differentia.ru/diff.php and disorderstatus.ru malware

system · 2015-09-11T13:10:23.000Z

Since yesterday i have been getting 2 warnings from my anti virus (Avast free version) each few seconds

URL: http://disorderstatus.ru/order.php
Infection: URL:Mal
Process: C:\Windows\SysWOW64\msiexec.exe

and
URL: http://differentia.ru/diff.php
Infection: URL:Mal
Process: C:\Windows\SysWOW64\msiexec.exe

Can’t find a way to get rid of it, and havent installed anything in the past days
please help

Pondus · 2015-09-11T13:13:20.000Z

Can't find a way to get rid of it, and havent installed anything in the past days

have you used any USB stick / removable drives?

Pondus · 2015-09-11T13:14:43.000Z

follow instructions here https://forum.avast.com/index.php?topic=53253.0
attach Malwarebytes and Farbar Recovery Scan Tool logs … 3 logs total

see below the box you write in … Attachments and other options

system · 2015-09-11T13:19:29.000Z

Yes, i believe it started since i inserted my regular USB stick (Which was used in the morning before it started in a university pc)

system · 2015-09-11T13:30:53.000Z

Ok, thanks, already installed Malwarebytes Anti-Malware & its scanning it

dbrisendine · 2015-09-11T22:46:38.000Z

Monitoring: when you finish the scans please post the logs and I will try to help.

Announcements