Avast WEBforum
Other => Viruses and worms => Topic started by: rokoblak12 on May 25, 2022, 05:51:51 PM
-
every about 15 minutes I get a notification from avast that it blocked 104.155.207.188 it says it is in proces svchost.exe. I also noticed I got loged out of chrome apps and can't log back in from this pc.
-
Avast isn't alone in detecting on that IP:
https://www.virustotal.com/gui/url/38ef8ec31e7b039875adc5b5486edb801c1a2c04c039ed60688745b1e426e4fe?nocache=1
Whilst svchost.exe is a system file it isn't so usual for it to connect to the internet, but has been on occasion used by another program (could be malicious) to avoid detection or obfuscate what is responsible for the connection.
Site considered a Medium Security Risk - https://sitecheck.sucuri.net/results/104.155.207.188
Site Security Score F - https://snyk.io/test/website-scanner/?test=220525_BiDcVT_C08
This appears to be part of the GoogleCloud containing user content - https://www.ip-adress.com/ip-address/ipv4/104.155.207.188
-
So is there any way to fix it, I also noticed that it is not always svchost.exe but also some random programs I am using like chrome and game launchers. but always the same IP. how can I find what is causing this.
-
So-called win.pac trojan infection. For a individual cleansing routine advice visit bleepingcomputer.com/forums
Read Ground Rules there. Hope you will get your issue resolved through assistence of a qualified malware remover there.
polonus