Avast, Vista and svchost.exe - false positive?

When I did memory scan avast told me that file
svchost.exe is infected by Win32:Downloader-LWR [Trj]

When I scan file from the disk it appears to be clean.

There are result from:

virscan.org
http://r.virscan.org/report/bd2ef465ed9b3064acf2ffdb2f2ee066.html

virustotal.com
http://www.virustotal.com/file-scan/report.html?id=d4f79d7bc639fe86ac68961e6273836b9d7af491773fd054395b33d317017beb-1324480917

Program and virus database are up to date.
It is fp?

What was the location of the file ? i.e. windows or system32

system32

File size: 21 504

I do not think it is an FP as I have just scanned my copy

You say it was a memory scan ? Do you have any other security programmes running at the time ?

Yes it was a memory scan.
No avast only.

OK lets run a quick check, as it was in memory it may well be that a different file is using svchost to cause the alert

Download OTL to your Desktop

[*]Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
[*]Select All Users
[*]Under the Custom Scan box paste this in
netsvcs
%SYSTEMDRIVE%*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBIOS /s
C:\Windows\assembly\tmp\U*.* /s
%Temp%\smtmp\1*.*
%Temp%\smtmp\2*.*
%Temp%\smtmp\3*.*
%Temp%\smtmp\4*.*
CREATERESTOREPOINT

[*]Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
[*]When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
[*]Attach both logs

THEN

Download aswMBR.exe ( 1.8mb ) to your desktop.
Double click the aswMBR.exe to run it Click the “Scan” button to start scan

http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR%20shots/aswMBRScan.gif

On completion of the scan click save log, save it to your desktop and post in your next reply

http://i1224.photobucket.com/albums/ee362/Essexboy3/aswMBR%20shots/aswMBRsavelog.gif

i’ve got the same problem, I do what you said in the last post, essexboy?

What is the OS ? As I am running windows 7

Windows Vista SP2 with last updates

Did you run a memory scan ?

I or Vultumax?

Both as I believe this to be a false positive affecting the memory scan only - standard scans show clean

Yes it was only in memory scan.
When I scan file on disc avast do not find anything.

OK I will see what the others report, but it does appear to be a false positive

I scan svchost.exe and got positive :frowning: No memory scan :cry:

@Vultumax could you start a new topic please and post the logs as requested there