htxp:// atomictrivia.ru/ atomic.php and htxp:// differentia.ru/ diff.php

system · 2015-08-11T22:19:10.000Z

Objet: htxp://atomictrivia.ru/atomic.php
Infection: URL:Mal
Process: C:\Windows\SysWOW64\msiexec.exe

Objet: htxp://differentia.ru/diff.php
Infection: URL:Mal
Process: C:\Windows\SysWOW64\msiexec.exe

I have read the guide
https://forum.avast.com/index.php?topic=53253.0

and I have the log files

polonus · 2015-08-11T22:26:01.000Z

Hi ricardopaz_15,

Please break those live links there as we do not want the unaware get infected with malcode as these are known infection sources!
https://www.virustotal.com/nl/url/3985dfaa178c72e9dcac15bfb1ed8967944ef69582d7e4e0931816fd59a13553/analysis/1439331704/
and https://www.virustotal.com/nl/url/1ed9c04be06f75a819250ba8cde8874b8959cd8c741f23a48d01b94b4f5fe7a5/analysis/1439331800/
Change http into htxp that is all it takes to make that link non-click-through.

polonus

system · 2015-08-11T22:40:27.000Z

You are right, sorry, done

TwinHeadedEagle · 2015-08-12T05:09:38.000Z

Hello,

Please download MCShield from one of the following links:

MCShield -Official download link

[*]Double click on MCShield-Setup to install the application.
Next => I Agree => Next => Install … per installation click on Run! button.
[]Wait a few seconds to MCShield finish initial HDD scan…
[]Connect all your USB storage devices to the computer one at a time. Scanning will be done automatically.
[*]When all scanning is done, you need to post a logreport that MCShield has created.

Under Logs tab (in Control Center) for AllScans.txt log section click on Save button. AllScanst.txt report shall be located on your Desktop.

=> Copy here content of AllScanst.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.

https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
Fix with Farbar Recovery Scan Tool

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[B] This fix was created for this user for use on that particular machine.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif

https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
Running it on another one may cause damage and render the system unstable.
https://sites.google.com/site/cannedfixes/home/hosted-images-formatting/icon_exclaim.gif
[/B]

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

[*]Right-click on
https://sites.google.com/site/cannedfixes/farbar-recovery-scan-tool/FRST.gif
icon and select
https://sites.google.com/site/cannedfixes/home/hosted-images-tools/RunAsAdmin.jpg
Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
[*]Press the Fix button just once and wait.
[*]If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
[*]When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

system · 2015-08-12T16:30:53.000Z

There are my log files, the problem seems to be fixed.
Thanks for your help
I want to know if that is all I have to do? or do I need to do anything else?

TwinHeadedEagle · 2015-08-12T18:09:13.000Z

You’re good to go

Post-cleanup procedures:

Download DelFix by Xplode and save it to your desktop.

[*]Run the tool by right click on the
http://www.imgdumper.nl/uploads6/51a5ce45267c1/51a5ce45263de-delfix.png
icon and Run as administrator option.
[*]Make sure that these ones are checked:

[]Remove disinfection tools
[]Purge system restore
[*]Reset system settings

[*]Push Run and wait until the tool completes his work.
All tools we used should be gone. Tool will create an report for you (C:[B]DelFix.txt)

The tool will also record healthy state of registry and make a backup using ERUNT program in %windir%\ERUNT\DelFix
Tool deletes old system restore points and create a fresh system restore point after cleaning.

Announcements