svchost.exe keeps trying to access infected pages :/ help

Sann · 2020-04-16T17:56:23+00:00

There was an error rendering this rich post.

Sann

Not even sure if svchost is the main problem, sometimes it doesn't say that it's svchost. :/

Could someone help? What is svchost.exe trying to do? This looks very suspicious to me.

------------------------------------------------------------------

11 minutes ago

Feature:

Online Threat Prevention

We blocked this dangerous page for your protection:

http://storage.googleapis.com/update-delta/hfnkpimlhhgieaddgfemjhofmfblmnib/5815/5814/be8213302b323da5fd68c2d13c3d2d6734454ff62d658782421326d3daa5663f.crxd

Accessed by: svchost.exe

Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consent.

Infected webpage detected

11 minutes ago

Feature:

Online Threat Prevention

We blocked this dangerous page for your protection:

http://storage.googleapis.com/update-delta/hfnkpimlhhgieaddgfemjhofmfblmnib/5815/5814/be8213302b323da5fd68c2d13c3d2d6734454ff62d658782421326d3daa5663f.crxd

Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consent.

------------------------------------------------------------------------

why would svchost connect to googleapis?

I'd appreciate the input.

Find more posts tagged with

Security

infection

Comments

cee_naa

Same here, BD has been blocking the same webpage for the past couple of days. Must be a FP.

Sann

But what is that address? What are these things that make a Microsoft app access a google storage page...?

Sann

And later I noticed on Task Manager that Windows Explorer is using a constant 1 to 1.5 bandwidth. Never seen Windows Explorer using bandwidth before.

Edit: 1 to 1.5 Megabits that is

M2020

Bumping for an answer.

NickW

Me also.. checked around and it seems to be a legit process from Google that has also been know to being hijacked with false links to support sites. What's the story BD? Do we bypass or block?

NickW

Just noticed when I checked Google Settings - Extensions, that the Google Tasks shows https://www.googleapis.com/* but note that it shows this as a secure site https unlike the warning message from Bit Defender?????

sarmour1

Same strange alert here. Twice. Any answers here?

"We blocked this dangerous page for your protection:

http://storage.googleapis.com/update-delta/mimojjlkmoijpicakmndhoigimigcmbb/32.0.0.363/32.0.0.344/2508f55c6dcbf6f5492cc5476d08a68736d38f06c1028373d2dec53264604d3a.crxd

Accessed by: qengine.exe

Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consent"

sarmour1

Same strange alert here. Twice. Any answers here?

"We blocked this dangerous page for your protection:

http://storage.googleapis.com/update-delta/mimojjlkmoijpicakmndhoigimigcmbb/32.0.0.363/32.0.0.344/2508f55c6dcbf6f5492cc5476d08a68736d38f06c1028373d2dec53264604d3a.crxd

Accessed by: qengine.exe

Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consent"

cee_naa

Regarding the topic :

NickW

What is a global exclusion? Does that mean BD excludes these from searches or includes them as normal operation? Confused....

Lavyn

I get this hundreds of times a day.

Infected web page detected

2 minutes ago

Feature:

Online Threat Prevention

We blocked this dangerous page for your protection:

https://joyshoul.com/22bd1a92d57466cd6c.js

Threat name: JS:Adware.Lnkr.A

Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consenty.

Flexx

https://community.bitdefender.com/en/discussion/comment/295638#Comment_295638

@Lavyn The detection holds true. Many vendors detect the java ****** as malicious, including Kaspersky, Eset.

Have a look at below VT link

https://www.virustotal.com/gui/file/029d9a496765bc30b2dbbcd6ecf1467201bde1a1ac53efa9e39b41cf853cde3b/detection

Regards

Flex

Flexx

For all others Members, this is to inform that the forum can only provide limited support.

If you are still facing the same issue , kindly drop an email to bitdefender support at bitsy@bitdefender.com briefly explaining the problem you are experiencing.Response may be delayed due to less staff and covid19. Rest be assured, they will reply back asap.

Regards

Flex

(Bitdefender beta tester 2019/ 2020)