Web Shield - JS:Miner- AV [trj]

[john1611]

Hi, I need some assistance.

We are struggling with two PC’s on the same network that keeps getting an Avast popup for a threat secured: JS:Miner-AV[Trj] detected in svchost.exe, the URL it tries to connect to changes constantly and a scan with Avast does not pick up anything. I’ve done full virus scans and a Boot scan, will attach the log files. I’ve also reset the routers and reset chrome.

[Asyn]

Start a topic in V&W and post your logs there: https://forum.avast.com/index.php?action=post;board=4
Instructions (basic diagnostic logs): https://forum.avast.com/index.php?topic=194892.0

[jursa]

@john1611 post:1

Hi, I need some assistance.

We are struggling with two PC’s on the same network that keeps getting an Avast popup for a threat secured: JS:Miner-AV[Trj] detected in svchost.exe, the URL it tries to connect to changes constantly and a scan with Avast does not pick up anything. I’ve done full virus scans and a Boot scan, will attach the log files. I’ve also reset the routers and reset chrome.

Hi, according to symtopms; detection: JS:Miner-AV[Trj] and the source process svchost, on two computers - it looks like that you have infected network and someone in the middle is inserting malicious javascript to legitimate traffic.

Could you please use curl/wget tools and printscreen the response from the following URL ? http://www.msftconnecttest.com/connecttest.txt

[john1611]

Hi,

Here is the response I got from onlinecurl.com

Thanks