2 replies to this topic

[BeechV35Pilot]

Hello, I am a long time user of Malwarebytes and have been subscribing to Pandora Internet Radio's "Pandora One" subscription for two years now.

Just today I started receiving IP block notifications from Malwarebytes as seen below in the log. This is happening once a minute, presumably because Pandora keeps attempting the connection. I have sent an email to Pandora asking them about this but I wanted to check here as well

This is a snippit of the log (with my machine/name removed):

2012/03/30 08:01:10 -0400 IP-BLOCK 111.111.111.111 (Type: outgoing, Port: 2903, Process: pandoraservice.exe)
2012/03/30 08:02:14 -0400 IP-BLOCK 111.111.111.111 (Type: outgoing, Port: 2917, Process: pandoraservice.exe)
2012/03/30 08:03:50 -0400 IP-BLOCK 111.111.111.111 (Type: outgoing, Port: 3022, Process: pandoraservice.exe)
2012/03/30 08:03:50 -0400 IP-BLOCK 111.111.111.111 (Type: outgoing, Port: 3023, Process: pandoraservice.exe)

Real or false-positive?

[MysteryFCM]

It was blacklisted due to the presence of exploits related to Zeus (amongst others). However, it appears the host has finally removed it, so I'll get the block removed.

[BeechV35Pilot]

After posting to your forum here I found out some more information:

The Windows 7 service causing all this grief is called PandoraService.exe but it is not from or related to the Internet radio product called Pandora – it is actually a hidden service that was installed by the open source video viewer, KMPlayer. I have no idea what this service is doing but I did find the uninstaller for it and in running it I have completely removed that piece of garbage from my system.

As far as I am concerned Malwarebytes did its job and alerted me to a Windows service installed on my computer without my knowledge or desire. I wonder now if you should remove it from your database?