malwarebytes blocking access 208.87.149.250

[sting66ray]

Good Morning!

Several days ago MB starting blocking access to an ip 208.73.210.29 on two of my computers with the paid version of MB on them. It happens frequently while not using the internet. I read on a forum here that avg worked to elimnate it. I tried it worked for a day or two then it started blocking 208.87.149.250 instead. MB logs are attached. Is there any way to stop this from trying to connect all the time. Computer doesn't seem slow, but it must use some of its resources to continually do this. Thank You!

David

protection_log_2011_01_31.txt

protection_log_2011_02_03.txt

protection_log_2011_01_28.txt

[Firefox]

Hello and

Do you show any signs of an infection?

Are you using any P2P programs or Torrent programs?

Are you using Skype?

Info on that IP Address:

Country United States

Country Code US

Region California

City Los Angeles

Postal Code 90071

Latitude 34.0533

Longitude -118.255

Area Code 213

DMA Code 803

Whois* Information

NetRange: 208.73.208.0 - 208.73.215.255

CIDR: 208.73.208.0/21

OriginAS:

NetName: OVERSEE-NET-2

NetHandle: NET-208-73-208-0-1

Parent: NET-208-0-0-0-0

NetType: Direct Assignment

NameServer: NS2.OVERSEE.NET

NameServer: NS1.OVERSEE.NET

RegDate: 2006-12-28

Updated: 2006-12-28

Ref: http://whois.arin.net/rest/net/NET-208-73-208-0-1

OrgName: Oversee.net

OrgId: OVERS-1

Address: 515 S. Flower St

Address: Suite 4400

City: Los Angeles

StateProv: CA

PostalCode: 90071

Country: US

RegDate: 2003-08-01

Updated: 2008-11-10

Ref: http://whois.arin.net/rest/org/OVERS-1

OrgTechHandle: OVERS-ARIN

OrgTechName: Oversee NOC

OrgTechPhone: +1-213-408-0080

OrgTechEmail: abuse@oversee.net

OrgTechRef: http://whois.arin.net/rest/poc/OVERS-ARIN

OrgAbuseHandle: OVERS-ARIN

OrgAbuseName: Oversee NOC

OrgAbusePhone: +1-213-408-0080

OrgAbuseEmail: abuse@oversee.net

OrgAbuseRef: http://whois.arin.net/rest/poc/OVERS-ARIN

[sting66ray]

Hello and

Do you show any signs of an infection?

Are you using any P2P programs or Torrent programs?

Are you using Skype?

Info on that IP Address:

Country United States

Country Code US

Region California

City Los Angeles

Postal Code 90071

Latitude 34.0533

Longitude -118.255

Area Code 213

DMA Code 803

Whois* Information

NetRange: 208.73.208.0 - 208.73.215.255

CIDR: 208.73.208.0/21

OriginAS:

NetName: OVERSEE-NET-2

NetHandle: NET-208-73-208-0-1

Parent: NET-208-0-0-0-0

NetType: Direct Assignment

NameServer: NS2.OVERSEE.NET

NameServer: NS1.OVERSEE.NET

RegDate: 2006-12-28

Updated: 2006-12-28

Ref: http://whois.arin.net/rest/net/NET-208-73-208-0-1

OrgName: Oversee.net

OrgId: OVERS-1

Address: 515 S. Flower St

Address: Suite 4400

City: Los Angeles

StateProv: CA

PostalCode: 90071

Country: US

RegDate: 2003-08-01

Updated: 2008-11-10

Ref: http://whois.arin.net/rest/org/OVERS-1

OrgTechHandle: OVERS-ARIN

OrgTechName: Oversee NOC

OrgTechPhone: +1-213-408-0080

OrgTechEmail: abuse@oversee.net

OrgTechRef: http://whois.arin.net/rest/poc/OVERS-ARIN

OrgAbuseHandle: OVERS-ARIN

OrgAbuseName: Oversee NOC

OrgAbusePhone: +1-213-408-0080

OrgAbuseEmail: abuse@oversee.net

OrgAbuseRef: http://whois.arin.net/rest/poc/OVERS-ARIN

Hi, Thanks for responding! Not showing any signs of infection. I do not use any of those programs you mentioned. I havven't done a full MB scan since Friday. Did an avg scan yesterday...no issues found. Thanks! David...I found the same info about the ip addresses...that started my concern, as well.

[Firefox]

Well you could always have the experts take a look at your logs to ensure you are not infected...

You can post your logs at Malware Removal - HijackThis Logs Section

[Guest garybear]

Hello!!

I think it's OK for me to reply.

First I'm wondering is this a incoming or outgoing block?

I would think it's outgoing!

Here's what I found. That IP address is hosting a lot of sites!!

Your logs don't show it being blocked all that much.

http://sameip.org/ip/208.73.210.29

PS. I replied to a similar thread , but my post was deleted. I hope I'm not breaking any rules. I guess if this needs to be deleted it will be. I didn't like the first host in the list?????

Opps Sorry I didn't open the last log. That is a lot of blocks!!

[Guest garybear]

Hello!!

This is what I found on the other blocked IP!!

http://www.projecthoneypot.org/ip_208.87.149.250

I believe I would follow Firefox's advice and get it checked out.

[sting66ray]

Hello,

How do you do a hijack this log?

David

[Firefox]

David you can just follow these instructions....

Please read the following so that you can begin the cleaning process:

As we don't deal with malware removal in the General Malwarebytes' Anti-Malware Forum, you need to start a topic in the Malware Removal forum so a qualified helper can help you fix any malware related problems/infections you may have.

• Please read and follow the directions here, skipping any steps you are unable to complete. Then post a NEW topic here.
  
• After posting your new post, make sure under options, you select Track this topic and choose Immediate Email Notification, so that you're alerted when someone has replied to your post.
  
• One of the expert helpers there will give you one-on-one assistance when one becomes available.
  
• Please refrain from making any further changes to your computer (Install/Uninstall programs, use special fix tools, delete files, edit the registry, etc...) unless advised by a malware removal helper. Doing so can result in system changes which may hinder the attempts by a helper to clean your machine.
  

NOTE: Please DO NOT post back to (bump) your topic within the first 48 hours.

Replying to your own posts changes the post count and helpers are looking for topics with zero replies. If you reply to your own post helpers may think that you're already being helped and thus overlook your post.

• • If there is no reply from any experts after 48 hours, you can reply to the topic, asking for help again.
    Or
    
  • You may send a Private Message to a Moderator asking for assistance.
    

Alternatively, as a paying customer, you can contact the help desk at support@malwarebytes.org or here.

Please be patient, someone will assist you as soon as it is possible.

PS: Please use the "ADDREPLY" button instead of other ones when you start replying.

[LDTate]

Calling Frontier (Verizon FIOS) about ftrdhcpuser.com

https://www.wmclan.net/main/2011/01/27/call...trdhcpuser-com/