The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host:
Chrome is not installed on that PC. Neither is there any suspicious process, service or task launched. I checked scheduled tasks, the registry (Run, RunOnce etc.), msconfig and boot-scripts: nothing suspicious. With Microsoft Message Analyzer I figured out the PID and processname, which are the same. The PID leads to svchost.exe (netsvcs). So my question is, how to go on behind svchost or how can I find the origin of that request? (If that is possible). I use Windows 7.