Run Malwarebytes’ Anti-Malware and find
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully.
It will come again even after you remove it. Some people discuss it here
http://www.malwarebytes.org/forums/index.php?showtopic=23844
By the time I write this post, it did not solve the problem. However, I find an easy way to remove it:
Delete all the Quarantine items from all anti-virus program running on the computer and it works.