[Resolved] Possible Backdoor, svchost.exe connecting to external

1) What do you mean by only working w/ IE ??? Like must I never use Firefox again :S This is worth of a format IMO Bonjour: Yeah I use bonjour sometimes I upload iMixes for my buddys, but I guess I could delete it. 2) Can you kinda detail what exactly combofix did, you dont need to put it in n00b terms, Ive got a pretty good understanding of computers im just nervous about these kinds of things. 3) This would be considered a false positive, right? How would I go about reporting it to ad aware? 4) This seemed to mess up my custom theme, and a few things when I right click (shell folders I think they are called). Will this go away, just reinstall the theme etc? 5) What was my svchost.exe doing in the first place, connecting to outside IP addresses? Could it have been a hack attempt?

BTW.. Im planning on uninstalling all the freeware I used to scan, cclean registry and temp files, then defrag. Is that right or do I need to do more to get my PC back to normal Sorry for the ridiculous amounts of edits but im trying to save you some time. This is what I could find on the side effects of combofix, is this right? —————————– 1.) IE homepage: No big deal to "fix this". You go to Start Button -> CONTROL PANEL (use CLASSIC VIEW, it's easier imo) -> Internet Options -> General Tab & HOMEPAGE (here is where you change that). 2.) System Time (rightclick on timeclock in lower righthand side of your screen, & from its POPUP menu, use the Date/Time tool) 3.) Desktop wallpaper (easy to fix: Rightclick on Desktop, use properties menu, & the desktop tab, change your background wallpaper there) —————————– I dont use IE and the other 2 seem to be nonexistant.. are there any more "side effects

Oh Sh*t. I didnt save combofix to my desktop when it ran.. would that have caused issues with the test?

Oh Sh*t.
I didnt save combofix to my desktop when it ran.. would that have caused issues with the test?

No. That would only cause issues if we need to use it to remove something.

1.) IE homepage: No big deal to "fix this". You go to Start Button -> CONTROL PANEL (use CLASSIC VIEW, it's easier imo) -> Internet Options -> General Tab & HOMEPAGE (here is where you change that).

2.) System Time (rightclick on timeclock in lower righthand side of your screen, & from its POPUP menu, use the Date/Time tool)

3.) Desktop wallpaper (easy to fix: Rightclick on Desktop, use properties menu, & the desktop tab, change your background wallpaper there)

Combofix will only run using IE. You can continue using FF. 1,2 and 3 are correct.

2) Can you kinda detail what exactly combofix did, you dont need to put it in n00b terms, Ive got a pretty good understanding of computers im just nervous about these kinds of things.

3) This would be considered a false positive, right?
How would I go about reporting it to ad aware?

4) This seemed to mess up my custom theme, and a few things when I right click (shell folders I think they are called).
Will this go away, just reinstall the theme etc?

5) What was my svchost.exe doing in the first place, connecting to outside IP addresses? Could it have been a hack attempt?

2. CF looks for malware signatures. 3. It might not have been a FP. It's possible it was active and your AV caught and removed it. As you know when changes are made, Windows creates a restore point, so that file is in that restore point. 4. Re-install the theme

ok thanks for all the help bro =D I uninstalled everything, and CF is standalone i assume so im good in terms of no remaining stuff? (Ive heard that RUN: combofix /u just removes backup files, and since I didnt remove anything it would be redundant) I ccleaned, defragged, reinstalled theme and everything seems back to normal.

Everything looks good to me

ok thanks bro! Hopefully next time I can handle this on my own too. Guess you can lock this now, ill get it reopened if anything weird starts happening again.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.