96.36.199 blocked - since they are all the same owner). Sure enough, my firewall is continuing to block access to this site every 10 minutes! The virus on the site is Vitumonde. I did get this virus last week and was successful in getting rid of "most" of it. However, I think I may still have some remnant of it since my computer is attempting to connect to 188.8.131.52 every 10 minutes. What would cause svhost.exe to try to connect to 184.108.40.206 every 10 minutes?
By the way, all scans I have done (Avast and MBAM) show I am virus clean and with my firewall blocking access to the offending site, I feel pretty secure. The attempted access to 220.127.116.11 is still disturbing me though. Any thought on what could cause this?
Edited by Orange Blossom, 22 February 2010 - 03:10 PM.
Move to AII. ~ OB