I've had this happening to me also. I found that Little Snitch was turned off when I checked after getting a request from Software Update to put my password in, which I rejected. Restarted and reset Little Snitch, and began to get requests for .rserv to connect to cuojshtbohnt.com.

Little Snitch gives you the IP address of the contact, which I did a search on here:

IP Address: 91.233.244.102

The location appears to be in the middle of nowhere in Siberia. The blacklist check has it listed on 70 blacklist sites.