View original (French)

I want to delete Poshukach

Solved
zelt.8k Posted messages 10 Status Member -  
bazfile Posted messages 58492 Registration date   Status Moderator Last intervention   -
Hello everyone, I have a little problem. I turned on my PC and found myself on the desktop, which is normal. Suddenly, a small pop-up window appeared at the bottom right of my screen. I didn't read it well, but it mentioned antivirus. So I thought, okay, an antivirus, why not. I clicked on Finish. I went out and now I've come back to see that Chrome has changed and it's become weird. I looked into it and found out it's a virus named Poshukach. I even found the solution here: https://forums.commentcamarche.net/forum/affich-37281577-comment-se-debarasser-de-poshukach#answers
But I really didn't understand anything. If someone can help me as soon as possible, that would be great
Thanks in advance.

5 answers

  1.
    bazfile Posted messages 58492 Registration date   Status Moderator Last intervention   20 268
     
    Hello,
    Download FRST once downloaded save it to the desktop then right-click on FRST and choose Run as administrator you will have this:
    Click on Scan

    Attention, wait for the messages indicating that the scan is complete to appear



    At the end of the scan you will have two text files on the desktop FRST and Addition

    Then send the FRST and ADDITION reports to CJOINT see THIS TUTORIAL then provide the two links generated by Cjoint in your response.

    --
    bazfile
    Moderator/Security Contributor.
    a hello, a response, a thank you are always appreciated.
    1
    1. zelt.8k Posted messages 10 Status Member
       
      I'll get back to you shortly.
      0
    2. zelt.8k Posted messages 10 Status Member
       
      I'm sorry, I really don't understand what you mean.
      0
    3. zelt.8k Posted messages 10 Status Member
       
      I clicked directly on Analyze, it saved FRST.TXT in the folder where FRST is located.
      0
  2. zelt.8k Posted messages 10 Status Member
     
    OK IT'S GOOD I JUST FOUND THE TWO TEXT FILES
    0
  3. bazfile Posted messages 58492 Registration date   Status Moderator Last intervention   20 268
     
    Procedure to follow in the indicated order:

    1- Open FRST as an administrator by right-clicking on FRST and selecting run as administrator
    2 - Copy the entire script from the box below: 
    Start::
    CreateRestorePoint:
    CloseProcesses:
    GroupPolicy: Restriction ? 
    Policies: C:\ProgramData\NTUSER.pol: Restriction
    Edge Extension: (No name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
    Edge Extension: (No name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
    Edge Extension: (No name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
    Edge Extension: (No name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
    CHR HomePage: Default -> hxxps://poshukach.com?fr=ps&gp=496723&altserp=1
    CHR StartupUrls: Default -> "hxxps://poshukach.com?fr=ps&gp=496723&altserp=1"
    CHR DefaultSearchURL: Default -> hxxps://poshukach.com/search?q={searchTerms}&fr=ps&gp=496723&altserp=1
    CHR DefaultSearchKeyword: Default -> poshukach engin search
    CHR DefaultSuggestURL: Default -> hxxps://suggest.finditnowonline.com/suggestionfeed/suggestion?format=json&gd=496721&q={searchTerms}
    S2 DCIService; C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe [X]
    S3 EpicOnlineServices; "C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe" [X]
    AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [10]
    AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [7266]
    EmptyTemp:
    End::

    3- Once the script is copied, click Fix, FRST will automatically take the script from the clipboard.



    Let the fix complete, once it's done you will be asked to restart your PC, do it as soon as requested, see below.
    Then once your computer is restarted:
    4- You will have a Fixlog file on your desktop, then send these reports to https://www.cjoint.com/ see this tutorial then provide the link generated by Cjoint in your next message.

    5- CHECK AND TELL ME IF YOUR PROBLEM IS STILL PRESENT

    .

    --
    bazfile
    Moderator/Security Contributor.
    A hello, a response, a thank you are always appreciated.
    0
    1. Zelt.8k
       
      Il semble que le lien que vous avez partagé soit un fichier ou une image. Je ne peux pas y accéder directement. Si vous souhaitez expliquer ce qui semble étrange avec Chrome ou si vous avez besoin d'aide à ce sujet, n'hésitez pas à fournir plus de détails !
      0
      1. bazfile Posted messages 58492 Registration date   Status Moderator Last intervention   20 268 > Zelt.8k
         
        Is Poshukach still present?
        What do you mean by strange in Chrome? Poshukach was in Chrome.
        0
      2. Zelt.8k > bazfile Posted messages 58492 Registration date   Status Moderator Last intervention  
         
        I don't know if it's just me, but I think it's slower. I'm going to restart and get back to you. By the way, it's like it's been reset. I don't know, sorry to bother you like this.
        0
  4. Zelt.8k
     
    (The problem persists and I have to refresh the sites for it to be normal.)
    0
    1. bazfile Posted messages 58492 Registration date   Status Moderator Last intervention   20 268
       
      Reset Chrome https://support.google.com/pixelslate/answer/3296214?hl=fr-CA
      1
      1. zelt.8k Posted messages 10 Status Member > bazfile Posted messages 58492 Registration date   Status Moderator Last intervention  
         
        So it's all good, problem solved, but is it normal that I have to reconnect to all my accounts on several things like Netflix, Twitter...
        0
      2. bazfile Posted messages 58492 Registration date   Status Moderator Last intervention   20 268 > zelt.8k Posted messages 10 Status Member
         
        Yes, it's normal.
        1
  6. Zelt.8k
     
    It's all good, problem solved, thank you so much and I'm sorry again, it's all good, I've reset, I'm recovering my accounts, everything is back in order.
    Thank you soooooo much
    Just a few small questions before closing this discussion:
    1. Is there any risk from Poshukach since this morning around 8:00 regarding my data?
    2. If possible, recommend me a good free antivirus to avoid this happening again.
    Thanks again
    0
    1. bazfile Posted messages 58492 Registration date   Status Moderator Last intervention   20 268
       
      Poshukach is a parasitic search engine or, if you prefer, adware. It usually comes through the installation of free software, and antivirus programs will not protect you from this kind of thing. It's up to you to be careful before allowing the installation of such stuff, as you are the one who authorized its installation, perhaps because of SpyHunter that you downloaded this morning, which is software to avoid.

      Here’s how it happens in images:
      In the future, be careful when installing free software; during the installation, make sure to read the different screens carefully to avoid being trapped. You need to uncheck the proposed boxes, as they are not always visible at first glance, for example:

      1
      1. zelt.8k Posted messages 10 Status Member > bazfile Posted messages 58492 Registration date   Status Moderator Last intervention  
         
        Thank you so much, but I want to clarify that I downloaded SpyHunter after being infected to remedy the situation. I really appreciate you taking the time to help me and answer my questions.
        0
      2. bazfile Posted messages 58492 Registration date   Status Moderator Last intervention   20 268 > zelt.8k Posted messages 10 Status Member
         
        You're welcome.
        See you on CCM.
        0