svchost.exe (Microsoft Publisher) --> Malicious (Proc.Svchost)

[Sergio]

Hola, mi RogueKillerCMDX64 me detecta (Proc.Svchostt) y no se como eliminar, me dice Acción, Kill 6500.

Gracias

[Curson]

Hi Sergio,

Welcome to Adlice.com Forum.
Could you please attach RogueKiller JSON report with your next reply ?

Regards.

[Sergio]

http://imgur.com/a/93H6G

la estaba buscando. Pero gracias

[Curson]

Hi Sergio,

That's not it.
Please launch RogueKillerCMD with the following arguments :

Code: [Select]

-scan -params "-reportpath """C:\report.json""""
A new file named report.json should now be present at the root of your drive.
Please attach it with your next reply.

Regards.

[Sergio]

Ahora no aparece nada, eso es lo que sale en el json

https://mega.nz/#!XQFllKzT!zJSyexnKZCo6qHnvzBviBrgh5h8gNgXvECn4ICLyUGw

[Curson]

Hi Sergio,

According to the report, it was a false alarm.
Don't hesitate to repost if the [Proc.Svchost] detection is triggered again.

Regards.

[Sergio]

Estaba en lo cierto, ha sido el Firewall.

Ahí el nuevo scaneo con los 4 detectados.

https://mega.nz/#!SZN2VCpD!bNG_zlA04p1DiVe7pZqf9Jo7wGCzPeP8zdD2wP8FMjw

[Sergio]

Hola, lo han visto?.

[Curson]

Hi Sergio,

According to the report, these processes are safe :

                "name": "svchost.exe",
                "name_parent": "cmdvirth.exe",
                "pid": 6012,
                "path": "C:\\Windows\\System32\\svchost.exe",
                "command_line": "C:\\WINDOWS\\system32\\svchost.exe -k LocalService",
                "pid_parent": 5492,
                "path_parent": "C:\\Program Files\\COMODO\\COMODO Internet Security\\cmdvirth.exe",
                "file_status": "[7]",
                "file_md5": "36F670D89040709013F6A460176767EC",
                "file_exists": true,
                "file_signed": true,
                "file_signer": "Microsoft Windows Publisher",
                "file_vtscore": -1,
                "status_str": "FOUND",
                "is_64": true

They are launched by COMODO Internet Security, probably in a sandboxed state, for analysis purpose.
You don't have to worry about them.

Regards.

[Sergio]

ok, gracias

[Curson]

Hi Sergio,

You are welcome.

Regards.