Windows 10: Malware bytes says it blocked an infected website and shows the file as svchost.exe

Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 5/29/23 Protection Event Time: 7:54 PM Log File: 78219d36-fe2c-11ed-a8f9-842afd4df612.json -Software Information- Version: 4.5.29.268 Components Version: 1.0.2022 Update Package Version: 1.0.70167 License: Trial -System Information- OS: Windows 11 Build 22621.1778 CPU: x64 File System: NTFS User: System -Blocked Website Details- Malicious Website: 1 , C:\Windows\System32\svchost.exe, Blocked, -1, -1, 0.0.0, , -Website Data- Category: Trojan Domain: IP Address: 116.68.97.75 Port: 59449 Type: Outbound File: C:\Window

:)

 

Svchost virus?

Did your antivirus provider identify the malware? If so, did you seek their advice?

You may want to send a copy of the file to VirusTotal for analysis. VirusTotal

Recommend you scan with the Emsisoft Emergency Kit (a free program): How to find and clean malware infections with Emsisoft Emergency Kit If
necessary boot into Safe Mode/Safe Mode with Networking to download and run the scanner or use another computer, put the EEK file on a flash drive and insert the flash drive in the infected computer...you can run the scanner from the flash drive. Other scanners
(some of which may be run in Safe Mode or from a flash drive) that may help with this issue are listed in List
of Malware Removal Tools

OR

IF this is what you are seeing, suggest you follow ALL of the steps (until the issue is resolved) in
this free removal guide https://malwaretips.com/blogs/svchost-exe-virus-removal/

But if you have this malware issue sometimes it will be necessary to reset your computer or do a clean install of the OS.

https://support.microsoft.com/en-us/help/12415/windows-10-recovery-options

Redirecting

Regards…

http://blog.emsisoft.com/2015/01/27/top-10-ways-pups-sneak-onto-your-computer-and-how-to-avoid-them/

 

malware bytes

Hello Bob

Thanks for posting Microsoft Community. I'm Marcos Independent Advisor.

Is Malware Bytes free version or Premiun?

If it is the Malware Bytes free version there should be no conflict, because they won't be doing the same work.

Malware Bytes free version runs as a periodic scanner, looking for malware, Windows Defender will be running as a real-time protection.

I suggest you testing both it should work well with Defender.

If you have Premiun Malware Bytes then It is not recommended to run more than one real-time Anti-Malware product. You should only chose to use one of them.

Hope it helps you let me know if you need further assistance.

Regards.

 

Malware using SysWOW64/svchost

I've done a lot of research, but haven't yet found a current solution to this.

I have Norton 360 protection, and when I block the svchost from running, all malware symptoms stop, yet blocking that creates new problems.

-The main symptom is an unnamed file running in Task Manager taking up 50-60% cpu, and clicking "open file location" takes you to SysWOW64/svchost.

-When on google chrome, a bunch of websites try to pop up or connect, but Norton blocks all of them. The most frequent one called "Bitcoin Miner6"

-About 20 "proxychecker"s were in the TM, which I blocked with Norton without bad side-effects.

-Blue Screen of deaths were often early on, about 15 mins and every time I tried restarting my computer.

All these were stopped by Norton, though the main file can be still found in TM, but it uses hardly any cpu. It seems to need internet connection to work (when I don't have Norton block it), and is run by SysWOW64 about 30sec after startup, possibly as a
dll.

Anyway Norton can't find it no matter what, and running my computer without svchost is annoying.