Someone recently posted about Avast stopping an attack from the address 22.214.171.124. Avast will catch the site as having a virus on it - which it does in 126.96.36.199/pldr/test.jpg. In order to determine if Avast is doing a 10 minute check (yes, it happens every 10 minutes), I disabled Avast and simply watched my firewall (I have the entire range 188.8.131.52-184.108.40.206 blocked - since they are all the same owner). Sure enough, my firewall is continuing to block access to this site every 10 minutes! The virus on the site is Vitumonde. I did get this virus last week and was successful in getting rid of "most" of it. However, I think I may still have some remnant of it since my computer is attempting to connect to 220.127.116.11 every 10 minutes. What would cause svhost.exe to try to connect to 18.104.22.168 every 10 minutes?
By the way, all scans I have done (Avast and MBAM) show I am virus clean and with my firewall blocking access to the offending site, I feel pretty secure. The attempted access to 22.214.171.124 is still disturbing me though. Any thought on what could cause this?
Edited by Orange Blossom, 22 February 2010 - 03:10 PM.
Move to AII. ~ OB