Results 1 to 6 of 6
  1. #1
    3 Star Lounger
    Join Date
    Dec 2009
    Location
    Edinburgh, UK
    Posts
    237
    Thanks
    24
    Thanked 50 Times in 22 Posts

    Are my computers "phoning home" to Amazon each morning?

    I have started to notice a pattern where, each morning, when I waken my computers from overnight sleep, Malwarebytes Antimalware PRO reports that it has blocked an attempt to access cetain IP addresses.

    Today's were these three:
    54.240.166.215
    54.240.166.123
    54.240.166.191

    Within the last few days, my MBAM logs also record several others:
    54.240.166.23
    54.240.166.243
    54.240.166.235

    Having observed the pattern, I did an ARIN lookup on these IP addresses; would you believe that they all belong to Amazon Technologies?

    I keep myself patched up-to-date, and scan regularly with MBAM and MSE, none of which reports any infections.

    Why should something on my machine want to "phone home" to Amazon? Or is there a perfectly innocent explanation?

  2. #2
    Administrator
    Join Date
    Mar 2001
    Location
    St Louis, Missouri, USA
    Posts
    23,572
    Thanks
    5
    Thanked 1,057 Times in 926 Posts
    Could be good or bad. Have you checked Scheduled Tasks and what is started when you boot the PC? Use a tool such as Autoruns or WhatInStartup to manage startup programs. You should run full malware scans using your favorite tools.


    Joe

  3. #3
    Administrator
    Join Date
    Jun 2010
    Location
    Portugal
    Posts
    12,519
    Thanks
    152
    Thanked 1,398 Times in 1,221 Posts
    The IPs really belong to domains owned by amazon.com. Do you have any amazon apps (kindle for pc, for example)?
    Rui
    -------
    R4

  4. #4
    3 Star Lounger
    Join Date
    Dec 2009
    Location
    Edinburgh, UK
    Posts
    237
    Thanks
    24
    Thanked 50 Times in 22 Posts
    Thank you to both who posted in reply.

    I looked around Scheduled Tasks, nothing had crept in without my say-so. No Amazon apps on either of the PCs in question. I do scan quite regularly, with MBAM and MSE.

    And, would you believe it, almost as if it knew I was watching (!), nothing happened this morning. Is it a false positive from MBAM?

    Close the thread! Thanks.

  5. #5
    Silver Lounger Banyarola's Avatar
    Join Date
    Dec 2009
    Location
    Big Indian, New York
    Posts
    1,900
    Thanks
    19
    Thanked 65 Times in 54 Posts
    Before booting I would disconnect my internet connection and then boot to see if I got a message saying something couldn't connect to the internet and you may see what it is that's trying to connect.
    "If You Are Reading This In English, Thank A VET"

  6. #6
    5 Star Lounger
    Join Date
    Mar 2010
    Location
    east coast
    Posts
    701
    Thanks
    89
    Thanked 8 Times in 8 Posts
    i have had some normal programs hijacked to phone home
    but only to some scumware sight

    my printer driver phones home all the time - bad design

    my email program tried to do it - blocked - trojan removed

    for a while microsoft stuff phoned home all the time
    that seems to have stopped

    some stray dlls and other programs - hijacked - trojan removed

    if mbam does not catch it then i suspect it is something amazon put on your pc to collect info about you
    or someone has hijacked soem amazon sites to use for their own purposes

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •