« previous next »
Pages: [1] 2   Go Down

Author Topic: svchost.exe connects to malicious sites  (Read 6157 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
svchost.exe connects to malicious sites
« on: May 19, 2015, 08:45:07 PM »
Hello Avast forum,

Just like a lot of people here, I'm also getting the dreaded 14 or so messages that svchost.exe connects to a site to download malware.
The urls are random, but it tries to download a .dll
Example: "http://reddie<dot>net/4141/TrimModule_142669093016272<dot>dll" (real dots replace so no url is generated for safety reasons  :))

I've tried everything in my power to remove it, but no succes...
I've ran the Farbar recovery scanner like requested in other posts and attached the logs to this post.

I really hope some of you guys can help me. If you need further information, do ask :)
Thanks in advance!

EDIT: Updated the OP with 2 additional logs.
« Last Edit: May 19, 2015, 09:13:55 PM by rob-smit »
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: svchost.exe connects to maicious sites
« Reply #1 on: May 19, 2015, 08:46:09 PM »
Hello,

Please follow this topic and attach required reports

https://forum.avast.com/index.php?topic=53253.0
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

REDACTED

  • Guest
Re: svchost.exe connects to maicious sites
« Reply #2 on: May 19, 2015, 09:13:07 PM »
My apologies, I've updated the opening post.
(aswmbt.exe found something called "Minitoolbox.exe", but it's an application in the Farbar malware suite, is this a false positive?)
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: svchost.exe connects to malicious sites
« Reply #3 on: May 19, 2015, 10:26:30 PM »
Scan with TDSSKiller

Please download TDSSKiller by Kaspersky and save it to your desktop.

  • Right-click on icon and select Run as Administrator to start the tool.
  • Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.
  • Your machine may appear very slow and unusable after that - it's normal.
  • TDSSKiller will run automaticaly. Click on Change parameters and click OK.
  • Click the Start Scan button and wait patiently.
If anything will be found follow this guidelines:
  • If a suspicious object is detected, the default action will be Skip, click on Continue.
  • If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
    Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
    If Cure is not available, please choose Skip instead.
  • Do not choose Delete unless instructed!
A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post.
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

REDACTED

  • Guest
Re: svchost.exe connects to malicious sites
« Reply #4 on: May 19, 2015, 10:46:29 PM »
As requested, I've attached the log of TDSS Killer. No threads were found.
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: svchost.exe connects to malicious sites
« Reply #5 on: May 20, 2015, 07:59:52 AM »
Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.
  • Right-click on icon and select Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please include their content into your next reply.
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

REDACTED

  • Guest
Re: svchost.exe connects to malicious sites
« Reply #6 on: May 20, 2015, 04:26:02 PM »
As requested, I've attached the 2 new logfiles of the Farbar Recovery Scan Tool.
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: svchost.exe connects to malicious sites
« Reply #7 on: May 21, 2015, 08:01:23 PM »
Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on icon and select Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.
Please attach it to your reply.
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

REDACTED

  • Guest
Re: svchost.exe connects to malicious sites
« Reply #8 on: May 21, 2015, 08:09:44 PM »
Fixlog.txt attached. The svchost.exe message isn't appearing @ the first reboot. Looks promising :)
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: svchost.exe connects to malicious sites
« Reply #9 on: May 21, 2015, 08:21:19 PM »
Very good. Keep me updated.
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

REDACTED

  • Guest
Re: svchost.exe connects to malicious sites
« Reply #10 on: May 21, 2015, 08:24:33 PM »
I will keep an eye on the message. I'll keep you informed. If the message hasn't shown itself after Saturday I'll post it here.
Just for curiosity, what was the process that you killed with the fix? I've read it but couldn't figure it out...
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: svchost.exe connects to malicious sites
« Reply #11 on: May 21, 2015, 08:26:35 PM »
That is author's secret ;)
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE

REDACTED

  • Guest
Re: svchost.exe connects to malicious sites
« Reply #12 on: May 21, 2015, 08:27:35 PM »
Hah, good response.  8) Ty very much. Ill keep you posted.
Logged

REDACTED

  • Guest
Re: svchost.exe connects to malicious sites
« Reply #13 on: May 22, 2015, 02:14:04 PM »
Just a question. Is it safe to use my pc for moneybusiness and other secure things?
I've read about the TDL4 botnet that was (Partially) present in my system. (Am I right?)
Or is a clean reinstall the best way to be safe?
Logged

Offline TwinHeadedEagle

  • Malware Removal Expert
  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 2987
    • Zemana
Re: svchost.exe connects to malicious sites
« Reply #14 on: May 22, 2015, 02:32:40 PM »
Yes, clean install will be the best and safest option.
Logged
My help is free, however if you'd like to show your appreciation by leaving a donation, it will be much appreciated ------> DONATE
Pages: [1] 2   Go Up
« previous next »