Author Topic: svchost.exe blocking problem  (Read 1751 times)

0 Members and 1 Guest are viewing this topic.

Offline Danelr

  • Newbie
  • *
  • Posts: 12
svchost.exe blocking problem
« on: November 26, 2023, 09:00:54 PM »
avast started to block svchost.exe in system32 process but I checked everything and the app is legit and is not virus I'm just getting like a month everyday messages that avast blocked a "virus". How can i add the app into exceptions or to do something to not get that annoying messages.
« Last Edit: November 26, 2023, 09:02:26 PM by Danelr »

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37469
  • Not a avast user
Re: svchost.exe blocking problem
« Reply #1 on: November 26, 2023, 09:06:59 PM »
Quote
I'm just getting like a month everyday messages that avast blocked a "virus"
And what does the block message say?

Attach a screenshot

If you think it is wrong, report it to avast lab
https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438

« Last Edit: November 26, 2023, 09:33:33 PM by Pondus »

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 88761
  • No support PMs thanks
Re: svchost.exe blocking problem
« Reply #2 on: November 27, 2023, 12:48:07 AM »
It isn't unusual for something/program to use/misuse svchost.exe.  Generally it is used by system functions, commonly windows updates, etc.

So as Pondus implies we need more information.

I certainly wouldn't recommend adding an exclusion until you know exactly why this is happening, in case this is being used maliciously.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.1.6099 (build 24.1.8821.762) UI 1.0.796/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Danelr

  • Newbie
  • *
  • Posts: 12
Re: svchost.exe blocking problem
« Reply #3 on: November 28, 2023, 08:22:43 PM »
screenshot

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 88761
  • No support PMs thanks
Re: svchost.exe blocking problem
« Reply #4 on: November 29, 2023, 12:00:03 AM »
A search for wpad.dat returns many hits, some of which look like it can be used for malicious purposes.
https://www.google.co.uk/search?q=wpad.dat

See https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol
Something on your system is using svchost.exe to connect to hxxp://wpad.dcomwifi.com/wpad.dat  I have modified the link (changed http to hxxp) so it isn't active.  This is trying to run a wpad.dat file at that location.  I have no what the reason for this would be or why it is connecting and considering the connection isn't secure https it whatever is communicated isn't secure.

I'm not familiar with the workings of Web_Proxy_Auto-Discovery_Protocol function or why it needs to be used.  Even trying to get information on the site from other sources triggers avast, see attached.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.1.6099 (build 24.1.8821.762) UI 1.0.796/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline nonwaty

  • Jr. Member
  • **
  • Posts: 21
Re: svchost.exe blocking problem
« Reply #5 on: November 29, 2023, 06:47:32 AM »
Hi
your pc tries to connect to "wpad.dcomwifi.com/wpad.dat "
with  svchost.exe.

(it's complicated)

reinstall the browser




« Last Edit: November 29, 2023, 07:07:59 AM by nonwaty »

Offline Danelr

  • Newbie
  • *
  • Posts: 12
Re: svchost.exe blocking problem
« Reply #6 on: November 29, 2023, 08:02:17 AM »
How i can know what browser he tries to use or i need to reinstall every browser?

Offline nonwaty

  • Jr. Member
  • **
  • Posts: 21
Re: svchost.exe blocking problem
« Reply #7 on: November 29, 2023, 08:36:47 AM »
HI

what browser do you use?

Offline Danelr

  • Newbie
  • *
  • Posts: 12
Re: svchost.exe blocking problem
« Reply #8 on: November 29, 2023, 08:55:19 AM »
Google Chrome and Edge

Offline Nunzio77

  • Poster
  • *
  • Posts: 413
Re: svchost.exe blocking problem
« Reply #9 on: November 29, 2023, 09:32:19 AM »
Have you also done a full antivirus scan on your PC?
Thank you and good day!
Nunzio
----------------------------
Avast Free - Windows 10 Pro-32 Bit, Intel Core2 Duo CPU T7500, RAM 4 Gb, SDD 512 Gb, ATI Mobile Radeon HD 2400 - Avast Mobile Security Free - Smartphone Android

Offline Nom

  • Sr. Member
  • ****
  • Posts: 291
Re: svchost.exe blocking problem
« Reply #10 on: November 29, 2023, 09:35:14 AM »
Try disabling the Web_Proxy_AutoDiscovery system service. Web_Proxy_AutoDiscovery is considered vulnerable and is recommended to be disabled if it is not used in your network. In the home network, I think no one uses a proxy, much less its automatic configuration. It starts automatically when configuration via DHCP is configured on the network interface. And this means that you can also specify static IP, DNS and gateway settings in the network interface settings. After restarting the computer, the service will not be disabled, but it will not start because the DHCP client will not start. But if you connect to the router via wi-fi and use your computer to connect to other wi-fi, then it's better to simply disable the service, otherwise there may be problems when connecting to someone else's wi-fi. I think so...
« Last Edit: November 29, 2023, 09:44:51 AM by Nom »

Offline Danelr

  • Newbie
  • *
  • Posts: 12
Re: svchost.exe blocking problem
« Reply #11 on: November 29, 2023, 11:29:10 AM »
I did full virus scan with high sensitivity and nothing. Is there any way to know which file is causing this?

Offline nonwaty

  • Jr. Member
  • **
  • Posts: 21
Re: svchost.exe blocking problem
« Reply #12 on: November 29, 2023, 11:49:21 AM »
Hi

"Google Chrome and Edge"

Svchost.exe means "service host" and is a file used by many Windows applications.

it's a problem many years old, "bad" programs, use this file (windows own).

I would recommend you, install, for example, avast browser.

Try it, because if you already have those contaminated.... Try it, and tell us the result.

Offline Nom

  • Sr. Member
  • ****
  • Posts: 291
Re: svchost.exe blocking problem
« Reply #13 on: November 29, 2023, 12:26:16 PM »
In general, this is a false positive. The Web_Proxy_AutoDiscovery system service makes a request according to the protocol in search of the proxy server configuration and no crime. The protocol is considered vulnerable and avast confuses it with malicious. You can write about it here - https://www.avast.com/false-positive-file-form.php?ysclid=lpjoapgdtp983368935#pc
But It would not hurt to disable the service, at least in order to check and see the result.
« Last Edit: November 29, 2023, 12:29:36 PM by Nom »

Offline Danelr

  • Newbie
  • *
  • Posts: 12
Re: svchost.exe blocking problem
« Reply #14 on: November 29, 2023, 12:56:21 PM »
After updating and deleting all data and cookies from both google and edge i didn't get any messages from avast again.