Persistent Suspicious Item Warning

Viruses and worms
1

Today I updated my Avast anti-virus, scanned my laptop using Malwarebytes and C-Cleaner, and then used the Windows 8 defrag facility. I am now getting repeated warnings from Avast about various websites but all giving the same threat warning : “Win32:Evo-gen [Susp]”
As far as I can tell the laptop is working fine, no crashes etc and I’m wondering if this is a false warning. Can anyone give me advice as to what to do next?

Thanks in anticipation.

2
Win32:Evo-gen [Susp]
Suspicious detection, and this is a on access detection only ...... not on websites, it must be a file

What is the full message on the warning popups …you may post screenshots

3

Pondus, firstly thanks for replying. I’m struggling to attach screenshots as I get a message saying the attachments are too large. I’ve tried to note down what the warning messages are saying but they don’t stay on screen for very long. The ones I have noted are :

  1. BITF209.tmp

  2. BITBEB7.tmp

  3. hxxp://musicget.name/?e=pcho8cht=1&cpatch=2&dc=1&pf=1&unp=Azm9cdolv7D

  4. hxxp://getlivvek.info/?e=pcho8cht=1&cpatch=2&dc=1&pf=1&unp=Azm9cdolv7D

All show the warning message Win32:Evo-gen [Susp] and I get approx. 6 or so messages at once. Regarding the last two mentioned above; when I clicked on “more details”, those details would barely fit in the display box on Avast’s web page.

4

Hi there I know what that is

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

[*]Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
[*]Select additions at the bottom
[*]Press Scan button.

https://dl.dropboxusercontent.com/u/73555776/frst.JPG

[*]It will produce a log called FRST.txt in the same directory the tool is run from.
[*]Please attach both logs generated.

5

essexboy, thanks for your post. Before I download Farbar, please could you expand on your comment about knowing what the problem is?

Pondus, I’ve managed to view the quarantine chest & attach screenshots. Hopefully, this will help you advising me as to what to do.

6

Yep it has hijacked the bits update mechanism on your system, I will just need to reset that and clear any other junk