threat coming from "street-info.net/load/_main.exe"

[neoluk]

it is some time that I receive the following announcement from Avast regarding a potential threat coming form "street-info.net/load/_main.exe". It says that the "c:/WINDOWS/system32/svshost.exe" process in involved.
Unfortunately I cannot find any solution to eliminate the problem.
(see the image in attachment).

more or less the same problem as reported here: "http://forums.cnetfrance.fr/topic/171835-probleme-street-info/" but still haven't found any solution around the net.
is there anyone who can help me in cleaning my pc?

thanks
Luca

[DavidR]

The problem as I see it is you have something hidden/undetected on your system that is using svchost.exe maliciously as svchost normally only connects to the internet during windows updates. This is clearly not what is happening here, as this isn't related to windows update.

So fortunately for you this site is on the network shields malicious sites list and blocking the attempt to connect to and run another executable.

What is your firewall ?

If you haven't already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).

• 1.  MalwareBytes Anti-Malware (MBAM), On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
• 2. SUPERantispyware (SAS). On-Demand only in free version.

Don't worry about reported tracking cookies they are a minor issue and not one of security, allow SAS to deal with them though. - See http://en.wikipedia.org/wiki/HTTP_cookie.
Also available a portable version of SAS, http://www.superantispyware.com/portablescanner.html, no installation required.

[polonus]

Hi neoluk,

The site is also listed as suspicious by Trend Micro,
Google's unmasked parasites has "A part of this site was found to have suspicious activities twice.

    Last time suspicious content was found was on 2010-06-04.

    Malicious software includes 23 exploits.

    This site was hosted on 1 network including AS7018 (ATT).


What malware avast detected:  JS:ScriptPE-inf[Trj]

    Yes the site hosted malicious software. This software has infected 12 domains, e.g.: esports.lt/, presepe.jp/, muztv.md/. Found there in 2004 was: Trojan ST.EXE http://www.wilderssecurity.com/showthread.php?t=44389
so the site has a long suspicious reputation...

polonus

[neoluk]

Thanks for your suggestions.
I used SUPER ANTI Spyware to clean the pc but still something seems to be still inside.
Any other suggestion?

[DavidR]

You're welcome.

If you haven't run MBAM, then I suggest that you now run that, don't forget to post the contents of the scan logs. In posting the logs we can get an idea of what has been found and if we need to use any other tools.