Disorder/Differentia.ru Malware

system · 2015-11-11T11:18:54.000Z

Recently I plugged my pendrive to my friends PC and when i plugged it back to my laptop avast is telling me this error every 15 seconds. Is there is any way to fix it?

http://i57.tinypic.com/r0qjhi.jpg

http://i57.tinypic.com/30iumx3.jpg

Those arent actually my screens but I have identical virus pop up.

Eddy · 2015-11-11T11:30:22.000Z

Please follow the instructions in the sticky at the top of this forum and attach the requested logs to your next post.

system · 2015-11-11T13:16:13.000Z

Im extremly sorry for that , was in a bit of a hurry.

system · 2015-11-11T15:38:30.000Z

Can’t send more then 4 attachments in one message, here is the rest of the files.

essexboy · 2015-11-11T15:58:22.000Z

Looks like MBAM got the run key so I will get the file

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: URLSearchHook: HKLM-x32 -> Domyslne = {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D} Toolbar: HKLM - Brak nazwy - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - Brak pliku FF Extension: Brak nazwy - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-10-08] [Brak podpisu cyfrowego] 2015-10-13 06:42 - 2015-10-07 18:58 - 00000102 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat 2015-07-14 20:25 - 2015-06-15 22:16 - 99058944 ___SH () C:\ProgramData\msqujksi.exe 2015-10-07 18:58 - 2015-10-13 06:42 - 0000102 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · 2015-11-11T16:25:31.000Z

Thank you! So far no pop ups

essexboy · 2015-11-11T18:05:53.000Z

Could you put the following folder into dropbox public c:\FRST
Send me the sharing link so that I can grab it for onward transmission to Avast
Once I have it you can delete it

Any further problems ?

system · 2015-11-11T22:18:21.000Z

https://www.dropbox.com/sh/nh56grswkrkrsik/AABO8UC6GqSBlC2zkA7KjwVUa?dl=0

essexboy · 2015-11-12T14:34:38.000Z

Oops you appears to have given me some pictures

Did you zip c:\FRST ?

Announcements