Jump to content

svchost.exe Blocking Incoming Connections

Valor

By Valor
in Resolved Malware Removal Logs

 Share

Recommended Posts

Valor

Valor

Posted
Posted

Detection, 6/16/2015 12:48:53 PM, SYSTEM, J-PC, Protection, Malicious Website Protection, IP, 89.248.171.135, 1900, Inbound, C:\Windows\System32\svchost.exe,
Detection, 6/16/2015 12:48:54 PM, SYSTEM, J-PC, Protection, Malicious Website Protection, IP, 89.248.171.135, 1900, Inbound, C:\Windows\System32\svchost.exe,
Detection, 6/16/2015 12:54:57 PM, SYSTEM, J-PC, Protection, Malicious Website Protection, IP, 89.248.171.135, 1900, Inbound, C:\Windows\System32\svchost.exe,

 

 

I got these three, and maybe more to come, very close together. I know that this is Malwarebytes doing it's job(blocking the connections), but I want to get rid of the source of whatever is causing these pop-ups. Is this anything to be concered about in the first place? I am grateful for your assistance. Cheers. :D

 

 

FRST.txt

Addition.txt

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Hello Valor! My name is Borislav and I will be glad to help you solve your malware problem.

Please note:

  • If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.
  • I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.
  • Make sure you read all of the instructions and fixes thoroughly before continuing with them.
  • Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.
  • Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.
  • Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.
Step 1

Download attached fixlist.txt file and save it to the Desktop.

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

Step 2

Please update Malwarebytes Anti-Malware and perform a threat scan. Post your log file.

In your next reply, post the following log files:

  • FRST log
  • Malwarebytes' Anti-Malware log

fixlist.txt

Link to post
Share on other sites
Valor

Valor

Posted
  • Author
Posted

Thank you, Borislav.

MBAM scan came back clean, about to run the Fixlist. I received a PM from a user telling me that he inspected the FRST logs and noticed that the DNS server was 192.168.0.1. Could this mean that my router has an infection on it? Please help. Have a good day.

Link to post
Share on other sites
Valor

Valor

Posted
  • Author
Posted

I got a popup right before I ran the fix.

Detection, 6/18/2015 4:04:21 AM, SYSTEM, J-PC, Protection, Malicious Website Protection, IP, 89.248.171.135, 1900, Inbound, C:\Windows\System32\svchost.exe,
Detection, 6/18/2015 4:04:21 AM, SYSTEM, J-PC, Protection, Malicious Website Protection, IP, 89.248.171.135, 1900, Inbound, C:\Windows\System32\svchost.exe,

Attached log it the fix.

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Note: Please do not run this tool without special supervision and instructions of someone authorized to do so. Otherwise, you could end up with serious problems. For more details, read this article: ComboFix usage, Questions, Help? - Look here

Please visit this webpage and read the ComboFix User's Guide:

  • Once you've read the article and are ready to use the program you can download it directly from the link below.
  • Important! - Please make sure you save combofix to your desktop and do not run it from your browser
  • Direct download link for: ComboFix.exe
  • Please make sure you disable your security applications before running ComboFix.
  • Once Combofix has completed it will produce and open a log file. Please be patient as it can take some time to load.
  • Please copy/paste the contents or attach that log file to your next reply.
  • If needed the file can be located here: C:\combofix.txt
  • NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.
Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Please scan your machine with ESET OnlineScan

  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.

    ESET OnlineScan

  • Click the esetonlinebtn.png button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on esetsmartinstaller_enu.exe to download the ESET Smart Installer.

      Save it to your Desktop.

    • Double click on the esetsmartinstaller_enu.png to download the ESET Smart Installer. icon on your Desktop.
  • Check "YES, I accept the Terms of Use."
  • Click the Start button.
  • Accept any security warnings from your browser.
  • Under Scan Settings, check "Scan Archives" and "Remove found threats"
  • Click Advanced settings and select the following:
    • Scan potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, click List Threats
  • Click Export, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Click the Back button.
  • Click the Finish button.
In your next reply, post the following log files:
  • ESET Online Scanner log
  • a new fresh FRST log
Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Download attached fixlist.txt file and save it to the Desktop.

NOTE. It's important that both files, FRST/FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST/FRST64 and press the Fix button just once and wait.

If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.

When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

fixlist.txt

Link to post
Share on other sites
  • 3 weeks later...
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.