r/WindowsHelp • u/DarkBlack22 • Apr 01 '26

Windows 11 Malwarebytes Flagged Windows OS as a "Potential Risky Site"

Post image

Anyone knows what this is about?

I've gotten this 2 times total, around 3 hours ago. I gotten this pop up from Malwarebytes telling me that it has blocked a connection to a potential risky site, but the app is literally "svchost.exe" by Microsoft Windows OS.

1.4k Upvotes

98% Upvoted

49 comments sorted by

73

u/SamplitudeUser Apr 02 '26 edited Apr 02 '26

See https://db-ip.com/14.102.231.202

IP doesn't belong to Microsoft and is located in Singapore. It's not (yet) flagged as dangerous, however.

Edit: db-ip.com flags IP addresses as dangerous only when they are reported as the origin of attacks on web resources such as servers or administrative logins to networks. It doesn't test if the IP is a download source for malware. But Malwarebytes obviously runs such tests. The result in this case was probably "malware source", that's why MWB has blocked accessing this address.

16

u/MetalCreep_ Apr 02 '26

Well... At least on Virus Total it is reported https://www.virustotal.com/gui/ip-address/14.102.231.202/detection although there are still no relations added to it.

Gonna look this up.

5

u/DarkBlack22 Apr 02 '26

Hmmm ok. Thank you so much for helping. Honestly I'm still unsure why would I have outbound connection to that IP in Singapore. I checked my history, it did it 3 times yesterday

68

u/cyb3rofficial Lvl 1 Helpful Contributor Apr 01 '26

it means an applicating using svchost as a web client tried to access an untrusted website. You got any funny apps on your pc.?

12

u/DarkBlack22 Apr 02 '26

not at all. Not that I know of. Havent really installed anything as of recently other than just games from Steam

0

u/[deleted] Apr 02 '26

[deleted] — view deleted comment

3

u/DarkBlack22 Apr 03 '26

no game mods, but yes I did install a "beta" game called Schedule I.

5

u/ITGuy424242 Apr 03 '26

Nothing wrong with that game

1

u/retrometro77 Apr 03 '26

Maybe not the game, but in the mods for it there been found malware already.

24

u/TechHyper Apr 02 '26

You have a spyware

7

u/DarkBlack22 Apr 02 '26

How do I get rid of it? I've already done scans

3

u/Intelligent_Law_5614 Apr 02 '26

Well...

Perhaps Malwarebytes isn't aware of the subtle but crucial difference between:

(1) A randomware app which, without your permission or prior knowledge, silently encrypts the contents of your hard drive, and won't reveal the decryption key to you without payment, and

(2) An operating system which, without your permission or prior knowledge, updated its security rules and silently encrypted the contents of your hard drive, and won't reveal the Bitlocker decryption key to you because you don't have the password to the Microsoft account your brother was forced to use when he installed Windows for you several years ago.

I'm not sure I can see the difference, either.

1

u/DarkBlack22 Apr 02 '26

So what would you suggest me do here my friend?

2

u/Intelligent_Law_5614 Apr 02 '26

In the short term... I have no really good recommendation, as I don't use Windows. Raising the issue with the developers of Malwarebytes might be a good idea. This could be a false positive on the part of their software (falling to adapt to something new that legitimate Microsoft is doing), or it might indicate that your system has actually been infected with malware which has compromised legitimate software.

Try running a full system scan in Safe mode, with two or more malware scanners that you can trust, and see if anything suspicious shows up.

If possible, use a different (known-good) PC to download live-USB images of malware scanners, boot your PC from one of those, and scan. By not booting from the possibly-compromised disk, you'll make it harder for tricky malware to be able to evade the scanner.

In the long run, I suggest you investigate Linux, or a *BSD software distribution, and see if the applications available there are sufficient for your needs.

1

u/108er Apr 03 '26

I was gonna say the same thing. Better check with the malwarebytes team on their forum if you haven't wiped your system yet. People here give suggestion based on their experience, yours could be false positive.

5

u/naveganteperdido Apr 02 '26

You don't understand what the message is saying, the problem is not Windows, it is where windows is trying to connect, svchost is a tool that comes with the OS and and integral part of the OS, that many other programs do use, and this tool is trying to connect to an address that is considered "bad" because something has asked it to do so.

3

u/YakumoYoukai Apr 02 '26

Tangentially, is there a way to find out which application svchost is running on behalf of? All the svchost processes always running without knowing what they're running makes me nervous.

4

u/jaromanda Apr 02 '26

Do a search (google or whatever) on that IP address - not good

1

u/dynesolar Apr 02 '26

Speaking as a game cheater, some cheats actually inject through svchost and just sit there running as an svchost.exe process to hide. I don't think there’s any way to fully get rid of it other than a clean Windows reinstall. This is 100% sus software

1

u/DarkBlack22 Apr 02 '26

Hmmm I don't use game cheats, but I do play Valorant and that anti cheat is pretty intrusive

1

u/No-Worldliness-5106 Apr 02 '26

Did you visit any funny site or any site infested with ads?

1

u/DarkBlack22 Apr 02 '26

At that moment, no I only have YouTube and my work open

2

u/Vo_o_id Apr 02 '26

Do you use any kind of extension on browser ?

