15

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host:

http://r9---sn-4g57kner.gvt1.com

Chrome is not installed on that PC. Neither is there any suspicious process, service or task launched. I checked scheduled tasks, the registry (Run, RunOnce etc.), msconfig and boot-scripts: nothing suspicious. With Microsoft Message Analyzer I figured out the PID and processname, which are the same. The PID leads to svchost.exe (netsvcs). So my question is, how to go on behind svchost or how can I find the origin of that request? (If that is possible). I use Windows 7.

7
  • You are most likely infected by a rootkit. Reinstall from backup... Jul 15, 2015 at 12:07
  • possible duplicate of How do I deal with a compromised server? Jul 15, 2015 at 12:08
  • This question as asked (how to discover what called svchost), appears more to be a Windows-internals-specific question, and might be better asked over at SuperUser (despite viruses being a factor). If the reeal question you're asking is how to deal with this infection, then @DeerHunter has your answer.
    – schroeder
    Jul 15, 2015 at 14:50
  • Thanks for your reply DeerHunter. At superuser.com i was told that that question might be better at security.stackexchange.
    – Kuronashi
    Jul 16, 2015 at 6:14
  • In Task Manager on the Services tab you can sort by PID and see which services are running in a particular svchost.exe process, and you can stop each service to see which one results in the network requests stopping. But as @DeerHunter said, it's probably a virus. Jul 16, 2015 at 12:41

3 Answers 3

9

I found the origin. Both Answers have given me the right indications to go on. With ProcessExplorer i picked the right svchost process (the same PID) and opened the TCP/IP tab, with wireshark i waited for the request, as it was sent, the TCP/IP tab from ProcessExplorer showed me the service wich was trying to establish a connection: BITS Service (Background Intelligent Transfer Service). I opened cmd and with

BITSAdmin /List [/allusers] [/verbose]

i listed all jobs. And there we have the crux of the matter. All full with jobs from google-update. The files listed for each job pointed to a non-existing google-update.exe. So i think the first answers might is right, that this is not a virus. I don't know why there were 9 google-update jobs and nothing else. I deleted all. Since then the requests are gone.

1
  • 1
    For reference, on OS X this domain is also used to update Google software (Google Software Update via ksfetch): ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent The domain does look suspicious, but it's legit, Google owned: who.is/whois/gvt1.com
    – Vexter
    Jun 18, 2016 at 9:39
8

It seems that "gvt1.com" its owned by Google (whois shows:)

Registrant Name: DNS Admin
Registrant Organization: Google Inc.
Registrant Street: 1600 Amphitheatre Parkway
Registrant City: Mountain View
Registrant State/Province: CA
Registrant Postal Code: 94043
Registrant Country: US
Registrant Phone: +1.6506234000
Registrant Phone Ext: 
Registrant Fax: +1.6506188571
Registrant Fax Ext: 
Registrant Email: dns-admin@google.com

And checking the location of that specific domain (r9---sn-4g57kner.gvt1.com) points to near San Francisco (which matches).

Checking further, it shows a relation between "gvt1.com" and "googlevideo.com" (example: https://github.com/lennylxx/ipv6-hosts/wiki/YouTube) and chromium, for example: https://code.google.com/p/chromium/issues/detail?id=423590

Google site check: http://google.com/safebrowsing/diagnostic?site=gvt1.com/

I'm almost sure its not a virus but something related to a Google service. (look for "gvt1.com" in google, you will find many more links)

3
  • It's good to know the owner of the URL: virustotal.com/en/url/… but I'm not sure this answers the OP's question.
    – schroeder
    Jul 17, 2015 at 2:53
  • 1
    This is likely to be Google Update process that is scheduled to run every 15min on computers with Google Chrome installed or improperly removed. To view the process behind, OP can install, for example, Svchost viewer. Jul 17, 2015 at 3:31
  • 1
    I would start by looking at any Google related software installed in that computer. As "Question Overflow" suggested, some google related update (perhaps running as system service). If you can't find anything, you can check the network interface with something like wireshark to know the exact URL and information being posted there (as its HTTP, should be clear) to narrow it.
    – lepe
    Jul 17, 2015 at 4:04
2

Go to sysinternals and install a trace tool. Record 20m of activity and locate that request. Then go back to the orign of that request.

2
  • I will try that on monday
    – Kuronashi
    Jul 17, 2015 at 23:01
  • @JohannSchwarz Last time I used that it was called ProcMon
    – Nils
    Jul 18, 2015 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.