Question about notifications and blocking

[Nonie]

I use Malwarebytes 3 Premium on Windows 7, and recently I've been getting a lot of spam from the domain mx4.earthlink.net which triggers Malwarebytes notifications that a website is blocked.  They keep popping up, showing that whatever it is in the email is continually trying sequential ports until it finds one it can get through.  The notifications continue for a while even after the email is deleted, so it appears that something is continuing to run on my computer (I'm attaching one of the notifications). Eventually it stops, and I don't know if that means it got through a port, because the spamming is increasing each day, which shows they think they have a live one.  I use Thunderbird for email, blocking everything except text, unless I approve to download content, which of course I don't.  I've run scans with Malwarebytes, and no threats are found.  My questions are 1) Why do notifications continue after the email is deleted and does Malwarebytes definitely block ALL ports? and 2) since all of these are coming from one domain, is there any way to block that particular domain from coming in, if that makes any sense?  For some reason, since my ISP is Earthlink, they won't allow me to block a domain that is one of theirs. Thank you for your help!

[Telos]

2 hours ago, Nonie said:

For some reason, since my ISP is Earthlink, they won't allow me to block a domain that is one of theirs

You can block domains through your HOSTS file, or OpenDNS free account, and of course, MBAM will flag interceptions it finds dodgy.

[Nonie]

I'm not sure what you mean... do you mean I could block through a file related to my ISP?  Or is HOSTS a service of some kind? 

[Nonie]

Does anyone know how it can continue checking ports after the email is deleted?  I'm using Thunderbird for email, so that shouldn't allow anything to download. Thanks!

[dcollins]

Malwarebytes doesn't block ports, it blocks based on domains or IP's. Also, these are outbound connections, meaning something in Thunderbird is trying to reach out to these websites. This could be a sign of an infection, an email that's trying to load an ad/image from this page, or a potential extension. I'm going to move this thread to the Malware Removal section so the  can check your information.

Please be sure to provide the needed information, which you can find here: