differentia.ru/diff.php and disorderstatus.ru malware

Since yesterday i have been getting 2 warnings from my anti virus (Avast free version) each few seconds

URL: http://disorderstatus.ru/order.php
Infection: URL:Mal
Process: C:\Windows\SysWOW64\msiexec.exe

and
URL: http://differentia.ru/diff.php
Infection: URL:Mal
Process: C:\Windows\SysWOW64\msiexec.exe

Can’t find a way to get rid of it, and havent installed anything in the past days
please help :frowning:

Can't find a way to get rid of it, and havent installed anything in the past days
have you used any USB stick / removable drives?

follow instructions here https://forum.avast.com/index.php?topic=53253.0
attach Malwarebytes and Farbar Recovery Scan Tool logs … 3 logs total

see below the box you write in … Attachments and other options

Yes, i believe it started since i inserted my regular USB stick (Which was used in the morning before it started in a university pc)

Ok, thanks, already installed Malwarebytes Anti-Malware & its scanning it

Monitoring: when you finish the scans please post the logs and I will try to help.