Three days ago, I had a Fake AV Website 32 attack that was blocked by Norton Internet Security 2011. What made this different from other blocked attacks that I’ve had in the last year, was that this time, I wasn’t on the internet using my browser. Later that night, once again, without using my browser, I had another FAKE AV Website 32 attack, from a web address different than the first one.
About two hours later, I had a Malevertisement Redirect Attack that was blocked, attributed to another web address. Once again, I wasn’t using my browser at the time. In all three cases, NIS said that the attack "resulted from \Device\HardDiskVolume3\Program Files\Spybot - Search & Destroy 2\SDFSSVC.exe."
A few hours later, I had another Malvertisement 3 attack, emanating from the same web address as the prior one, and linked to the same Spybot file, which was blocked by NIS.
The next day, there was another Fake AV Website 32 attack that was blocked, attributed to the same web address as the first Fake AV Website 32 attack. This happened again three hours later, and then two hours after that, there was another intrusion attempt, this one a portscan, which unlike the prior attacks, was of medium severity. The others were all high severity.
All of these attacks occurred with my browser closed, and none of the scans done with NIS turned up any malware at all. The Spybot file which NIS had implicated in all of these attacks, with the exception of the one portscan, came up clean in every Norton scan that I’ve done since the first attack occurred.
I used Norton Power Eraser several times, and it found nothing wrong.
Spybot turns up nothing with the system scan or the rootkit scan, and Malwarebytes found no compromised file on my computer throughout all this.
Yesterday, I didn’t see any portscans or any attempt Fake website attacks or any Malvertisement attacks, until late in the day, when I saw yet another Malvertisement Redirect attack coming from the same website as before (but this one occurred with my broswer open, unlike all the others), followed by a portscan two hours later with the browser closed. I did notice earlier in the day that when I went to a secure bank site, there was one IPS submission having to do with jscript.dll. Also, I’ve noticed more than a few references to "rule rejected TCP(6) Traffic" over the last three days, usally occurring not long after I first turn on my computer, or waking up from sleep.
I’ve noticed a few attempted attacks over the last year, and they were usually either Fake website attacks or Exploit website toolkits, but they all occurred while I was using my browser going from one site to another. What concerns me is that the attacks I’ve seen this week all, with one exception, occurred with my browser closed, and with Norton, Spybot and Malwarebytes not finding any compromised file in any system scan (even though NIS says that all of these attacks, but for the portscan, emanated from that one Spybot SDFSSVC.exe file). I've also never seen this many attacks in such a short span of time.
I did go to Yahoo and put the names of all three of the websites that were linked to the attacks, but all three of them had green Norton boxes. They were all supposedly safe and secure.
Why would this be happening? What is going on?