svchost.exe keeps trying to access infected pages :/ help
Sann
✭
Hi
Not even sure if svchost is the main problem, sometimes it doesn't say that it's svchost. :/
Could someone help? What is svchost.exe trying to do? This looks very suspicious to me.
------------------------------------------------------------------
11 minutes ago
Feature:
Online Threat Prevention
We blocked this dangerous page for your protection:
Accessed by: svchost.exe
Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consent.
Infected webpage detected
11 minutes ago
Feature:
Online Threat Prevention
We blocked this dangerous page for your protection:
Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consent.
------------------------------------------------------------------------
why would svchost connect to googleapis?
I'd appreciate the input.
Comments
Same here, BD has been blocking the same webpage for the past couple of days. Must be a FP.
But what is that address? What are these things that make a Microsoft app access a google storage page...?
And later I noticed on Task Manager that Windows Explorer is using a constant 1 to 1.5 bandwidth. Never seen Windows Explorer using bandwidth before.
Edit: 1 to 1.5 Megabits that is
Bumping for an answer.
Me also.. checked around and it seems to be a legit process from Google that has also been know to being hijacked with false links to support sites. What's the story BD? Do we bypass or block?
Just noticed when I checked Google Settings - Extensions, that the Google Tasks shows https://www.googleapis.com/* but note that it shows this as a secure site https unlike the warning message from Bit Defender?????
Same strange alert here. Twice. Any answers here?
"We blocked this dangerous page for your protection:
http://storage.googleapis.com/update-delta/mimojjlkmoijpicakmndhoigimigcmbb/32.0.0.363/32.0.0.344/2508f55c6dcbf6f5492cc5476d08a68736d38f06c1028373d2dec53264604d3a.crxd
Accessed by: qengine.exe
Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consent"
Same strange alert here. Twice. Any answers here?
"We blocked this dangerous page for your protection:
http://storage.googleapis.com/update-delta/mimojjlkmoijpicakmndhoigimigcmbb/32.0.0.363/32.0.0.344/2508f55c6dcbf6f5492cc5476d08a68736d38f06c1028373d2dec53264604d3a.crxd
Accessed by: qengine.exe
Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consent"
Regarding the topic :
What is a global exclusion? Does that mean BD excludes these from searches or includes them as normal operation? Confused....
I get this hundreds of times a day.
Infected web page detected
2 minutes ago
Feature:
Online Threat Prevention
We blocked this dangerous page for your protection:
https://joyshoul.com/22bd1a92d57466cd6c.js
Threat name: JS:Adware.Lnkr.A
Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consenty.
@Lavyn The detection holds true. Many vendors detect the java script as malicious, including Kaspersky, Eset.
Have a look at below VT link
https://www.virustotal.com/gui/file/029d9a496765bc30b2dbbcd6ecf1467201bde1a1ac53efa9e39b41cf853cde3b/detection
Regards
Flex
For all others Members, this is to inform that the forum can only provide limited support.
If you are still facing the same issue , kindly drop an email to bitdefender support at [email protected] briefly explaining the problem you are experiencing.Response may be delayed due to less staff and covid19. Rest be assured, they will reply back asap.
Regards
Flex
(Bitdefender beta tester 2019/ 2020)