Assistance with svchost.exe url malware

[REDACTED]

Been getting lots of daily avast pop up warnings that look like the following.

URL: hxxp://bestdriverstar.net/4141/RelayTurbo_142668814330855.dll
Infection: URL:Mal
Process: C:\Windows\System32\svchost.exe

The url in the avast popup warning is different sometimes. Attached below are my logs from Malwarebytes, Farbar, and aswMBR. On a side note I got a blue screen and shut down while running aswMBR

Thank you

[Rednose]

Hi no1b4me72, welcome to the forum

As it is past midnight here in Europe, most experts will be sleeping right now.
Be patient, you will be helped as soon as possible.

Greetz, Red.

[REDACTED]

Hi no1b4me72, welcome to the forum

As it is past midnight here in Europe, most experts will be sleeping right now.
Be patient, you will be helped as soon as possible.

Greetz, Red.

Thanks Rednose. Have a good evening...

[REDACTED]

Hello



Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on icon and select Run as Administrator to start the tool.
  
• Wait patiently until the main console will appear, it may take a minute or two.
• In the main box please paste in the following script:

Code: [Select]

createsrpoint;
autoclean;
emptyalltemp;
bitsadmin /reset /allusers;b
ipconfig /flushdns;b

• Make sure that Scan All Users option is checked.
  
• Push Run Script and wait patiently. The scan may take a couple of minutes.
  
• When the scan completes, a zoek-results logfile should open in notepad.
  
• If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

[REDACTED]

Here's the zoek-results log attachment.

[REDACTED]

Re-run zoek and run this script:

Code: [Select]

mdlgoanmklkbmpnloohhfolfgibmieog;chr
C:\Users\user\AppData\Local\Chromium\User Data\Default\Preferences;f
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences;f
createsrpoint;
autoclean;
emptyalltemp;

Post its content into your next reply.

[REDACTED]

2nd zoek log attachment after running script.

[REDACTED]

Is everything ok now?

[REDACTED]

Have been at work. Will give it 24 hours and report back if there are anymore Avast alerts. Thanks for your assistance argus...

[REDACTED]

No problem.