The MSBuild.exe keeps contacting suspicious URLs

Question

The MSBuild.exe keeps contacting suspicious URLs

-XwX- TheHb 20

Sorry for the Japanese interface but as you can see MSBuild.exe kept contacting some .cfd URLs

and a URL called labrernouni.lol yesterday (not shown on the pic)

20261016-012130.png

but i tried full scan detecting nothing, yet the "connection blocked" pop-up continues almost 5 mins once. The connections are being blocked by Kaspersky for now.

I know my computer is being attacked but don't know what to do, if there's someone can help me out

*Edited 2026.10.16 01:37am JST

Kaspersky detected some kind of trojan threat targeting MSBuild.exe

I translated the report with AI

Event: Object deleted Application: MSBuild.exe User type: Initiator Component: System Watcher Result description: Deleted Type: Trojan Name: PDM:Trojan.Win32.Generic Risk level: High Object type: Process Object path: C:\Users\[username]\AppData\Local\Microsoft\Windows\INetCache\SystemWebCors Object name: SystemWebCors.csproj MD5: 159CBA970E5B959641F4E53D0A097390

Here is the FRST.txt and Addition.txt just in case, please tell me what to do next

FRST.txt

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Ramesh 182.5K Volunteer Moderator

Please run the fixlist below.

Download fixlist.txt
Save Fixlist.txt to the same folder as FRST64English.exe.
Close all programs.
Launch the Farbar Scanner tool and click "Fix".
Restart Windows if prompted.
Upload the output log file (FixLog.txt) in your next reply.

NOTE: The fixlist.txt script was written specifically for this user and for use on that particular machine. It is not recommended to run it on another machine, and don't run the same fixlist.txt more than once.

-XwX- TheHb 20 Reputation points

2026-10-15T17:13:30.4266667+00:00

Fixlog.txt

Hello!

Here is the Fixlog.txt

Please tell me what to do next
Ramesh 182.5K Reputation points Volunteer Moderator

2026-10-15T17:18:14.8266667+00:00

That should have fixed the issue. But I don't know what the .csproj file that the exe was executing contained. It's a good idea to change the passwords and enable 2FA wherever possible.

Rename FRST64.exe to Uninstall.exe and run it. This removes all files/folders created by FRST and the tool itself. A reboot is required.
-XwX- TheHb 20 Reputation points

2026-10-15T17:28:32.8466667+00:00

I‘ve changed the pw and both enabled 2FA as soon as I know my accs are leaked, yet the "someone trying to log in your account" kinda emails keep telling me my pc is still unsafe

Rebooting my pc and there's no more suspicious connection blocked pop-up showing up so I guess this is it!

Thank you very much!
Ramesh 182.5K Reputation points Volunteer Moderator

2026-10-15T17:34:49.4433333+00:00

You're most welcome!