I am not buying this idea that, because ESET fixed the so-called issue by updating signatures there is no problem. I have several systems continuing to try to make connections to this IP. I have had to block all traffic to this site until someone can better explain what is happening and would suggest anyone who has seen this to do the same. Marcos - would you please shed some light on this and what ESETs reasoning for allowing communication to continue to this IP and randomized URLs?
"ESET blocks a bunch of weird connections, all to that same IP, but with different urls. Such as hxxp://wpad.******.net/wpad.dat (where ****** is the local Windows domain name of the company). Also a bunch of random URLs with random characters and no TLD such as hxxp://ekickejd, and some are even showing hxxp://****1 (the name of the company's file server)'' ??
Additionally, why has it only been reported by few and not all of your customers? I first noticed this issue on the 10th and only when I connected and disconnected to my corporate VPN. I would assume all your customers would have reported this had it been a windows issue? I
