report.bitdefender.com

Hi Escalader,

I might be wrong, but that could be BitDefender trying to send/receive data about viruses as a result of the options Send virus reports and Enable BitDefender Outbreak Detection (General -> Settings)

Try to disable these options, and see if you have any more attempts.

Cris.

Hi Chris:

I will try your idea, what puzzled me was I didn't change any BD options lately and it was zlclient that connected first. Now it is WINLOGON.exe that is attempting the connect. I have it blocked until I know what's happening here.

Did a reverse DNS and the ip comes up as Bucerest Romania. No information on organization owning it.

The whois data base lists this country with a high fraud profile?

Hello,

Nobody except Bitdefender can register sub-domains of BitDefender.com ,the Head Quarters of BitDefender are in Romania. Once you own a Domain name you can register as many sub-domains as you want for free, that can be done just by the main owner of the domain.The report.bitdefender.com could be a server in the HQ so it's not dangerous at all.

Have a nice day.

Hello Rudy:

Just to be clear I trust BitDefender or I wouldn't use the product.

But the way this came to light was very strange.

First as mentioned a few posts back zlclient was the program that first accessed report.bitdefender.com.

Next the id of the program attempting access switched to WINLOGON.exe.

Is report.bitdefender.com a server in HQ? The city and country are right but the whois data base don't confirm BD's ownership of this site.

Could be a server is not the same as is a server.

I'm not trying to be difficult, I just want clarity.

The owner you see there is INES , that is one of our Internet Providers. The connection is leading to our internal server.Over this connection are virus and spam statistics send.

Real Time Virus Report (RTVR) & Real Time Spam Report (RTSR)

RTVR/RTSR is a system included in BitDefender products deployed all over the Internet that reports virus and spam activity to the BitDefender Labs(report.bitdefender.com) to help isolate and prevent the spreading of malware and spam in an efficient and timely manner.

So it is our server.

Hi Rudy:

Thank you very much for tracking this down for me. Best to be clear!

I currently have followed the following idea:

"....turned off the "Send virus reports and Enable BitDefender Outbreak Detection" options in BD setup"

The repeated connections attempts to 80.86.106.67 continue anyway.

This seems to me to mean that the RTVR and RTSR connects occur even if the options are turned off.

In my set up I have the address blocked, yet updates of the product continue ok as do the attempts to send reports back.

So updates must use one server and reports on virus and spam must use another?

Have I described all this correctly?

The update servers are different from the one with statistic reports. Why?

Beacuse we need to have good connection to all the users from the World. That's why you will have servers scattered all over the World and only one server that gathers information about viruses and spam in Romania.

If you are concerned about your security just block report.bitdefender.com although is our server and everything is secured.

Hi Florin:

Well of course I'm concerned about my security and everybody's!

If we could learn why the options turned off don't work is a known bug to be fixed due to still trying the access it would increase the users confidence. I may even turn on the service if I knew.

Take care