I was scammed and I thought those scammers were really from Microsoft so I let them remotely connected to my computer. I don’t know what they installed on it.
After I realized that it was a scam, I reset my computer, cleaned all the drives and reinstalled Windows 10. I thought whatever virus I had should have gone away.
But I typed in “netstat -ano” in command prompt, and I still see this:
TCP 192.168.1.9:49793 184.108.40.206:443 ESTABLISHED 6752
I looked up the PID in Task Manager, it is DiagTrack service which is like a key logger right? And the IP that’s connected to it: 220.127.116.11 has been reported 8 times in AbuseIpDb.com.
I don’t know why after I totally reset my computer, this IP is still connected to me.
I thought about blocking this IP by modifying host file.
nslookup 18.104.22.168 but couldn’t find the hostname for this ip.
Server: NF4V.Home Address: 192.168.1.1 *** NF4V.Home can't find 22.214.171.124: Non-existent domain
Is there anyway I can block this IP from connecting to my computer?
Is there anyway I can block this IP from my router?