+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: [Check-Up] MWB Blocking connections to svchost.exe (/showthread.php?tid=4601331)
Pages: Pages
1
2
MWB Blocking connections to svchost.exe - 001001 - Dec 25, 2014
Hey I am not sure if I am infected but I am experiencing things I have not before.
I own MWB and have the live web blocking on and am getting connections to svchost.exe being blocked. Plus there has been a few times that it looked like a program has opened and closed really fast. Things are also going a little slower.
Quick/Threat scan finds nothing.
Code
Malicious Website Protection, IP, 93.190.109.37, 59243, Inbound, C:\Windows\System32\svchost.exe,
Malicious Website Protection, IP, 93.190.109.37, 59243, Inbound, C:\Windows\System32\svchost.exe,
Protection, Malicious Website Protection, IP, 93.190.109.37, 59243, Inbound, C:\Windows\System32\svchost.exe,* - Aura - Dec 25, 2014
Malwarebytes Web Protection module is known to throw a lot of false positives on processes like svchost.exe, chrome.exe, skype.exe, utorrent.exe. The best thing to do is to ignore it or simply disable it and leave web protection in the hand of your Antivirus product and your Firewall. This is the 10,000th thread on the subject here. Thread closed.
* - Null Byte - Dec 25, 2014
Do you have any Russian software? Because the IP belongs to a Russian company called Sibirskie Seti Ltd. I think we should do a checkup for malware if it's ok with you.
* - 001001 - Dec 25, 2014
Yea I don't have any Russian software that I know of.
* - Aura - Dec 25, 2014
(Dec 25, 2014 08:25 PM)001001 Wrote: Yea I don't have any Russian software that I know of.
What are you doing exactly on your system when that connection is being prompted?
* - 001001 - Dec 25, 2014
(Dec 25, 2014 08:44 PM)Aurа Wrote: What are you doing exactly on your system when that connection is being prompted?
That has happened during watching a movie, browsing online, playing a steat game. Nothing that I at the moment can think of is common to each time I've seen it pop up.
* - Aura - Dec 25, 2014
(Dec 25, 2014 09:39 PM)001001 Wrote: That has happened during watching a movie, browsing online, playing a steat game. Nothing that I at the moment can think of is common to each time I've seen it pop up.
To be honest, just the "browsing online" could have triggered that alert if you were on a website that loads content from a Russian server or else. It's way too vague to see if you're indeed infected or not. Does Malwarebytes detects anything with a Threat Scan?
* - 001001 - Dec 25, 2014
No it does not. It has happened with nothing opened and an idle PC while I was watching tv.
* - Aura - Dec 25, 2014
(Dec 25, 2014 09:52 PM)001001 Wrote: No it does not. It has happened with nothing opened and an idle PC while I was watching tv.
Then it's caused by a background process or service running. What services do you have running under svchost.exe?
* - jonas99 - Dec 29, 2014
Russians trying to hack you... scan your pc :) Antivirus :)
* - Aura - Dec 29, 2014
(Dec 29, 2014 04:05 PM)jonas99 Wrote: Russians trying to hack you... scan your pc :) Antivirus :)
Stop fucking shitposting in this section.
* - 001001 - Dec 29, 2014
I have quite a few running, like 7 svchosts. Looked like audio software. I have the firewall and av, is there and up to date. You say it should be fine then I will assume I was wrong.
* - Aura - Dec 29, 2014
(Dec 29, 2014 10:11 PM)001001 Wrote: I have quite a few running, like 7 svchosts. Looked like audio software. I have the firewall and av, is there and up to date. You say it should be fine then I will assume I was wrong.
For me you're fine, since a single connection doesn't prove anything. What if one of the background service updates from a server in Russia. Even if the possibility is low, it still is possible. Without any concrete detections or logs, there's not much that we can do.
* - 001001 - Dec 29, 2014
(Dec 29, 2014 10:12 PM)Aurа Wrote: For me you're fine, since a single connection doesn't prove anything. What if one of the background service updates from a server in Russia. Even if the possibility is low, it still is possible. Without any concrete detections or logs, there's not much that we can do.
There are other ip's that it blocks but nothing has been tampered with or logged under other ip's. Did pass changes and such. No threats as of the firsfirst post as well.
* - Aura - Dec 29, 2014
(Dec 29, 2014 10:19 PM)001001 Wrote: There are other ip's that it blocks but nothing has been tampered with or logged under other ip's. Did pass changes and such. No threats as of the firsfirst post as well.
I would leave all the web protection/traffic in the ends of your Antivirus product/Firewall. Malwarebytes classify as "suspicious" IP addresses it doesn't know.