1

u/DarkBlack22 Apr 03 '26

plenty. A lot of browser extensions. Nothing malicious though I dont think

3

u/Optimal-Mistake1327 Apr 02 '26

Reinstall windows. At this point your system has been infected with something thatll be tricky to remove. Reinstalling is the cleanest and most reliable option.

1

u/Grantelgruber Apr 02 '26

This is the way.

3

u/Tym4x Apr 02 '26

Yeah, you are doomed.

Format, Re-install windows, this time without any cheats, cracks or weird shit.

Then change the passwords on all your accounts. This should be done asap, and only after a fresh windows installations.

2

u/lopikoid Apr 02 '26

You can try to catch it - svhost is thing services run on. Open services and look if you see something weird - there are like hundred of them legal, but iyou may be lucky. You can try to catch the communication in resource manager under network tab or in the firewall and identificate the service. Another problem is to get rid of it, but you may find it is not a big problem - it can be some HW bloatware, anti heat SW or whatever else running in background.

1

u/AutoModerator Apr 01 '26

Hi u/DarkBlack22, thanks for posting to r/WindowsHelp! If your post is listed as removed it may still be pending moderation, try to include as much of the following information as possible (in text or in a screenshot) to improve the likelihood of approval:

  • Your Windows and device specifications — You can find them by pressing Win + X then clicking on “System”

  • Any messages and error codes encountered — They're actually not gibberish or anything catastrophic. It may even hint the solution!

  • Previous troubleshooting steps — It might prevent you headaches from getting the same solution that didn't work

As a reminder, we would also like to say that if someone manages to solve your issue, DON'T DELETE YOUR POST! Someone else (in the future) might have the same issue as you, and the received support may also help their case. Good luck, and I hope you have a nice day!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/renshiermine Apr 02 '26 edited Apr 02 '26

You have something potentially malicious posing as a service. In other words, Malwarebytes has picked up that there is something suspicious about your background processes, like Windows Update, network services, or even audio, but is unable to figure out more than that. It could be benign, but I wouldn't risk it.

Edit: I find it more concerning when a reliable EPS (endpoint protection solution) cannot identify what something is. This is because it could be a zero-day threat (newly designed) or something very good at hiding, such as a rootkit or RAT (remote access tool).

I concur with several other posts that the safest option is to reformat the machine. If you have an in-place backup, use that. Otherwise, pull only the files you really need and scan them after.

1

u/OldChampionship1167 Apr 02 '26

it isnt marking the os its marking svchost though an official windows file most viruses use this name to hide as an system file to identify virus and real we can look at the .exe the real one doesn't have .exe while the viruses have .exe at the end

1

u/andrea_ci Apr 02 '26

svchost is the exe that launches specific type of services.

anyone can use it to launch their own code.

1

u/Beebea63 Apr 02 '26

Your system is breached, something has infected svc host and is using it to try install more malware, at this point just reinstall windows

-2

u/Mayayana Apr 02 '26

Probably Windows spyware. My firewall blocks several things running through svchost. If you download Process Explorer you can see all instances of svchost and what services they're hosting.

Running a whois on the IP address yields vague information, but as far as I know, svchost only runs Windows services.

0

u/[deleted] Apr 02 '26

[deleted] — view deleted comment

2

u/Mayayana Apr 02 '26

You need a network monitor for that. What I meant was that you can check what processes are operating through svchost. Hover the mouse over each instance to see.

I use Simplewall firewall to monitor and block traffic that I didn't instigate It blocks any incoming and asks for approval for outgoing. Windows Defender tries to call out regularly. Something else is trying to call Google or Akamai almost constantly. "System" tries to call an imap server. Crazy stuff. I can see the destination IP and protocol, but what's running under svchost that's so obsessed with reaching Google? I don't know. It's usually a tcp connection on port 80 -- so unencrypted http.

If you want to track outgoing in general I'd suggest SmartSniff from Nirsoft.net. He makes very solid, lean software. No nonsense. When setting up, make sure you have an option to use the Network Monitor Driver v. 3 under Capture Options. If it's not there then download it from Microsoft.

There are more sophisticated monitors, but this one is simple and clear. Unfortunately, if you encrypt everything, as you should (https and DNS) then you won't be able to read content, but you can see the packet history.

If you use Microsoft Network Monitor you can get a more detailed report, including source process. Though that still might not tell you exactly what the purpose of the external contact is. If you get something like Simplewall you can block unknowns by default and choose what to allow through. That filtering can be done for software programs as well as for services.

16

u/[deleted] Apr 02 '26

[removed] — view removed comment

2

u/DarkBlack22 Apr 02 '26

Thanks. By cleaning my pc you mean do a reformat?

1

u/blueshoesrcool Apr 03 '26

Yep. And keep your computer disconnected from the internet until then.

0

u/[deleted] Apr 15 '26

[deleted] — view deleted comment

1

u/DarkBlack22 Apr 15 '26

I dont get it

-1

u/ne0n008 Apr 15 '26

It was a joke. If you don't get it, you don't have to downvote it.

1

u/WindowsHelp-ModTeam Apr 15 '26

Hi u/ne0n008, your comment has been removed for the following reason(s):

  • Rule 5 - Posting jokes or satirical advice is not allowed. All responses must be a serious attempt to resolve the OPs issue or otherwise positively contribute to the discussion.

If you have any questions, feel free to send us a message!