jemorse

Very interesting!!! I was getting the pop-ups on every new page or refresh. After disabling Link Extender, I have not gotten another pop-up for a couple of hours now... Looks like the culprit has been found and neutralized. In checking LinkExtend's site, I found that the most recent upgrade was to 1.0.7 on 12/24/2009 - about the time that I started getting the pop-ups. Also, their Future Development plans include "Blocking dangerous sites and/or showing onscreen warnings". Perhaps when they provide another update, I will try it again. Thanks WartEye!!!

So what if anything can be done to stop getting the notices. Can Firefox be set up to blacklist the IP address so it doesn't get through - or perhaps my router... As WartEye said it gets to be a pain to have the block message every time the page changes in Firefox. If it really is malicious I really don't want to turn off the detection/blocking that MalWareBytes provides. John

Having read this topic through I notice that it stops in October.... I am currently getting MANY notices about 88.214.203.109... I googled that ip address and found that the address apparently belongs to a UK (United Kingdom - NOT Ukraine) company - see this link http://whois.domaintools.com/88.214.203.109 If I exit my browser (Firefox 3.5.3) I do not get the "warnings" even though I still have my email application (Thunderbird) still running. I currently have Malware Anti-Malware 1.44 So, what is the fix --- Other than turning off IP protection...or adding that IP address to the ignore list??? John

What are the is-D452M items??? WinPatrol alerted me that is-D452M.exe was attempting to be added to the startup.... Not having any idea what this might be, I told WinPatrol to deny the addition. Then I searched my hard drive and did find the 3 is-D452M items in my c:\windows folder. The lst file indicates that it is associated with MalwareBytes. So are they legitimate??? And should I let them run??? John