Ever since this morning after installing a game I've been having this spam Norton history:
Category: Firewall - Activities
Date & Time,Risk,Activity,Status,Recommended Action,Category
30/03/2015 7:59:25 a.m.,Info, Rule rejected UDP(17) traffic with (192.168.1.254 Port ssdp(1900) ),Detected,No Action Required,Firewall - Activities
Firewall rule was matched:<br> Rule Name: Default Block UPnP Discovery<br> Rule Action: rejected<br> Rule Severity: normal<br> <br> Traffic Details:<br> Protocol: UDP(17) <br> Direction: inbound<br> Local Host: <br> Local IP: 239.255.255.250<br> Local Service: Port ssdp(1900) <br> Remote Host: <br> Remote IP: 192.168.1.254<br> Remote Service: Port ssdp(1900) <br> Remote MAC: -- <br> Adapter Index: 11<br> <br> Process Information:<br> Process ID: 2556<br> Process Path: C:\Windows\System32\svchost.exe<br>
It's spams 4 of them at a time every 5 minutes exactly and upon uninstalling the game and deleting the installation files it spams every 10 minutes.
Also noticed this appear too:
Category: Firewall - Activities
Date & Time,Risk,Activity,Status,Recommended Action,Category
30/03/2015 9:47:03 a.m.,Info, Rule rejected TCP(6) traffic with (192.168.1.254 Port (58596) ),Detected,No Action Required,Firewall - Activities
Firewall rule was matched:<br> Rule Name: Default Block SSDP<br> Rule Action: rejected<br> Rule Severity: normal<br> <br> Traffic Details:<br> Protocol: TCP(6) <br> Direction: inbound<br> Local Host: NEREVAR<br> Local IP: 192.168.1.64<br> Local Service: Port (2869) <br> Remote Host: <br> Remote IP: 192.168.1.254<br> Remote Service: Port (58596) <br> Remote MAC: -- <br> Adapter Index: 11<br> <br> Process Information:<br> Process ID: 4<br> Process Path: System<br>
This one also coming from the same remote IP. However this one doesn't seem to have any pattern to how often it appears and has appeared 5 times so far in the past hour being 22 minutes apart to 1 minute apart to 8 minutes apart and each time the port changes; 35673, 35674, 57573, 45885, 58596.
When I installed the game Norton detected Trojan.ADH.2 and blocked it.