Help in removing hxxp://getusaaall.info/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1

Viruses and worms
1

Hello

I ham having alerts every 15 minutes or so that avast has blocked an url, hxxp://getusaaall.info/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7D
and avast says it is a URL: MAL. I have read around on this forum and found the thread : Logs to assist in cleaning malware
with url https://forum.avast.com/index.php?topic=53253.0.

I have made the first step in scanning with MBAM whilst enabling scanning for rootkits, am attaching the log. MBAM did not find any problems, but during the scan i had a avast alert like the one i am having problems with, but now it tries to access the URL: hxxp://54.187.243.98/?e=pcho&cht=2&dcu=1&cpatch=2&dcs=1&pf=1&unp=Azm9CdOLv7D
From then on the URl that my computer tries to access is this and not the getusaaall one.

should i continue with the other steps in the thread now that the url has changed or what should i do?

2
should i continue with the other steps in the thread now that the url has changed or what should i do?
we also need Farbar log
3

here goes

4

Let me know if this stops it

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = U3 atuqgke6; C:\Windows\System32\Drivers\atuqgke6.sys [0 ] (Microsoft Corporation) CMD: bitsadmin /reset /allusers CMD: DEL %TEMP%\*.* /F /S /Q CMD: RD /S /Q %TEMP% REBOOT:

Save this as fixlist.txt, in the same location as FRST.exe
Run FRST and press Fix
On completion a log will be generated please post that

5

here goes

6

Have the alerts now ceased ?

7

Hi! thanks for your help! have not had any alerts today, but have not been using the computer very much (summer). I will reply again if they start popping up again

8

In that case methinks I will send you on your merry way :slight_smile:

Subject to no further problems :slight_smile:

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean :thumbsup:

A good workman always cleans up after himself so…The following will implement some cleanup procedures as well as reset System Restore points:

Download and run Delfix

https://dl.dropboxusercontent.com/u/73555776/delfix.JPG

: Keep Java Updated :

WARNING: Java is the #1 exploited program at this time. The Department of Homeland Security recommends that computer users disable Java
See this article

I would recommend that you completely uninstall Java unless you need it to run an important software.
In that instance I would recommend that you disable Java in your browsers until you need it for that software and then enable it. (See How to diasble Java in your web browser and How to unplug Java from the browser)

Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

CryptoPrevent install this programme to lock down and prevent crypto ransome ware

https://dl.dropboxusercontent.com/u/73555776/CryptoPrevent.JPG

Malwarebytes.

Update and run weekly to keep your system clean

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To learn more about how to protect yourself while on the internet read this little guide Best security practices Keep safe :wave:

9

Hi! been using the computer alot more today, and still nothing, thanks again! :smiley:
I have also done as you recommended with installing the softwares and unplugging java from my browser. I just have a question, while unplugging java from my browser i noticed a box (chrome) where i can prevent all “webb places” (sorry dont know how to express that in english) to run java scripts. I feel like i should disable this as well, but it was not included in the guide… what do you think?

10

If you do not have sun Java onboard then the windows java will handle it (but that is much more restrictive)

So yes you can tick that box :slight_smile:

11

Hi,

just to let you know i was having exactly the same problem with Getusaaall.info and i fixed it by disabling avast during 30 minutes + using Adwcleaner as it’s described here : http://www.how-to-remove.com/getusaaall-info/

12

As long as the infection is not residing in a bits file that will work