50.97.214.162 false?

[John A]

I get this on www.microsoft.com and browsing Microsoft site, two computers. 2013/04/18 06:43:20 +1000 MY-PC Me IP-BLOCK 50.97.214.162 (Type: outgoing, Port: 49699, Process: iexplore.exe)

[AdvancedSetup]

Please check for updates in MBAM and then run a Quick Scan and post back the log.

Thanks

[MysteryFCM]

it's not an F/P, and nothing to do with the Microsoft website. The IP belongs to one of the ads being loaded (specific server involved, has had multiple exploit incidents since the 3rd)

[LadyA]

For the past 5 days or so, I have been getting the same "blocked access to a potentially malicious website: 50.97.214.162" while on a variety of websites, even while just looking at search results in Google or viewing things on eBay, using Flickr, etc (all sorts of sites).

I don't really know much about this stuff... but since MysteryFCM said (in above post) that it's not a false positive, is there anything I need to do to stop it from happening? Or is there any danger here? The last scan I did didn't show any infections. Should I do another and post the log here?

[Coss]

Me too. I started getting warnings about this address, and a number of others linked to this same site.

It's called Softlayer.com just outside of Irving Texas. You can go to their site and see that they are a hosting company for Cloud Apps / Cloud Space

I haven't figured out what add they are linked to, but it is on more that just the MSN site.

[LadyA]

Thank you for the info about the site, Coss. Yeah, it's definitely on a lot of sites it seems... just a few minutes ago I got the same exact "blocked access to: 50.97.214.162" message when viewing a page that doesn't even look like it has ads on it? This site: http://www.worldcat.org/title/spiders-of-japan-with-keys-to-the-families-and-genera-and-illustrations-of-the-species/oclc/780854580 (It's just a service that tells you which libraries have a book you need.) I can't see anything there that would be doing it, unless it's the little Facebook, YouTube, etc, buttons at the bottom right of the page? Wait, well, actually it just dawned on me that I had multiple tabs open at the time, so maybe it was from another page... but the MBAM notification popped up after I'd been viewing the WorldCat website for like 2 minutes.

I did another MBAM scan and it came back clean... which I guess is probably useless information since Malwarebytes is blocking it anyways (so it shouldn't come back as an 'infection' to begin with).

[John A]

Just updated, same problem - microsoft.com - this time 50.97.218.220.

Here is QS log

Malwarebytes Anti-Malware (PRO) 1.75.0.1300

www.malwarebytes.org

Database version: v2013.04.18.03

Windows 7 Service Pack 1 x86 NTFS

Internet Explorer 10.0.9200.16540

User:: PC [administrator]

Protection: Enabled

18/04/2013 1:50:27 PM

mbam-log-2013-04-18 (13-50-27).txt

Scan type: Quick scan

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 230873

Time elapsed: 4 minute(s), 50 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

[hannsschweis]

We are getting multiple pop ups on different workstations from the same IP on ports: 59522, 57236, 56371

as well as:

IP: 50.23.124.152 Ports: 58530, 58572, 55185, 50578

IP: 50.97.218.220 Port: 50155

[MysteryFCM]

The malicious content is no longer present, so the block on the IP has now been removed.

[BCDeb]

It hasn't been removed as far as my MB is concerned. I finally got so fed up I just used the wrench icon on the notification to change the setting. MB is no longer going to be annoying me with constant notifications concerning something it has blocked. But I am a little concerned about the other issue that has been reported. The business about the system being quarantined by MB, and getting a black screen so you can't even run the Windows Repair Disk you have made. I am thoroughly backed up with an external hard drive doing real time backup of my data, and it also has a pretty up-to-date system image on it. But I am wondering if it is safer to NOT have MB on my computer than to have it, if MB itself can so corrupt a person's system?

[LadyA]

I've gotten FAR less pop-ups about blocked IPs the last two days. Yesterday I only got 2 (which was down from about 10-15 the other days), and so far today I haven't gotten any, but I've only been online for about an hour, so not sure if I might still run into them or not.

Glad the malicious content was removed. I'm also glad the MBAM blocked it in the first place! I'd rather have a few notification pop-ups than an actual infection. :-)