Also got a problem with disoderstatus.ru

system · 2015-11-18T08:19:31.000Z

This morning I got pop ups from Avast saying:

URL: http://disorderstatus.ru/order.php
Infection: URL:Mal
Process: C:\Windows\SysWOW64\msiexec.exe

URL: http://differentia.ru/diff.php
Infection: URL:Mal
Process: C:\Windows\SysWOW64\msiexec.exe

I haven’t done anything but a scan from Avast, because after reading this topic https://forum.avast.com/index.php?topic=53253.0 I’m not sure what are the first steps I should do.

system · 2015-11-18T09:11:13.000Z

Ok, I followed the steps and here are the logs (attachements).

I would really appreciate the help.

essexboy · 2015-11-18T11:08:19.000Z

Let me know if this stops it

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-1282577008-4036829767-2089237545-1000\...\CurrentVersion\Windows: [Load] C:\ProgramData\msrtv.exe <===== ATTENTION 2015-09-14 20:17 - 2015-06-15 22:42 - 89971584 ___SH () C:\ProgramData\msrtv.exe Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-11-18T12:35:54.000Z

Here is the log file.

essexboy · 2015-11-18T12:46:38.000Z

Have the alerts ceased ?

system · 2015-11-18T12:50:31.000Z

No, it’s still happening.

But after I got the Fixlog, it was quiet for like a few minutes and then I plugged in my usb drive and it started again, although MCShield said that there is no malware on it. I’m not sure if it’s related.

system · 2015-11-18T13:33:54.000Z

And now MCShield detects a malware on the usb drive…

essexboy · 2015-11-18T16:06:23.000Z

Your USB is the source of the infection. Let MCShield clean it then post a fresh FRST log

system · 2015-11-18T16:49:48.000Z

Ok, here is the FRST log

essexboy · 2015-11-18T18:04:10.000Z

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: HKU\S-1-5-21-1282577008-4036829767-2089237545-1000\...\CurrentVersion\Windows: [Load] C:\ProgramData\msrtv.exe <===== ATTENTION 2015-09-14 20:17 - 2015-06-15 22:42 - 76138112 ___SH () C:\ProgramData\msrtv.exe RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-11-18T18:37:48.000Z

I think it’s solved. There’s no pop up messages, for now. Hope there won’t be any more. And I can successfully format my usb without leftover folders.

I was in a hurry today, so I took a second usb drive to take some files with me, and now I’m not sure if it’s infected as well. I’m hesitating to plug that one in. Will I need to repeat all of this again with the second usb?

Thank you for your help and patience.

essexboy · 2015-11-18T22:01:16.000Z

When you insert the USB hold the shift key down and it will not autorun, then scan with MCShield

Announcements