FAST Search & Transfer

First off, I apologize if this is the wrong place to post. I wanted to ask at the iblocklist forums but that requires a subscription. :-(

I'm having an issue with my PC (Windows 7 x64) attempting to contact FAST Search & Transfer (208.68.139.89 and 208.68.143.55) hundreds of times a minute. I know that since PeerBlock is stopping it, not to worry too much but it seems to me that would mean something on my PC is compromised.

I've ran Avast, Spybot, MalwareBytes, SuperAntiSpyware and even tried figuring out which process is sending them with Sysinternal's TCPView. It seems to be coming from the System process which doesn't help me at all. While researching it, I've found rumors that Microsoft has bought out that company which could mean that its a "legit" windows thing. I would still like to stop it though.

Thanks in advance for any ideas.

Only thing I can come up with is its somekind of Norweigan advertising company. Check programs and features sometimes these kind of companies slam dunk you and you'll find installed software in your control panel.

After a Quick WhoIs I turned up this:

208.68.139.89 - Whois Information
#
# Query terms are ambiguous. The query is assumed to be:
# "n + 208.68.139.38"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# [whois.arin.net]
#

NetRange: 208.68.136.0 - 208.68.143.255
CIDR: 208.68.136.0/21
OriginAS: AS40066
NetName: FAST-GNS
NetHandle: NET-208-68-136-0-1
Parent: NET-208-0-0-0-0
NetType: Direct Assignment
NameServer: DNSBOSEXT.FASTSEARCH.NET
NameServer: DNSDENEXT.FASTSEARCH.NET
RegDate: 2006-06-28
Updated: 2011-01-20
Ref: [whois.arin.net]

OrgName: FAST Search & Transfer Inc
OrgId: FST-20
Address: 117 Kendrick Street
City: Needham
StateProv: MA
PostalCode: 02494
Country: US
RegDate: 2006-05-04
Updated: 2006-05-04
Ref: [whois.arin.net]

OrgTechHandle: JHH10-ARIN
OrgTechName: Hutchinson, James Henry
OrgTechPhone: +1-781-433-8999
OrgTechEmail: james.hutchinson@microsoft.com
OrgTechRef: [whois.arin.net]

RTechHandle: NORMA1-ARIN
RTechName: Norman, Darren
RTechPhone: +1-425-703-6647
RTechEmail: danorm@microsoft.com
RTechRef: [whois.arin.net]

RNOCHandle: ZM23-ARIN
RNOCName: Microsoft Corporation
RNOCPhone: +1-425-882-8080
RNOCEmail: noc@microsoft.com
RNOCRef: [whois.arin.net]

RAbuseHandle: ABUSE231-ARIN
RAbuseName: Abuse
RAbusePhone: +1-425-882-8080
RAbuseEmail: abuse@msn.com
RAbuseRef: [whois.arin.net]

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: [www.arin.net]
#
208.68.143.55 - Whois Information
#
# Query terms are ambiguous. The query is assumed to be:
# "n + 208.68.143.50"
#
# Use "?" to get help.
#

#
# The following results may also be obtained via:
# [whois.arin.net]
#

NetRange: 208.68.136.0 - 208.68.143.255
CIDR: 208.68.136.0/21
OriginAS: AS40066
NetName: FAST-GNS
NetHandle: NET-208-68-136-0-1
Parent: NET-208-0-0-0-0
NetType: Direct Assignment
NameServer: DNSBOSEXT.FASTSEARCH.NET
NameServer: NS2.FASTSEARCH.NET
RegDate: 2006-06-28
Updated: 2011-03-16
Ref: [whois.arin.net]

OrgName: FAST Search & Transfer Inc
OrgId: FST-20
Address: 117 Kendrick Street
City: Needham
StateProv: MA
PostalCode: 02494
Country: US
RegDate: 2006-05-04
Updated: 2006-05-04
Ref: [whois.arin.net]

OrgTechHandle: JHH10-ARIN
OrgTechName: Hutchinson, James Henry
OrgTechPhone: +1-781-433-8901
OrgTechEmail: james.hutchinson@microsoft.com
OrgTechRef: [whois.arin.net]

RTechHandle: MSFTP-ARIN
RTechName: MSFT-POC
RTechPhone: +1-425-882-8080
RTechEmail: iprrms@microsoft.com
RTechRef: [whois.arin.net]

RNOCHandle: ZM23-ARIN
RNOCName: Microsoft Corporation
RNOCPhone: +1-425-882-8080
RNOCEmail: noc@microsoft.com
RNOCRef: [whois.arin.net]

RAbuseHandle: ABUSE231-ARIN
RAbuseName: Abuse
RAbusePhone: +1-425-882-8080
RAbuseEmail: abuse@hotmail.com
RAbuseRef: [whois.arin.net]

#
# ARIN WHOIS data and services are subject to the Terms of Use
# available at: [www.arin.net]
#

It seems to be more associated with Comcast and there search engine then Microsoft.. Its weird that the email address in the whois are @microsoft.com but bear in mind I have an @microsoft.com email because I am a certified partner.

Thanks for looking in to it. I couldn't find much on the company either other than the same weirdness. I had my roommate use peerblock on his PC (Win7 x86) and he is getting the same thing. So I've come to the conclusion its either:

1) A Windows thing. Microsoft is using the the server, addresses, or the company itself for windows update or possibly something less than scrupulous. (Wouldn't be the first time)

2) Something infected both our PC's systemically and the scanners I've tried so far can't find it.

I know in safe-mode, whatever is doing it doesn't run. Once I get a chance, I'm gonna disable all my services and start them one by one in safe mode to see if I can pinpoint it.

Check to see if any software installed on your computer(s) is from Comcast.

Nope, nothing Comcast. I just went through every program on my PC just to make sure.

I installed ZoneAlarm just to make sure nothing else is getting through and it revealed something unusual. One of the ports being used is the "microsoft-ds" port (Or 445) which is only used for Windows-to-Windows things like LAN shared drives. ZoneAlarm called it a Network-based attack.

Maybe I was right to be suspicious?

Possibly.

I need to customize my FAST search result page at very high level. Similar as attached screen shot. Can anybody help me on this...how to proceed....? how to get date Range, Industry filters, key concepts in the left of search result?

Thanks in advance