Infected? Please Help

[john14907]

Hello my Malwarebytes has blocked some ip's over the past few days and as far as i know its nothing to dowith me.

Can anyone tell me what could be causing this and how to fix it please?

ip's and whois report... (sorry its so long)

69.89.31.242

IP Location: United States Provo Bluehost Inc
Resolve Host: box442.bluehost.com
IP Address: 69.89.31.242
SSL Cert: *.bluehost.com expires in 12 days.
Reverse IP: 2,097 other sites hosted on this server.
Blacklist Status: Clear

OrgName: Bluehost Inc.
OrgID: BLUEH-2
Address: 1958 South 950 East
City: Provo
StateProv: UT
PostalCode: 84606
Country: US

NetRange: 69.89.16.0 - 69.89.31.255
CIDR: 69.89.16.0/20
OriginAS: AS11798
NetName: BLUEHOST-NETWORK-1
NetHandle: NET-69-89-16-0-1
Parent: NET-69-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.BLUEHOST.COM
NameServer: NS2.BLUEHOST.COM
Comment:
RegDate: 2006-10-02
Updated: 2007-11-02

RAbuseHandle: NOC2320-ARIN
RAbuseName: Network Operations Center
RAbusePhone: +1-801-765-9400
RAbuseEmail:

RNOCHandle: TECHN497-ARIN
RNOCName: Technical Operations
RNOCPhone: +1-801-765-9400
RNOCEmail:

RTechHandle: NETWO2081-ARIN
RTechName: Network Operations
RTechPhone: +1-801-765-9400
RTechEmail:

OrgTechHandle: SAL72-ARIN
OrgTechName: Alligood, Steve
OrgTechPhone: +1-801-765-9400
OrgTechEmail:

78.159.98.216

IP Location: Germany Netdirekt E.k
Resolve Host: ice.flamebox.org
IP Address: 78.159.98.216
Blacklist Status: Clear

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: P.O. Box 10096
City: Amsterdam
StateProv:
PostalCode: 1001EB
Country: NL

ReferralServer: whois://whois.ripe.net:43

NetRange: 78.0.0.0 - 78.255.255.255
CIDR: 78.0.0.0/8
NetName: 78-RIPE
NetHandle: NET-78-0-0-0-1
Parent:
NetType: Allocated to RIPE NCC
NameServer: NS-PRI.RIPE.NET
NameServer: SEC1.APNIC.NET
NameServer: SEC3.APNIC.NET
NameServer: TINNIE.ARIN.NET
NameServer: SUNIC.SUNET.SE
NameServer: NS2.LACNIC.NET
Comment: These addresses have been further assigned to users in
Comment: the RIPE NCC region. Contact information can be found in
Comment: the RIPE database at http://www.ripe.net/whois
RegDate: 2006-08-29
Updated: 2009-05-18

== Additional Information From whois://whois.ripe.net:43 ==

inetnum: 78.159.96.0 - 78.159.103.255
netname: NETDIRECT-NET
descr: netdirekt e.K.
remarks: INFRA-AW
country: DE
admin-c: WW200-RIPE
tech-c: SR614-RIPE
status: ASSIGNED PA
mnt-by: NETDIRECT-MNT
mnt-lower: NETDIRECT-MNT
mnt-routes: NETDIRECT-MNT
source: RIPE # Filtered

person: Wiethold Wagner
address: netdirekt e. K.
address: Kleyer Strasse 79 / Tor 14
address: 60326 Frankfurt
address: DE
phone: +49 69 90556880
fax-no: +49 69 905568822
e-mail:
nic-hdl: WW200-RIPE
mnt-by: NETDIRECT-MNT
source: RIPE # Filtered

person: Simon Roehl
address: netdirekt e. K.
address: Kleyer Strasse 79 /Tor 14
address: 60326 Frankfurt
address: DE
phone: +49 69 90556880
fax-no: +49 69 905568822
e-mail:
nic-hdl: SR614-RIPE
mnt-by: NETDIRECT-MNT
source: RIPE # Filtered

