This IP gets blocked every single day...

[alekso]

Hello, i have been using malwarebyes and norton for a long time. For many days now this ip have been getting blocked (loggs):

2012/12/25 15:47:24 +0100 ALEKSANDER-PC Aleksander MESSAGE Starting protection

2012/12/25 15:47:24 +0100 ALEKSANDER-PC Aleksander MESSAGE Protection started successfully

2012/12/25 15:47:24 +0100 ALEKSANDER-PC Aleksander MESSAGE Starting IP protection

2012/12/25 15:47:26 +0100 ALEKSANDER-PC Aleksander MESSAGE IP Protection started successfully

2012/12/25 16:02:31 +0100 ALEKSANDER-PC Aleksander IP-BLOCK 82.208.40.8 (Type: outgoing, Port: 49818, Process: ccsvchst.exe)

2012/12/25 16:19:11 +0100 ALEKSANDER-PC Aleksander IP-BLOCK 82.208.40.8 (Type: outgoing, Port: 50263, Process: ccsvchst.exe)

2012/12/25 16:26:34 +0100 ALEKSANDER-PC Aleksander IP-BLOCK 82.208.40.8 (Type: outgoing, Port: 50639, Process: ccsvchst.exe)

Anoyone have any idea what the ip "82.208.40.8" is used for and why its outgoing? i have done a full scan with malwarebytes and norton whitout any results.. (except tracking cookies).apperantly the ip is known as many things "ns1.dns-domainserver.com --> mx2.dns-domainserver.com --> 82.208.40.8". Its not blacklisted anywhere so i do not even know why malwarebytes has it blacklsited?

[orubio]

Hello alekso and welcome to the Malwarebytes support forum. Thank you for choosing Malwarebytes' Anti-Malware as your malware security solution, my name is Oscar Rubio and I'll be assisting you today.

Please see the information here - Available Assistance

[alekso]

It appears that "82.208.40.8" is a norton update server, WOW they use suspicious servers with a strange rdns record "ns1.dns-domainserver.com ", anyone that can tell me why malwarebytes blocks this IP? its not listed in hpHosts http://hosts-file.net/default.asp?s=82.208.40.8 and is definitly not malware.

[orubio]

Hello alekso,

Please visit our false positive forum and post the address.

A member of our research team can better look into the IP block.

Thank you and happy holidays.

[alekso]

I have reason to belive the server is not a norton update server, as stated by their support "We are not able to verify thats a norton server just by looking at the IP"

I tried to check the certificate of the norton program (ccsvchst.exe) its valid... however i tested another program i know the certificate is expired on for two years ago, thats too valid? maybe im wrong, but i do not think the computer should count it as valid when its 2 year after it has expired.

Maybe the norton framework is infected and the virus has hidden itself by making all invalid certificates valid?

i do not see any indication that i am infected, nor do i see anything when i scan... this is all just strange.

Heres a pic or the "expired" certificate: http://i.imgur.com/VqIa2.png

(sorry for it not being in english, no easy way to change Windows language)

[AdvancedSetup]

Well it certainly does not have an obvious Norton system linked to it or an obvious Content Delivery Network

IP address: 82.208.40.8

Host name: mx2.dns-domainserver.com

Alias: ns2.dns-domainserver.com

82.208.40.8 is from Czech Republic(CZ) in region Eastern Europe

Netcom Limited

CZ

Casablanca INT

Vinohradska 184, Prague 3 - 130 52

I would follow the advice to either have one of the Experts assist you in the HJT forum or open a ticket on the Help Desk and have someone there assist you.

Thank you.