MSBuild.exe contacting an unknown website every 10 minutes

Disconnect this PC from the network, keep Malwarebytes blocking the connections, and have a qualified responder create a machine-specific FRST fixlist.txt from both current logs rather than using a fixlist from another case.

The detected executables are running from:

• ...\INetCache\HealthCheckService\MSBuild.exe
• ...\INetCache\CatalogPublisher\MSBuild.exe

That is not the normal Visual Studio MSBuild installation location, which is under the Visual Studio installation folder in MSBuild\Current\Bin.^1^ Do not assume the files are legitimate merely because they are named MSBuild.exe.

Immediate actions

1. Disconnect Wi-Fi/Ethernet. Do not disable Malwarebytes web protection.
2. Do not run any fixlist from the similar thread. FRST fixlists are written for one specific machine and should not be reused or run more than once.^2^
3. Ensure your upload contains both FRST.txt and Addition.txt. The matching Q&A procedure requires both logs for analysis.^3^
4. Because FRST reports can expose usernames, installed software, and system configuration, restrict the cloud share to only the responder if possible. Do not post a replacement log containing account identifiers or other personal information.
5. After a responder supplies a fix specifically for these logs:
   • Save fixlist.txt in the same folder as FRST64.exe.
   • Close all applications.
   • Run FRST and select Fix.
   • Restart if prompted.
   • Return the generated FixLog.txt.
   • Do not execute the fix a second time.^4^

Deleting only the two cached executables may not solve this: the repeated interval indicates that an autostart or scheduled mechanism may launch or recreate them.

Trace and safely disable the persistence entry

Since normal scans have already found nothing, use Microsoft Autoruns to identify what starts these files:

1. Download and run Autoruns as administrator.
2. Select Options → Hide Microsoft Entries, then refresh.
3. Search for:
   • HealthCheckService
   • CatalogPublisher
   • INetCache
   • MSBuild.exe
4. Check the Scheduled Tasks, Logon, Services, and WMI categories.
5. For a matching entry, use Entry → Jump to Entry to record its exact registry, task, or file location.
6. Uncheck the entry first to disable it; do not immediately delete it. Autoruns documents that unchecking disables an autostart, while Delete permanently removes its configuration.^5^
7. Save screenshots or an Autoruns export and provide them with the FRST logs.

Do not disable unrelated unsigned or unfamiliar entries solely because Autoruns displays them. Its signature-verification and VirusTotal options can help narrow the list, but the relevant evidence is an entry whose image path or command line references these cache folders.^5^

Offline remediation

If “every scan” did not include Microsoft Defender Offline, save open work and run:

Windows Security → Virus & threat protection → Scan options → Microsoft Defender Antivirus (offline scan) → Scan now

The PC restarts and scans from the Windows Recovery Environment, making it harder for persistent malware to hide or defend itself. Results appear afterward under Windows Security → Protection history.^6^

After the FRST fix and restart, reconnect temporarily and verify that no new blocked connection appears for at least 20–30 minutes. If the cache executables or connections return, disconnect again; that indicates the persistence mechanism remains.

If the activity still returns

Back up documents only—not executables, scripts, installers, or the suspicious cache folders—and perform a clean Windows installation from installation media. Microsoft lists this as the recovery path when malware remains suspected; a clean installation removes Windows, applications, settings, and personal files from the selected drive.^7^

References

1. Tutorial: Use MSBuild
2. The MSBuild.exe keeps contacting suspicious URLs - Microsoft Q&A
3. MSbuild.exe is contacting gamorar.cc 3 times every 10 minutes it is being flagged as a trojan and connection is blocked by malwarebytes - Microsoft Q&A
4. MSBuild.exe contacting gamorar.cc every 10 minutes Need FRST Fixlist - Microsoft Q&A
5. Autoruns v14.3
6. Virus and Threat Protection in the Windows Security App | Microsoft Support
7. Recovery options in Windows | Microsoft Support