route: 78.159.96.0/19
descr: ORG-nA8-RIPE
origin: AS28753
org: ORG-nA8-RIPE
mnt-lower: NETDIRECT-MNT
mnt-routes: NETDIRECT-MNT
mnt-by: NETDIRECT-MNT
source: RIPE # Filtered

organisation: ORG-nA8-RIPE
org-name: netdirect
org-type: LIR
address: netdirekt e. K.
Kleyer Strasse 79 / Tor 14
60326 Frankfurt
Germany
phone: +49 69 90556880
fax-no: +49 69 905568822
e-mail:
admin-c: SR614-RIPE
admin-c: WW200-RIPE
mnt-ref: NETDIRECT-MNT
mnt-ref: RIPE-NCC-HM-MNT
mnt-by: RIPE-NCC-HM-MNT
source: RIPE # Filtered

67.215.233.130

IP Location: United States Santa Ana Secured Private Network
Resolve Host: http://www.utorrent.com
IP Address: 67.215.233.130
Reverse IP: 3 other sites hosted on this server.
Blacklist Status: Clear

OrgName: Secured Private Network
OrgID: SPNW
Address: 1740 East Garry Ave.
Address: Suite 234
City: Santa Ana
StateProv: CA
PostalCode: 92705
Country: US

NetRange: 67.215.224.0 - 67.215.255.255
CIDR: 67.215.224.0/19
OriginAS: AS22298
NetName: SPN3W
NetHandle: NET-67-215-224-0-1
Parent: NET-67-0-0-0-0
NetType: Direct Allocation
NameServer: NS1.SECUREDPRIVATENETWORK.NET
NameServer: NS2.SECUREDPRIVATENETWORK.NET
Comment:
RegDate: 2007-10-18
Updated: 2008-10-08

RAbuseHandle: HOSTM519-ARIN
RAbuseName: Network Operations
RAbusePhone: +1-877-434-2378
RAbuseEmail:

RNOCHandle: HOSTM519-ARIN
RNOCName: Network Operations
RNOCPhone: +1-877-434-2378
RNOCEmail:

RTechHandle: HOSTM519-ARIN
RTechName: Network Operations
RTechPhone: +1-877-434-2378
RTechEmail:

OrgNOCHandle: HOSTM519-ARIN
OrgNOCName: Network Operations
OrgNOCPhone: +1-877-434-2378
OrgNOCEmail:

OrgTechHandle: HOSTM519-ARIN
OrgTechName: Network Operations
OrgTechPhone: +1-877-434-2378
OrgTechEmail:

74.205.26.220

IP Location: United Kingdom Info.com
IP Address: 74.205.26.220
Reverse IP: 3 other sites hosted on this server.
Blacklist Status: Clear

OrgName: Rackspace.com, Ltd.
OrgID: RSPC
Address: 9725 Datapoint Drive
Address: Suite 100
City: San Antonio
StateProv: TX
PostalCode: 78229
Country: US

NetRange: 74.205.0.0 - 74.205.127.255
CIDR: 74.205.0.0/17
NetName: RSCP-NET-4
NetHandle: NET-74-205-0-0-1
Parent: NET-74-0-0-0-0
NetType: Direct Allocation
NameServer: NS.RACKSPACE.COM
NameServer: NS2.RACKSPACE.COM
Comment:
RegDate: 2006-11-20
Updated: 2007-03-13

RAbuseHandle: ABUSE45-ARIN
RAbuseName: Abuse Desk
RAbusePhone: +1-210-892-4000
RAbuseEmail:

RTechHandle: IPADM17-ARIN
RTechName: IPADMIN
RTechPhone: +1-210-892-4000
RTechEmail:

OrgAbuseHandle: ABUSE45-ARIN
OrgAbuseName: Abuse Desk
OrgAbusePhone: +1-210-892-4000
OrgAbuseEmail:

OrgTechHandle: IPADM17-ARIN
OrgTechName: IPADMIN
OrgTechPhone: +1-210-892-4000
OrgTechEmail:

OrgTechHandle: ZR9-ARIN
OrgTechName: Rackspace, com
OrgTechPhone: +1-210-892-4000
OrgTechEmail:

CustName: Info.com
Address: 170-172 Victoria Street
Address: Westminster
City: London
StateProv: GREATER LONDON
PostalCode: SW1E 5LB
Country: GB
RegDate: 2008-10-06
Updated: 2008-10-06

NetRange: 74.205.26.216 - 74.205.26.223
CIDR: 74.205.26.216/29
NetName: RSPC-1223305088481065
NetHandle: NET-74-205-26-216-1
Parent: NET-74-205-0-0-1
NetType: Reassigned
Comment:
RegDate: 2008-10-06
Updated: 2008-10-06

RAbuseHandle: ABUSE45-ARIN
RAbuseName: Abuse Desk
RAbusePhone: +1-210-892-4000
RAbuseEmail:

RTechHandle: IPADM17-ARIN
RTechName: IPADMIN
RTechPhone: +1-210-892-4000
RTechEmail:

OrgAbuseHandle: ABUSE45-ARIN
OrgAbuseName: Abuse Desk
OrgAbusePhone: +1-210-892-4000
OrgAbuseEmail:

OrgTechHandle: IPADM17-ARIN
OrgTechName: IPADMIN
OrgTechPhone: +1-210-892-4000
OrgTechEmail:

OrgTechHandle: ZR9-ARIN
OrgTechName: Rackspace, com
OrgTechPhone: +1-210-892-4000
OrgTechEmail:

218.7.43.199

IP Location: China Harbin Harbin-engineering-university
IP Address: 218.7.43.199
Blacklist Status: Clear

inetnum: 218.7.43.0 - 218.7.43.255
netname: HARBIN-ENGINEERING-UNIVERSITY-1
descr: Harbin Engineering University 1
country: CN
admin-c: BG63-AP
tech-c: BG63-AP
changed: 20030610
mnt-by: MAINT-CNCGROUP-HL
status: ASSIGNED NON-PORTABLE
source: APNIC

route: 218.7.0.0/16
descr: CNC Group CHINA169 Heilongjiang Province Network
country: CN
origin: AS4837
mnt-by: MAINT-CNCGROUP-RR
changed: 20060118
source: APNIC

person: Binghui Gao
nic-hdl: BG63-AP
e-mail:
address: Communication Corporation Internet Enterprise Division of HLJ
phone: +86-451-2804465
fax-no: +86-451-2804442
country: CN
changed: 20030221
mnt-by: MAINT-CNCGROUP-HL
source: APNIC

[Mozz]

Uninstall Malwarebytes, Reset modem + Router - Do a system restore in safe mode - Boot up as normal - Re-install Malwarebytes.

[ranged]

Hello, mozz not everyone knows the exact way to do every one of those steps. It would be best if you would provide detailed instructions on each step. If not, tomorrow when I have access to a computer I will get back with detailed instructions. Thanks!

[Omniscient]

Exactly what's the concern? So MWB has blocked a few IPs at Bluehost. If you think they're false positives contact MWB.

[--([-S7N-])--]

What Omniscient said is true. MalwareBytes' blocking suspicious IP should be a good thing. If you think you are infected, run a Full Scan with Malwarebytes'.

[Sp33D™]

Yes , what omni said is correct .

[SniperRiflezzzz]

If you think your infected post a HJT log here.
We can analyze it on here.

[.D0T']

MalwareBytes has a tendancy to block lots of IP's, a fair amount being false positives. Do as Omniscient has recommended, and report the false positive IP's if you believe they are false.

However, if you believe you are infected, I suggest you run an MalwareBytes full scan.

[nitinrox]

i dont think so.....u are not...

[Support]

Turn off every program that normally connects with the internet. Examples are torrent clients, MSN, steam etc. and then open up CMD and type in "netstat -n" then post a picture of the result. If you face problem while doing this in Vista, please run CMD as administrator.

Thanks,
Pi[X]eL