svchost.exe infected

Viruses and worms
1

Hello! Avast is telling me that svchost.exe is acting strangely. Every time I login I get several popup messages from Avast saying:

"Avast Web Shield has blocked a harmful webpage or file.

Object: {a suspicious website I have never seen before}
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe"

However after performing multiple scans no files seem to be infected and avast says the file is “Not Harmful”. I’ve been receiving the popups for about a week now. On virscan.org 0/39 virus scanners found malware in svchost.exe and I have attached logs from FRST, aswMBR.exe and malwarebytes and an image of the warning message. I also don’t have any restore points set up on my PC so unfortunately that’s not an option. Could anyone help me with this slightly annoying issue? Thank you!

Regards
John

2
I also don't have any restore points set up on my PC so unfortunately that's not an option.
system restore does not remove infections .... it is not that easy :-\
3

Let me know if this stops it

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-20704470-4210453850-939022676-1001\...\Winlogon: [Shell] - <==== ATTENTION 2015-03-12 18:36 - 2015-03-12 18:36 - 00000000 __HDC () C:\ProgramData\{6AACA38B-2810-4B47-BDEC-D7A1F38B1531} 2015-02-13 18:12 - 2015-03-12 18:34 - 00000000 ____D () C:\ProgramData\3c0f2b0c000031cf 2015-02-13 18:11 - 2015-02-13 18:11 - 00000000 ____D () C:\Users\John\Documents\Optimizer Pro 2015-02-13 18:10 - 2015-03-10 16:27 - 00000000 ____D () C:\ProgramData\{166098cc-0641-192e-1660-098cc0646330} RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

4

Great thanks essexboy I got no popup on reboot, looks like I installed something a bit dodge latley. Anyway here is the fix log, I think the problem has been solved but will post back in a day to update.

5

It was a small change to the windows BITs programme … Hence nothing else saw it