Problem: Malicious website blocked, inbound, due to svchost.exe

[question123]

Hello,

 

I have a problem with different websites (didn´t check, where the IPs are actually located) being blocked

by malwarebytes (svchost.exe). Have already tried some stuff, but the problem still shows, although ordinary virus and rootkit-scans are negative. But my IT-skills are by far not good enough for trying further without advice. I would really appreciate some help. Thank you!

[TwinHeadedEagle]

Hello,
    
 
They call me TwinHeadedEagle around here, and I'll be working with you.
 
    
 
    
Before we start please read and note the following:
    
Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
Please be patient. I know it is frustrating when your PC isn't working properly, but malware removal takes time.
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
Do not paste the logs in your posts, attachments make my work easier. There is a Attach Files option below which you can use to attach your reports. Always attach reports from all tools.
Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
Note that we may live in totally different time zones, what may cause some delays between answers.
Do not ask for help for your business PC. Companies are making revenue via computers, so it is good thing to pay someone to repair it.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
    
I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
 
 
 
 
P2P/Piracy Warning:

• If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
• Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
• If you have illegal/cracked software, cracks, keygens, etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

 

 

Please download Farbar Recovery Scan Tool and save it to your desktop.
 
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.
Only one of them will run on your system, that will be the right version.

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[question123]

Hello!

 

Thank you very much!

Finally found out how to get the attach-file option...

files attached...

Addition.txt

FRST.txt

[TwinHeadedEagle]

Who told you to run ComboFix?
 
WARNING!!! ComboFix is complex and very powerfull tool, that is able to destroy your system completely if run in wrong hands. It is not intended for everyday use. It should be run only when asked and under guidance by trained malware removal expert. Don't run ComboFix on your own!!!
 
 
I would like to see ComboFix report, usually located at C:\ or C:\Qoobox
 
 
 
Fix with Farbar Recovery Scan Tool
 

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable.

 
Download attached fixlist.txt file and save it to the Desktop:
 
Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on icon and select Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.
 
 
 
 

Fix with AdwCleaner
 
Please download AdwCleaner by Xplode and save the file to your desktop.

• Right-click on icon and select Run as Administrator to start the tool.
• Follow the prompts and click Scan.
• When finished, please click Clean.
• Upon completion, click Report. A log (AdwCleaner[s*].txt) will open.

Please include the contents of that file in your reply.

fixlist.txt

[question123]

That was what I meant with "tried some stuff". It was not the smartest thing, I know.

I also had an Adwcleaner-run yesterday.

So both logs are attached.

In addition I attach the Adwcleaner run from just a few minutes ago.

Plus the Fixlog.

Sorry if my actions yesterday make it more difficult for you... I will not do something like

this again without assistance or really knowing what I´m doing... hope I did not destroy 

something.

AdwCleanerS0.txt

AdwCleanerS1.txt

Combo-Fix_report.txt

Fixlog.txt

[TwinHeadedEagle]

How is your computer now?

[question123]

The computer is ok. The last pop-up with "malicious website blocked" is one and a half hours ago.

Do the logs look ok?

[TwinHeadedEagle]

Yes, your logs appear clean

 

 

 

Below you will find my thoughts about securing your machine. Go ahead through it, you will benefit from some useful advice about safe computing.

 

 

Recommended reading:

MUST READ - security tips: Computer Security - a short guide to staying safer online.Simple and easy ways to keep your computer safe and secure on the Internet

MUST READ - general maintenance: What to do if your Computer is running slowly?

 

 

 

Recommended additional software:

TFC - to clean unneeded temporary files.

Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware.

Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities.

McShield - to prevent infections spread by removable media.

CryptoPrevent - to secure yourself from very severe CryptoLocker infection.

Unchecky - to prevent from installing additional foistware, implemented in legitimate installations.

 

 

• The following will implement some post-cleanup procedures:

 

=> Please download DelFix by Xplode to your Desktop.

 

Run the tool and check the following boxes below;

Remove disinfection tools

Create registry backup

Purge System Restore

Click Run button and wait a few seconds for the programme completes his work.

At this point all the tools we used here should be gone. Tool will create an report for you (C:\DelFix.txt)

 

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix

Tool deletes old system restore points and create a fresh system restore point after cleaning.

 

 

My help is free for everybody.

If you're happy with the help provided and/or wish to buy me a beer for the assistance you received, then you can consider a donation:

Thank you!

 

 

 

Stay safe,

TwinHeadedEagle

[question123]

Thank you very much! :-)

[question123]

Unfortunately had a pop-up with "malicious website blocked, svchost.exe" again...

any ideas? or is it best to format everything?

[TwinHeadedEagle]

Please download Farbar Recovery Scan Tool and save it to your desktop.

 

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them.

Only one of them will run on your system, that will be the right version.

 

• Double-click to run it. When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.

The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

[question123]

ok, I attached the file. Thank you again for your reply

FRST.txt

Addition.txt

[TwinHeadedEagle]

PC is clean. When does this happen?

 

Try to reset your router/modem to factory settings.

[question123]

once in one or two hours... noticed it mainly in the evenings because that´s when the computer is turned on for longer times...

how do I do the router re-setting? is there some recipe?

[TwinHeadedEagle]

Do you know your router/modem manufacturer and model?

[question123]

it´s an old model, see info

info.txt

[question123]

I reset it. So I will watch what happens in the next few hours...

Thanks

[question123]

also after reset: same problem...

[TwinHeadedEagle]

Does it happen when you use browsers or regardless of what you are doing?

[question123]

have to check this...

[question123]

not directly connected to browser... happens also when browsers not open...

[AdvancedSetup]

Sorry to step in but please post your MBAM protection logs from the past couple of days. Inbound IP blocks are not an infection and typically not much one can do to stop them except ensure the firewall is working well and if wanted specifically add those IPs to the firewall block list. But unrequested inbound IP probes should already be blocked in most cases by the firewall.

[question123]

ok. Here are the protection logs for the last two days. always looked like this...

Thanks!

protection_logs.txt

protection_logs_1.txt

[AdvancedSetup]

Yes, those are just inbound IP blocks. There is no infection on your computer. As said you can specifically add those IP addresses to your firewall but it should already block non requested incoming probes like that.

[question123]

Thank you very much for your advice and information!