svchost/services.exe accessing Internet?

Discussion in 'Malware Help (A Specialist Will Reply)' started by BrianB, May 16, 2006.

  1. BrianB

    BrianB Private E-2

    Windows XP SP1.

    I am seeing both Services.exe and SVCHOST.exe accessing the internet. More than just DNS, too. Services.exe is querying GOOGLE.com with apparent random search strings (e.g. ?processor+love). But consistently goes to ftp.icq.com and does a GET /pub/ICQ_Win95_98_NT4/ICQ5/icq5_setup.exe. SVCHOST.exe also accesses random sites. Sites I have never visited.

    This primarily occurs when I first login to Windows. Virus scans have not fixed it. I ran CCleaner, AD-Aware, SPYBot, MS Malicious SW removal tool, CounterSpy, Bitdefender and Panda.

    I use Ethereal and SYSInternal's ProcessExplorer to watch the behavior. I am not seeing any process running in Procexplorer while this occurs.

    Anyone have clues on what is causing this?

    Regards,
    brian
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Welcome to Majorgeeks!

    Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.
    • Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
    • Make sure you check version numbers and get all updates.
    • Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.
    • After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:
    • When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)
      • Bitdefender
      • Panda Scan
      • HijackThis
    .Question: Do you use ICQ?
     
  3. BrianB

    BrianB Private E-2

    Thanks for the reply.

    I had followed all the "RUN and README First" process -- it was extremely valuable -- kudos to all who spent the time to create it. Didn't want to post the Bitdefender/Panda/HijackThis logs until I saw others replying they had the same issues with svchost and services.

    The problem appears to have cleared up --- for now. I'm continuing to watch.
    I'm thinking running the process a second time in non-safe mode may have did it.

    I do not use ICQ.

    FYI - I was a bit confused at which "step" I should turn off System Restore and reboot then turn it back on. I did it after step 6.

    Regards and thanks for your time and effort in maintaining this forum.

    brian
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. It is only supposed to be toggle after you are clean. That does not necessarily mean after running the READ ME. In normal cases where the steps are followed and we help a user manually clean other malware from the PC that the READ ME did not remove, we tell the user when they are clean and when to toggle System Restore. It is the next to the last thing we tell everyone to do before leaving. The last things to do is what I'm going to tell you now (if you are sure you are clean):

    If you are not having any other malware problems, you should work thru the below link:

    How to Protect yourself from malware!
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds