Need to know how to block I.P. addresses from my computer

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Zorkman, May 15, 2007.

  1. Zorkman

    Zorkman Private E-2

    Hello, again,
    For a while now, I've been having trouble with one particular I.P. address. I don't know who, or what, it is, but every time I allow Application: SVCHost.exe to access the internet, the I.P. 80.67.74.225:http starts pinging (or something) my machine. I have no idea who/what it is, and would like to know how to block that particular I.P. address. (I think it may be malware, but I've done all the scans I can think of... and there's nothing.) Any advice/Help would be appreciated. Especially if you think you know what this is.
    Found another one that could possibly be causing the problem. 5.0.0.1: DCHP
    The data above was taken from Zonealarm's firewall.
    thanks in advance,


    -Z.
     
    Last edited: May 15, 2007
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You really should follow our standard cleaning procedures so we can determine if you have any malware on your PC. Who is your ISP? Does your IP addess from your ISP begin with 80? Do you have a router installed?

    Please follow the below steps which are necessary for us to provide you support. Also there are steps included for installing, renaming, running, and posting HijackThis logs as attachments.
    • Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
    • Make sure you check version numbers and get all updates.
    • Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.
    • After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:
    Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around.
    • When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:
      • CounterSpy - only for Windows XP, 2K, & NT users
      • AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy. - only for Windows XP, 2K, & NT users
      • Bitdefender - from step 6
      • Panda Scan - from step 6
      • runkeys.txt - the log from GetRunKey.bat
      • newfiles.txt - the log from ShowNew.bat
      • HijackThis
    NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!
     
  3. Zorkman

    Zorkman Private E-2

    Okay, I've done all of the scans except for the ones I cannot(Online scans), and the one I have to download (Counterspy).
    I cannot do any of the online scans due to my incredibly slow internet (3.2 Kb/s, on a good day. With the solar wind behind me.)
    I do not know who my ISP is, but I do know that their I.P. is no where near the 80 region. I have a router installed, but this consumption of resources has never occurred before, so my guess is that it has nothing to do with that.
    Tomorrow I'll give you the Counterspy scan.
     

    Attached Files:

  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You are not using the current version of the READ ME. You logs from GetRunKey and ShowNew reveal that you are WAY OUT OF DATE. Get the proper versions and attach new logs. You must always make sure you use the online READ ME steps and check for proper versions of tools.

    I'm not seeing any problems based on what you have attached thus far.

    Click Start, Run and enter ipconfig /all > c:\ipinfo.txt and click OK!

    Then attach the c:\ipinfo.txt file that was created here.

    Did you create the below policies yourself?

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
    "NoRecentDocsMenu"=dword:00000001
    "NoRecentDocsHistory"=dword:00000001
    "ClearRecentDocsOnExit"=dword:00000001
    "NoUserNameInStartMenu"=dword:00000001
    "NoSharedDocuments"=dword:00000001

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
    "NoRecentDocsMenu"=dword:00000001
    "NoRecentDocsHistory"=dword:00000001

    You need to update your Sun Java version as requested in step 6. The below steps explain what to do. You can do this when you internet speed is no longer a problem.
    Uninstall the below old versions of software:
    J2SE Runtime Environment 5.0 Update 6

    Make sure you reboot after uninstalling the above!

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment
     
  5. Zorkman

    Zorkman Private E-2

    Apologies about taking so long, Counterspy is being stubborn about updating (though I did run a scan, and it came back with two results, Beast and a adware downloading program.) After I ran Counterspy, I couldn't find a log that was described in the READ ME.
    I'll try and download the newest Java ASAP, but that might be delayed a week or two.
    I'll try updating Counterspy again as soon as the new Starcraft 2 Cinematic Trailer finishes downloading.
    Also, here is the IP log that you wanted. Is there anything else that you wanted me to update/run/find?Edit
    Edit: By the way, those security policies are all mine, so no reason for alarm there.
     

    Attached Files:

  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You did not follow the instructions in my last message. The first thing I said was:
    Question: How is it that you do not know who provides your internet service?

    The IP address you gave in your first message is owned by the following company: http://www.akamai.com/
    Also see: http://en.wikipedia.org/wiki/Akamai_Technologies

    I would expect that they are involved in your internet service.

    CounterSpy does not create the log on its own. You need to create the log as described in the READ ME. I would still like to see a log if it is detecting anything.

    I'll try and download the newest Java ASAP, but that might be delayed a week or two.[/quote]The longer you wait, the more susceptible you are to infections. The old version have security issues that Vundo infections use to infect your PC.

    There are two Ethernet interfaces in there. I assume you are using the second one with the 192.168.0.61 address. Is that correct? Why is it set for a static IP address rather than using DHCP? Are you using a router or is this directly connected to a cable or DSL modem?

    Please attach a log from ZoneAlarm.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds