malware using avast.exe

[reef-geeks]

Hey everyone, had an account here before but can seem to remember user name.

Anyway, twice today while surfing, my malwarebytes blocked outgoing calls from avast.exe. I dont have any more info right now, ill add to this post as i get it.

[reef-geeks]

Malwarebytes log

2012/06/22 00:56:41 -0400   CHRIS-PC   Chris   IP-BLOCK   222.186.49.240 (Type: outgoing, Port: 52921, Process: avastsvc.exe) (Type: outgoing, Port: 50079, Process: avastsvc.exe)
2012/06/22 21:34:32 -0400   CHRIS-PC   Chris   IP-BLOCK   94.100.23.90 (Type: outgoing, Port: 50103, Process: avastsvc.exe)
2012/06/23 10:30:16 -0400   CHRIS-PC   Chris   IP-BLOCK   89.248.174.55 (Type: outgoing, Port: 65136, Process: avastsvc.exe)

[DavidR]

What you don't understand is how avast in itself works to protect your system. There is nothing using avast.exe (aside from your post doesn't even show avast.exe being used) the avastSvc.exe controls the avast scanners and in this case it is the Web Shield, localhost proxy through which http traffic is routed so that it can be scanned by the web shield.

So it is your browsing (via the web shield proxy) reaching out to an IP that MBAM considers malicious. This can be from links to content on another site that you happen to be browsing.

[reef-geeks]

Okey-dokey  hadn't seen that before and thought it was strange

[DavidR]

No problem.