View original (French)

Virus crossrider

Solved
viaumax Posted messages 4 Status Member -  
viaumax Posted messages 4 Status Member -
Hello everyone,

I need your help because I currently have a virus.
This virus arrived by downloading a file (yes, a mistake!).

Now, ads appear when I perform a search (only with Google and regardless of the browser) - see photo.



I can't seem to remove this program, despite numerous attempts.
Running a diagnosis with ZHPDIAG, this line appears in red: 


HKCU\SOFTWARE\67490f87-0893-5593-ae76-b1e5d0acd13f =>Adware.CrossRider


Looking at the task manager, I noticed that Windows Explorer uses a large part of the processor (about 30%).
Restarting the explorer.exe task brings the usage back to normal (less than 1%).
However, each time I restart, I have to perform this operation.
Can someone help me?

Could you provide me with some assistance?

Thank you very much!

The complete report is available here:

https://www.cjoint.com/c/HEuvxeNUrQI

4 answers

  1.
    Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Good evening,

    Reset/Repair the web browsers affected by the issues:

    then:

    Follow the FRST tutorial. ( Take the time to read carefully - everything is well explained ).

    Download and run the FRST scan,
    Wait for the scan to finish, a message will indicate that the analysis is complete.

    Three FRST reports will be generated:
    • FRST.txt
    • Shortcut.txt
    • Additionnal.txt


    Send these 3 reports to the site https://pjjoint.malekal.com/ to share them.
    In return, provide the 3 pjjoint links to the reports here in a new response so that we can consult them.

    --
    Please press a key to continue the disinfection...
    1
  2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Yep, you had a junk extension installed.
    Read this to understand: https://www.malekal.com/adwares-pups-extension-malveillante-chrome-firefox/

    You have programs that were installed when you bought the computer or later that are not necessarily useful.
    They clutter Windows and can slow it down.
    You can uninstall them.
    Go to Control Panel
    then Programs and Features.
    Uninstall:

    Avast Cleanup Premium
    CCleaner
    CyberLink PowerDirector


    P.S.: CCleaner is not really useful, even if it's recommended everywhere.
    If you want to keep it, disable CCleaner's monitoring, which is unnecessary, as it starts up with Windows and slows it down with its incessant cleanings; see: https://www.malekal.com/supprimer-ccleaner-demarrage-windows/

    Avast!, which you seem to have installed for the occasion, can also be uninstalled.
    Windows Defender is much less intrusive.

    Here is the correction to perform with FRST. You can use this explanatory note with screenshots.
    Restart FRST and then press CTRL + Y on your keyboard.
    The notepad will open, copy/paste this. 

    CreateRestorePoint:
    CloseProcesses:
    2018-05-20 20:47 - 2018-05-20 20:47 - 003091840 _____ C:\Users\maxim\ZHPDiag3.exe
    2018-05-20 20:23 - 2018-05-21 00:17 - 000000000 ____D C:\Users\maxim\AppData\Roaming\ZHP
    2018-05-20 20:23 - 2018-05-20 21:11 - 000000000 ____D C:\Users\maxim\AppData\Local\ZHP
    2018-05-20 13:15 - 2018-05-20 20:45 - 000000000 ____D C:\AdwCleaner
    1601-01-03 21:33 - 1601-01-03 21:33 - 000174592 _____ (Microsoft Corporation) C:\Users\maxim\AppData\Local\oaaoND.exe
    2018-05-19 16:45 - 2018-05-19 16:55 - 000000000 ____D C:\Program Files (x86)\Bana
    2018-05-19 16:45 - 2018-05-19 16:45 - 000000006 _____ C:\Users\maxim\AppData\Roaming\529499.txt
    2018-05-18 13:16 - 2018-05-18 13:16 - 001871360 _____ C:\WINDOWS\f8a908f62720aee16e790b0d1a976592.exe
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Save the content from the file menu and then save.

    Close the notepad, go back to FRST, and click the "Fix" button.
    A restart may be necessary and automatic.
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    1
    1. viaumax Posted messages 4 Status Member
       
      Hello Malekal_morte-,

      Here is my FixLog file

      https://pjjoint.malekal.com/files.php?id=20180521_u12f9u7u6m6

      For your information, I have disabled Ccleaner on startup and uninstalled Avast after the FRST correction.
      However, I want to keep PowerDirector; I'll just try to prevent it from launching at startup.

      Thank you for your help,

      Maxime.
      0
  4. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    It's all good =)

    Delete the folder C:\FRST

    Finish with a cleanup using Malwarebytes - Malwarebytes Anti-Malware Free Version Tutorial
    Avoid regular scans and cleanups with ZHPCleaner, AdwCleaner, not useful.

    Some advice:

    To not get caught again.
    To read - Potentially Unwanted Programs / PUPs: Adwares/PUPs: Unwanted and Parasite Programs
    (Especially enable LPI detections to detect unwanted and advertising programs)

    --
    Please press any key to continue the disinfection...
    0
    1. viaumax Posted messages 4 Status Member
       
      Impeccable!

      Thank you very much!
      0