Malwarebytes frequent outbound connections blocked

Thread replies: 6
Thread images: 1

Anonymous
Malwarebytes frequent outbound connections blocked 2017-07-26 09:51:51 Post No. 353481
[Report] Image search: [Google]

File: malwarebytes capture.png (38KB, 886x615px) Image search: [Google]

38KB, 886x615px

Malwarebytes frequent outbound connections blocked Anonymous 2017-07-26 09:51:51 Post No. 353481 [Report]

Every day I get notices from Malwarebytes telling me an outbound connection was blocked. It's always the same two urls. tradeexchange(.)com and popcash(.)net.

Any idea what the cause is?

Prior to installing Malwarebytes, Norton Security Suite was telling me "intrusion attempt prevented" almost every day. I ran the entire malware removal guide from Reddit's /r/techsupport sub which included installing Malwarebytes. Norton has been quiet since then but now Malwarebytes is the one constantly blocking stuff.

What's up?

Anonymous 2017-07-26 10:58:23 Post No.353514
[Report]

Anonymous 2017-07-26 10:58:23 Post No.353514 [Report]

>>353481
Gee, maybe your web browser?

What do you think happens to the witchfinder that doesn't find any witches? What incentive does Malwarebytes have to not exaggerate non-issues so they look big and scary?

Anonymous 2017-07-26 11:48:31 Post No.353557
[Report]

Anonymous 2017-07-26 11:48:31 Post No.353557 [Report]

>>353514
If it was just an occasional thing I might believe they were false positives but this happens literally every day.

Anonymous 2017-07-27 02:04:27 Post No.353623
[Report]

Anonymous 2017-07-27 02:04:27 Post No.353623 [Report]

>>353481
>>353514
>Gee, maybe your web browser?

Why don't you use "netstat -a -o" from a command prompt, or ProcessExplorer to see what process is opening the socket?

TCP 192.168.0.103:54819 104.16.62.249:http ESTABLISHED 1592

PID 1593 is chrome.exe, and 104.16.*.* is 4chan.org.

Anonymous 2017-07-27 02:38:05 Post No.353631
[Report]

Anonymous 2017-07-27 02:38:05 Post No.353631 [Report]

>>353623
I just tried the command and I have no idea how to make sense of the results. What should I be looking for?

Anonymous 2017-07-27 06:16:14 Post No.353709
[Report]

Anonymous 2017-07-27 06:16:14 Post No.353709 [Report]

>>353631
You're looking for an IP address in the same subnet as the website:

>ping -a thetradexchange.com

Pinging thetradexchange(.)com [104.27.129.67] with 32 bytes of data:
Reply from 104.27.129.67: bytes=32 time=14ms TTL=58

(I mistyped the URL, your target doesn't respond to pings.)

Odds are it is your browser. If you really, really don't want it talking to that website you can block it at your router or make malwarebytes do it for you.

I'm aware that Imgur.com will stop allowing adult images since 15th of May. I'm taking actions to backup as much data as possible. Read more on this topic here - https://archived.moe/talk/thread/1694/

I'm aware that Imgur.com will stop allowing adult images since 15th of May. I'm taking actions to backup as much data as possible.
Read more on this topic here - https://archived.moe/talk/thread/1694/