Avast blocking URL svchost.exe

Viruses and worms
21

Yes, and this time more from chrome.exe.

22

Is it just Chrome now ?

23

I have only seen Chrome for the last 4 alerts.

24

OK could you now uninstall Chrome fully and then reboot before re-installing

25

Done. A bit troublesome to lose all bookmarks, but I guess it had to be done.

26

Have the alerts now ceased ?

27

Unfortunately not, I had an alert on Chrome.exe
But it seems alerts decreased a lot.

28

Do you have synch enabled as it may be that it is downloading the bad stuff as soon as you sign in

How to disable and delete synch data http://www.howtogeek.com/103655/how-to-delete-your-google-chrome-browser-sync-data/

Re-install Chrome

  1. If you have bookmarks, let’s save them by exporting them - Export Bookmarks
  2. Then I need you to go Google Sync and sign into your account
  3. Scroll down until you see the “Stop and Clear” button and click on the button. At the prompt click on “Ok”
  4. Now we need to uninstall chrome. Note: When asked about user data or settings you must remove this also so please check the box.
  5. Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
  6. Import your bookmarks back into Chrome
  7. Sign back in to your Chrome browser so that your bookmarks sync with your online account.
29

When going to the google.com/dashboard, it asks me to log in with my account. But I don’t have one… Should I create one ?

30

No if you do not have an account then it is not synching. Once you have completed could I have a fresh FRST scan please

31

Here you go, see attached.

32

Are the alerts still appearing ?

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\S-1-5-21-3777026070-661087563-4202175341-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION SearchScopes: HKU\S-1-5-21-3777026070-661087563-4202175341-1002 -> {350D3A74-F259-4AD7-BAC1-2CFC9E2AF85F} URL = http://www.baidu.com/baidu?tn=dealio_dg&wd={searchTerms} FF Plugin-x32: @baidu.com/npxbdsetup -> C:\Windows\Downloaded Program Files\345867055\npxbdsetup.dll No File FF Plugin-x32: @cmbchina.com/npcmbedit -> C:\Windows\system32\NPCMBEdit.dll No File 2015-03-01 09:32 - 2015-03-01 09:32 - 0000020 _____ () C:\Users\Ronan\AppData\Roaming\004D5649544E41696E66 Task: {E45BAFAD-A369-4FBB-AECF-7319610EA8F2} - \{202A373B-6B5D-4314-8BDA-D6D28EA4C4B5} No Task File <==== ATTENTION EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

33

Here you go.

Thanks,
Hed.

34

Are the alerts still there ?

35

Yes, still there

36

Could you confirm that they disappear when chrome is uninstalled from the system

37

No, they don’t disappear. And their number have considerably increased.

At the beginning it was once every hour.
Now it is around 60 warnings per hour minimum.

Starting to be really impacting my activities ;/

38

Could you attach a screenshot of the Avast alert please

39

Here you go

40

That IP is in China are you there perchance ? Beijing Teletron Telecom Engineering Co., Ltd.