Another Inbound connection to svchost.exe user

[MHoroszowski]

Hello there and thank you for your time and efforts!

Like many others I seem to be having inbound connection being blocked from a few different IPs, going to snchost.exe.

I'm attaching the FRST scan, the Addition file, as well as a few of the logs of the Compromised events from MalwareBytes.

Anything I can do to resolve this issue, please let me know, and thanks again in advance.

FRST.txt Addition.txt inbound svchost blocked 2.txt inbound svchost blocked 3.txt inbound svchost blocked.txt

[Maurice Naggar]

Hi,   
My name is Maurice. I will be helping and guiding you, going forward on this case.
Let me know what first name you prefer to go by.

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me.

 

Thank you for the reports.  Those are logs of Block events.   The program is keeping your machine safe from external threats.

 

The Block notices from Malwarebytes web protection do mean that Malwarebytes Premium is keeping your pc safe from potential harm. 

A block notice is an advisory of the "block". 

 

It  indicates that a potential risk was blocked by the malicious website protection.  

The Malwarebytes web protection, by default, will always show each  block occurrence. 

The Malwarebytes Web protection feature will advise customers when a known or suspected malicious IP is attempted to be reached (outgoing) or is trying access your PC. 

  

See our info page https://www.malwarebytes.com/lp/ip-blocking/?ipblock=true 

  

Incoming block notice can be ignored, the Malwarebytes Premium real-time protection is blocking the threat and there is nothing more that can be done. 

On Outbound blocks, any attempted connection was stopped. 

[MHoroszowski]

Thank you Maurice! Sounds like this is not an issue. I appreciate the feedback!

[Maurice Naggar]

Hello ( again).

Since this is a Pro edition of Windows   (  Windows 10 Pro Version 1909 18363.900 (X64)  one of the first suggestions I would have, if you do not need, nor use the Remote Desktop option,  then to turn it off.   Because it is quite possibly attempts are ongoing to see if it ( remote desktop) can be compromised.

See the top part of this knowledge base article

Check that out.  Let me know if you can turn off RDP.

On my next replies I am going to lead you thru some scans   ( though I expect that this machine does not actually have a on-board "infection"

All what it is , is that ( possibly) some attempted probes are being made on your machine.

[Maurice Naggar]

[ reply 3 \

If you absolutely do not need them at this time, EXIT out of any online games,  Steam, and Discord.

+

Close all web browsers before you press "scan" on this next scan.

 

Run a scan with Malwarebytes.
Start Malwarebytes from the Windows  Start menu.

Click Settings ( gear icon)   at the top right of Malwarebytes window.   We want to see the SETTINGS window.

Then click the SECURITY  tab.
Scroll down and lets be sure the line in SCAN OPTIONs for "Scan for rootkits" is ON
Click it to get it ON  if it does not show a blue-color

Now click the small X  to get back to the main menu window.

Click the SCAN button.
Select a Threat Scan ( which should be the default).

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

Then click on Quarantine selected.

 

Be sure all items were removed. Then too, Repeat the scan one more time. It does not take long.

and again, be sure all detected items are removed.

Let it remove what it has detected.

 

[MHoroszowski]

I do make use of remote desktop, but likely can only turn it on when I do need it before leaving my house. Its good to understand that the inbound connections to svchost are going to that.

[Maurice Naggar]

ok.  Still, look at the top of the article on tips for How to protect your RDP access from ransomware attacks

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you