Recurring window opening issue

LaurentChampion -  
Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   -
Hello,
I have a recurring problem with a window that opens with the message
There is a recommended update

I saw that it was possible to solve the problem using these different reports:

FRST: https://pjjoint.malekal.com/files.php?id=FRST_20180525_o12h15v9y13e7
Additional: https://pjjoint.malekal.com/files.php?id=20180525_l10x12t11z7d6
Shortcut: https://pjjoint.malekal.com/files.php?id=20180525_z11k15e15z7q12

Could someone help me read and possibly resolve my little issue!
Thank you very much

Configuration: Windows / Firefox 60.0

4 answers

  1. jeanbern Posted messages 13740 Registration date   Status Contributor Last intervention   5 136
     
    Hello,
    I am submitting the reports for a better opening:

    FRST
    Additional
    Shortcut

    --
    The stone and the pebble fall at the same speed (an old Chinese proverb)
    0
  2. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
     
    Hello,

    You were tricked by an InstallCore installer, a PUP (Potentially Unwanted Programs) platform that is offered on download sites or through fake Java and Flash updates.
    It proposes to install Chromium to force Yahoo!, ByteFence, Avast!, McAfee Security Advisor, or McAfee LiveSafe.
    To avoid being deceived again, read: PUPs InstallCore

    You have programs that were installed when you purchased the computer or installed later that are not necessarily useful.
    They clutter Windows and can slow it down.
    You can uninstall them.
    Go to the Control Panel
    then Programs and Features.
    Uninstall:

    CCleaner
    CleanUp!
    PremierOpinion
    QuickTime
    WildTangent Games App


    PS: CCleaner is not really useful, even though it's recommended everywhere.
    If you want to keep it, disable CCleaner's monitoring, which is unnecessary, as it starts up with Windows and slows it down with its constant cleanings. See: https://www.malekal.com/supprimer-ccleaner-demarrage-windows/

    Here is the fix to perform with FRST. You can refer to this explanatory note with screenshots.
    Restart FRST and press CTRL + Y on your keyboard.
    The notepad will open, copy/paste this.

    CreateRestorePoint:
    CloseProcesses:
    R2 PremierOpinion; C:\Program Files (x86)\PremierOpinion\pmservice.exe [208320 2018-01-11] (VoiceFive, Inc.) <==== WARNING
    2018-05-25 00:59 - 2018-05-25 00:59 - 000000000 ____D C:\Users\Laurent Champion\AppData\Local\{C5C9F395-E161-9F2D-8CF9-BAC5A891465D}
    2018-05-12 11:03 - 2018-05-13 19:59 - 000000000 ____D C:\WINDOWS\System32\Tasks\productupdt
    Task: C:\WINDOWS\Tasks\Search Provided by Bing nasif.job => C:\Windows\system32\wscript.ex C:\ProgramData\{3B2DFE4E-B16F-7488-37A9-EACAADEB6104}\taca.txt
    2018-05-12 11:02 - 2018-05-15 07:12 - 000000000 ____D C:\Users\Laurent Champion\AppData\Local\{1BA82DF4-3F00-414C-5298-64A476F0983C}
    2018-05-12 11:02 - 2018-05-13 19:59 - 000000000 ____D C:\Users\Laurent Champion\AppData\Roaming\Hagafek
    2018-05-12 11:02 - 2018-05-12 11:04 - 000000000 ____D C:\Users\Laurent Champion\AppData\Local\Kucanaf
    2018-05-09 07:59 - 2018-05-09 08:01 - 000000000 ___HD C:\Users\Laurent Champion\AppData\Local\1a2c41cd533b8105
    2018-05-24 21:22 - 2018-03-11 11:06 - 000000000 ____D C:\Program Files (x86)\PremierOpinion
    HKU\S-1-5-21-3966068022-3775404913-4185320479-1001\...\Run: [Chromium] => c:\users\laurent champion\appdata\local\chromium\application\chrome.exe [859648 2017-02-27] (The Chromium Authors)
    c:\users\laurent champion\appdata\local\chromium
    C:\ProgramData\{3B2DFE4E-B16F-7488-37A9-EACAADEB6104}
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:


    Save the content through the file menu and then save.

    Close the notepad, go back to FRST and click the "Fix" button.
    A restart may be necessary and automatic.
    A text file will appear, copy/paste the content here in a new message.

    Restart the computer.

    2°)
    Reset/Repair the WEB browsers concerned by the problems:

    0
  3. LaurentChampion
     
    Hello!
    While trying to remove PremierOpinion, I realized that it was also quite a mess... impossible to uninstall via the usual method... unless the previous manipulation actually deleted it. Anyway,
    here's the report of what I did and really thanks for the help.

