14

The firewall of my company has detected and blocked a repetitive (every 15 min) HTTP request from a PC, which tries to start a download of a file called ..._chrome_installer.exe(or so) from the host:

http://r9---sn-4g57kner.gvt1.com

Chrome is not installed on that PC. Neither is there any suspicious process, service or task launched. I checked scheduled tasks, the registry (Run, RunOnce etc.), msconfig and boot-scripts: nothing suspicious. With Microsoft Message Analyzer I figured out the PID and processname, which are the same. The PID leads to svchost.exe (netsvcs). So my question is, how to go on behind svchost or how can I find the origin of that request? (If that is possible). I use Windows 7.

  • You are most likely infected by a rootkit. Reinstall from backup... – Deer Hunter Jul 15 '15 at 12:07
  • possible duplicate of How do I deal with a compromised server? – Deer Hunter Jul 15 '15 at 12:08
  • This question as asked (how to discover what called svchost), appears more to be a Windows-internals-specific question, and might be better asked over at SuperUser (despite viruses being a factor). If the reeal question you're asking is how to deal with this infection, then @DeerHunter has your answer. – schroeder Jul 15 '15 at 14:50
  • Thanks for your reply DeerHunter. At superuser.com i was told that that question might be better at security.stackexchange. – JohannSchwarz Jul 16 '15 at 6:14
  • In Task Manager on the Services tab you can sort by PID and see which services are running in a particular svchost.exe process, and you can stop each service to see which one results in the network requests stopping. But as @DeerHunter said, it's probably a virus. – dave_thompson_085 Jul 16 '15 at 12:41
9

I found the origin. Both Answers have given me the right indications to go on. With ProcessExplorer i picked the right svchost process (the same PID) and opened the TCP/IP tab, with wireshark i waited for the request, as it was sent, the TCP/IP tab from ProcessExplorer showed me the service wich was trying to establish a connection: BITS Service (Background Intelligent Transfer Service). I opened cmd and with

BITSAdmin /List [/allusers] [/verbose]

i listed all jobs. And there we have the crux of the matter. All full with jobs from google-update. The files listed for each job pointed to a non-existing google-update.exe. So i think the first answers might is right, that this is not a virus. I don't know why there were 9 google-update jobs and nothing else. I deleted all. Since then the requests are gone.

  • 1
    For reference, on OS X this domain is also used to update Google software (Google Software Update via ksfetch): ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent The domain does look suspicious, but it's legit, Google owned: who.is/whois/gvt1.com – Vexter Jun 18 '16 at 9:39
8

It seems that "gvt1.com" its owned by Google (whois shows:)

Registrant Name: DNS Admin
Registrant Organization: Google Inc.
Registrant Street: 1600 Amphitheatre Parkway
Registrant City: Mountain View
Registrant State/Province: CA
Registrant Postal Code: 94043
Registrant Country: US
Registrant Phone: +1.6506234000
Registrant Phone Ext: 
Registrant Fax: +1.6506188571
Registrant Fax Ext: 
Registrant Email: dns-admin@google.com

And checking the location of that specific domain (r9---sn-4g57kner.gvt1.com) points to near San Francisco (which matches).

Checking further, it shows a relation between "gvt1.com" and "googlevideo.com" (example: https://github.com/lennylxx/ipv6-hosts/wiki/YouTube) and chromium, for example: https://code.google.com/p/chromium/issues/detail?id=423590

Google site check: http://google.com/safebrowsing/diagnostic?site=gvt1.com/

I'm almost sure its not a virus but something related to a Google service. (look for "gvt1.com" in google, you will find many more links)

  • It's good to know the owner of the URL: virustotal.com/en/url/… but I'm not sure this answers the OP's question. – schroeder Jul 17 '15 at 2:53
  • 1
    This is likely to be Google Update process that is scheduled to run every 15min on computers with Google Chrome installed or improperly removed. To view the process behind, OP can install, for example, Svchost viewer. – Question Overflow Jul 17 '15 at 3:31
  • 1
    I would start by looking at any Google related software installed in that computer. As "Question Overflow" suggested, some google related update (perhaps running as system service). If you can't find anything, you can check the network interface with something like wireshark to know the exact URL and information being posted there (as its HTTP, should be clear) to narrow it. – lepe Jul 17 '15 at 4:04
2

Go to sysinternals and install a trace tool. Record 20m of activity and locate that request. Then go back to the orign of that request.

  • I will try that on monday – JohannSchwarz Jul 17 '15 at 23:01
  • @JohannSchwarz Last time I used that it was called ProcMon – Nils Jul 18 '15 at 13:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.