After Norton claims it blocked an intrusion, svchost.exe process uses significant memory; did Norton really block it?

[Outlier]

When I start my computer, I get 2 Norton warnings: "An intrusion attempt by 31.3.239.140 was blocked" and there was a block from another computer as well.  Under details it says "Network traffic from maps.wiwuvy.ed:82/y3nx095hcc matches the signature of a known attack. The attack resulted from \DEVICE\HARDDISKVOLUME3\WINDOWS\SYSWOW64\SVCHOST.EXE

 

Norton says that no action is required and a Malwarebytes scan (including a scan for rootkit) shows up nothing.  So on the surface it seems everything might be ok, but when I go to Task Manager, look at the processes, a svchost.exe *32 process is taking up around 300,000k of memory. I've seen that fluctuate and go up to almost 1 GB at times.  That specific process usually takes up less than 20,000k (I've been keeping my eye on it for the last few days).  It seems to only increase significantly like that after these Norton warnings.  And the Norton warning itself says that the attack resulted from that specific file (svchost.exe).  Please tell me if I'm reading this wrong but if Norton is telling you that an attack resulted from a file in your computer (svchost.exe), and you see that process consume significant memory immediately afterwards, isn't that saying that there's already something wrong in your computer? (ie/ potentially infected)?

 

I'm using Windows 7 (SP1, 64 bit).  If anyone knows, please let me know if I'm worried for nothing.  I've kept a clean computer for many years & my pc's have very rarely have been infected so this is kind of freaking me out right now.

 

 

[LiquidTension]

Hello Outlier, welcome to Malwarebytes' Malware Removal forum!
 
My username is LiquidTension, but you can call me Adam. I will be assisting you with your malware-related problems.
If you would allow me to call you by your first name I would prefer that. 
 
General P2P/Piracy Notice: 
 

If you are using Peer to Peer (P2P) filesharing software such as uTorrent, BitTorrent or similar you must either fully uninstall or completely disable the programme(s) from running whilst receiving assistance at this forum. 
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked/keygen or similar software on the computer, please remove/uninstall the software now and read the policy on Piracy. Failure to do so will also result in your topic being closed.

 
======================================================
 
Please read through the points below to ensure this process moves as quickly and efficiently as possible.

• Please read through my instructions thoroughly, and ensure you carry out each step in the order specified.
• Please do not post logs using the CODE, QUOTE or ATTACHMENT format. Logs should be posted directly in plain text. If you receive an error whilst posting, please break the log in half and use multiple posts.
• Please do not run any tools or take any steps other than those I provide for you. Independent efforts may make matters worse, and will affect my ability in ascertaining the current situation & providing the best set of instructions for you.
• Please backup important documents before proceeding with my instructions.
• If you come across any issues whilst following my instructions, please stop and inform me of the issue in as much detail as possible. Please do not hesitate to ask before you run anything.
• Topics are locked if no response is made after 4 days. Please inform me if you will require additional time to complete my instructions.
• Ensure you are following this topic. Click  at the top of the page. 
   

======================================================

 

Lets check for rootkits first, and I'll then have you run a diagnostic scan to help ascertain the state of your computer.

 

STEP 1
 TDSSKiller Scan

• Please download TDSSKiller and save the file to your Desktop.
• Right-Click TDSSKiller.exe and select  Run as administrator to run the programme.
• Click Change parameters. Place a checkmark next to:
  • Loaded Modules
  • Detect TDLFS file system
  • Verify file digital signatures
• Note: If you receive the following message: Extended Monitoring Driver is required, click Reboot now, and continue from here following the reboot.
• ​Click Start Scan. Do not use the computer during the scan.
• If objects are found, change the action to skip.
• Click Continue and close the window.
• A log will be created and saved to the root directory (usually C:\). Attach the log in your next reply.

 

STEP 2
 aswMBR

• Please download aswMBR and save the file to your Desktop. 
• Temporarily disable your anti-virus software. For instructions, please refer to the following link.
• Right-Click aswMBR.exe and select  Run as administrator to run the programme.
• Click Yes when prompted to download avast! virus definitions. Wait until AVAST engine defs: ### appears. 
• If you are prompted to enable the use of "Virtualization Technology", click Yes.
• Click the AV Scan: drop down box and click C:\.
• Click Scan. 
• Upon completion, you will see Scan finished successfully. Click Save log. Save the log to your Desktop. 
• Re-enable your anti-virus software.
• Copy the contents of the log and paste in your next reply.

Note: Do NOT click Fix or FixMBR.
Note: A file (MBR.dat) will be created on your Desktop. Do NOT click or delete it.

 

 

======================================================

 
STEP 3
 Logs
In your next reply please include the following logs. Please be sure to copy and paste the requested logs, as well as provide information on any questions I may have asked.

• TDSSKiller log (attached)
• aswMBR log

[AdvancedSetup]

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!