    Report:
    Results of Farbar Recovery Scan Tool (x64) Version: 16.05.2018 01
    Executed by Laurent Champion (25-05-2018 09:22:59) Run:1
    Executed from C:\Users\Laurent Champion\Desktop
    Loaded profiles: Laurent Champion (Available profiles: Laurent Champion)
    Boot mode: Normal
    ==============================================

    fixlist content:
    CreateRestorePoint:
    CloseProcesses:
    R2 PremierOpinion; C:\Program Files (x86)\PremierOpinion\pmservice.exe [208320 2018-01-11] (VoiceFive, Inc.) <==== ATTENTION
    2018-05-25 00:59 - 2018-05-25 00:59 - 000000000 ____D C:\Users\Laurent Champion\AppData\Local\{C5C9F395-E161-9F2D-8CF9-BAC5A891465D}
    2018-05-12 11:03 - 2018-05-13 19:59 - 000000000 ____D C:\WINDOWS\System32\Tasks\productupdt
    Task: C:\WINDOWS\Tasks\Search Provided by Bing nasif.job => C:\Windows\system32\wscript.ex C:\ProgramData\{3B2DFE4E-B16F-7488-37A9-EACAADEB6104}\taca.txt
    2018-05-12 11:02 - 2018-05-15 07:12 - 000000000 ____D C:\Users\Laurent Champion\AppData\Local\{1BA82DF4-3F00-414C-5298-64A476F0983C}
    2018-05-12 11:02 - 2018-05-13 19:59 - 000000000 ____D C:\Users\Laurent Champion\AppData\Roaming\Hagafek
    2018-05-12 11:02 - 2018-05-12 11:04 - 000000000 ____D C:\Users\Laurent Champion\AppData\Local\Kucanaf
    2018-05-09 07:59 - 2018-05-09 08:01 - 000000000 ___HD C:\Users\Laurent Champion\AppData\Local\1a2c41cd533b8105
    2018-05-24 21:22 - 2018-03-11 11:06 - 000000000 ____D C:\Program Files (x86)\PremierOpinion
    HKU\S-1-5-21-3966068022-3775404913-4185320479-1001\...\Run: [Chromium] => c:\users\laurent champion\appdata\local\chromium\application\chrome.exe [859648 2017-02-27] (The Chromium Authors)
    c:\users\laurent champion\appdata\local\chromium
    C:\ProgramData\{3B2DFE4E-B16F-7488-37A9-EACAADEB6104}
    Hosts:
    EmptyTemp:
    RemoveProxy:
    Reboot:

    The restore point was created successfully.
    Process closed successfully.
    "HKLM\System\CurrentControlSet\Services\PremierOpinion" => successfully deleted
    PremierOpinion => service successfully deleted
    "C:\Users\Laurent Champion\AppData\Local\{C5C9F395-E161-9F2D-8CF9-BAC5A891465D}" => not found
    C:\WINDOWS\System32\Tasks\productupdt => successfully moved
    C:\WINDOWS\Tasks\Search Provided by Bing nasif.job => successfully moved
    C:\Users\Laurent Champion\AppData\Local\{1BA82DF4-3F00-414C-5298-64A476F0983C} => successfully moved
    C:\Users\Laurent Champion\AppData\Roaming\Hagafek => successfully moved
    C:\Users\Laurent Champion\AppData\Local\Kucanaf => successfully moved
    C:\Users\Laurent Champion\AppData\Local\1a2c41cd533b8105 => successfully moved
    C:\Program Files (x86)\PremierOpinion => successfully moved
    "HKU\S-1-5-21-3966068022-3775404913-4185320479-1001\Software\Microsoft\Windows\CurrentVersion\Run\\Chromium" => successfully deleted
    c:\users\laurent champion\appdata\local\chromium => successfully moved
    C:\ProgramData\{3B2DFE4E-B16F-7488-37A9-EACAADEB6104} => successfully moved
    C:\Windows\System32\Drivers\etc\hosts => successfully moved
    Hosts restored successfully.

    ========= RemoveProxy: =========

    "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => successfully deleted
    "HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => successfully deleted
    "HKU\S-1-5-21-3966068022-3775404913-4185320479-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings" => successfully deleted
    "HKU\S-1-5-21-3966068022-3775404913-4185320479-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings" => successfully deleted

    ========= End of RemoveProxy: =========

    =========== EmptyTemp: ==========

    BITS transfer queue => 9199616 B
    DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 345591536 B
    Java, Flash, Steam htmlcache => 2344 B
    Windows/system/drivers => 3410054 B
    Edge => 30005 B
    Chrome => 0 B
    Firefox => 402860681 B
    Opera => 0 B

    Temp, IE cache, history, cookies, recent:
    Default => 0 B
    Users => 0 B
    ProgramData => 0 B
    Public => 0 B
    systemprofile => 0 B
    systemprofile32 => 0 B
    LocalService => 49152 B
    NetworkService => 105982 B
    Laurent Champion => 43428630 B

    RecycleBin => 0 B
    EmptyTemp: => 767.4 MB of temporary data deleted.

    ================================

    The system had to restart.

    End of Fixlog 09:25:50

    0
  4. LaurentChampion
     
    Oh yes, I see that the report mentions Premier Opinion indeed!
    It remains in Applications and Features in the settings but it might be disabled... we'll see when using it :p
    0
    1. Malekal_morte- Posted messages 178136 Registration date   Status Moderator, Security Contributor Last intervention   24 712
       
      Yes, see if the ads stop.
      0