MBAM blocking inbound connection to port 3389

My computer is not infected, but Malwarebytes Anti Malware Pro keeps reporting the following inbound attempts

Detection, 07/21/2015 11:11 AM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,

Port 3389 is one of the Remote Desktop ports, 3390 is another.

Anyone else seeing anything like this? I don't have RDT enabled.

 

Malwarebytes Anti-Malware
www.malwarebytes.org


Protection, 07/21/2015 10:52 AM, SYSTEM, DESKTOP, Protection, Malware Protection, Starting,
Protection, 07/21/2015 10:52 AM, SYSTEM, DESKTOP, Protection, Malware Protection, Started,
Protection, 07/21/2015 10:52 AM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Starting,
Protection, 07/21/2015 10:53 AM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Started,
Detection, 07/21/2015 11:11 AM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 11:11 AM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 11:11 AM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 11:11 AM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Update, 07/21/2015 11:44 AM, SYSTEM, DESKTOP, Scheduler, Malware Database, 2015.7.20.8, 2015.7.21.4,
Protection, 07/21/2015 11:44 AM, SYSTEM, DESKTOP, Protection, Refresh, Starting,
Protection, 07/21/2015 11:44 AM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Stopping,
Protection, 07/21/2015 11:44 AM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Stopped,
Protection, 07/21/2015 11:44 AM, SYSTEM, DESKTOP, Protection, Refresh, Success,
Protection, 07/21/2015 11:44 AM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Starting,
Protection, 07/21/2015 11:44 AM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Started,
Update, 07/21/2015 12:33 PM, SYSTEM, DESKTOP, Scheduler, Malware Database, 2015.7.21.4, 2015.7.21.5,
Protection, 07/21/2015 12:33 PM, SYSTEM, DESKTOP, Protection, Refresh, Starting,
Protection, 07/21/2015 12:33 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Stopping,
Protection, 07/21/2015 12:33 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Stopped,
Protection, 07/21/2015 12:33 PM, SYSTEM, DESKTOP, Protection, Refresh, Success,
Protection, 07/21/2015 12:33 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Starting,
Protection, 07/21/2015 12:33 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Started,
Detection, 07/21/2015 1:31 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 1:31 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 1:31 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 2:27 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 93.174.93.65, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 2:27 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 93.174.93.65, 3389, Inbound, C:\Windows\System32\svchost.exe,
Update, 07/21/2015 2:43 PM, SYSTEM, DESKTOP, Scheduler, Malware Database, 2015.7.21.5, 2015.7.21.6,
Protection, 07/21/2015 2:43 PM, SYSTEM, DESKTOP, Protection, Refresh, Starting,
Protection, 07/21/2015 2:43 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Stopping,
Protection, 07/21/2015 2:43 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Stopped,
Protection, 07/21/2015 2:43 PM, SYSTEM, DESKTOP, Protection, Refresh, Success,
Protection, 07/21/2015 2:43 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Starting,
Protection, 07/21/2015 2:43 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Started,
Scan, 07/21/2015 2:49 PM, SYSTEM, DESKTOP, Context, Start:07/21/2015 2:43 PM, Duration:6 min 13 sec, Threat Scan, Completed, 0 Malware Detections, 0 Non-Malware Detections,
Update, 07/21/2015 3:55 PM, SYSTEM, DESKTOP, Scheduler, Malware Database, 2015.7.21.6, 2015.7.21.7,
Protection, 07/21/2015 3:55 PM, SYSTEM, DESKTOP, Protection, Refresh, Starting,
Protection, 07/21/2015 3:55 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Stopping,
Protection, 07/21/2015 3:55 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Stopped,
Protection, 07/21/2015 3:55 PM, SYSTEM, DESKTOP, Protection, Refresh, Success,
Protection, 07/21/2015 3:55 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Starting,
Protection, 07/21/2015 3:55 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Started,
Detection, 07/21/2015 3:56 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 3:56 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 3:56 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 3:56 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Update, 07/21/2015 5:47 PM, SYSTEM, DESKTOP, Scheduler, Malware Database, 2015.7.21.7, 2015.7.21.8,
Protection, 07/21/2015 5:47 PM, SYSTEM, DESKTOP, Protection, Refresh, Starting,
Protection, 07/21/2015 5:47 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Stopping,
Protection, 07/21/2015 5:47 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Stopped,
Protection, 07/21/2015 5:47 PM, SYSTEM, DESKTOP, Protection, Refresh, Success,
Protection, 07/21/2015 5:47 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Starting,
Protection, 07/21/2015 5:47 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, Started,
Detection, 07/21/2015 6:36 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 6:36 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 6:36 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 6:36 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 9:19 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 9:19 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,
Detection, 07/21/2015 9:19 PM, SYSTEM, DESKTOP, Protection, Malicious Website Protection, IP, 41.203.87.2, 3389, Inbound, C:\Windows\System32\svchost.exe,

(end)

IPLocationTools shows the following:

[external image: IPLocTool_zps8genjgzf.jpg]

Hey Rich

Running Windows 8.1 64 bit, Malwarebytes Pro 2.1.8.1057 , just checked all my Protection logs from the last week or so and dont have anything thats been blocked

That does show "Inbound" so it's not coming from your pc.

Where you at any particular website when that happened?

Make sure MBAM is up to date.

I think I was on either eightforums.com or tenforums.com, but not sure. If it happens again I'll collect more information.

MBAM (and MBAE) are both current. I did a MBAM scan after this and all was clean.