View original (French)

I want to delete Poshukach

Solved
zelt.8k -  
Hello everyone, I have a little problem. I turned on my PC and found myself on the desktop, which is normal. Suddenly, a small pop-up window appeared at the bottom right of my screen. I didn't read it well, but it mentioned antivirus. So I thought, okay, an antivirus, why not. I clicked on Finish. I went out and now I've come back to see that Chrome has changed and it's become weird. I looked into it and found out it's a virus named Poshukach. I even found the solution here: https://forums.commentcamarche.net/forum/affich-37281577-comment-se-debarasser-de-poshukach#answers
But I really didn't understand anything. If someone can help me as soon as possible, that would be great
Thanks in advance.

5 answers

  1.  bazfile Moderator
    Hello,
    Download FRST once downloaded save it to the desktop then right-click on FRST and choose Run as administrator you will have this:
    Click on Scan

    Attention, wait for the messages indicating that the scan is complete to appear



    At the end of the scan you will have two text files on the desktop FRST and Addition

    Then send the FRST and ADDITION reports to CJOINT see THIS TUTORIAL then provide the two links generated by Cjoint in your response.

    --
    bazfile
    Moderator/Security Contributor.
    a hello, a response, a thank you are always appreciated.
    1
    1. zelt.8k Author
      I'll get back to you shortly.
      0
    2. zelt.8k Author
      I'm sorry, I really don't understand what you mean.
      0
    3. zelt.8k Author
      I clicked directly on Analyze, it saved FRST.TXT in the folder where FRST is located.
      0
  2. zelt.8k Author
    OK IT'S GOOD I JUST FOUND THE TWO TEXT FILES
    0
    1. bazfile Moderator
      Procedure to follow in the indicated order:

      1- Open FRST as an administrator by right-clicking on FRST and selecting run as administrator
      2 - Copy the entire script from the box below: 
      Start::
      CreateRestorePoint:
      CloseProcesses:
      GroupPolicy: Restriction ? 
      Policies: C:\ProgramData\NTUSER.pol: Restriction
      Edge Extension: (No name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
      Edge Extension: (No name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
      Edge Extension: (No name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
      Edge Extension: (No name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
      CHR HomePage: Default -> hxxps://poshukach.com?fr=ps&gp=496723&altserp=1
      CHR StartupUrls: Default -> "hxxps://poshukach.com?fr=ps&gp=496723&altserp=1"
      CHR DefaultSearchURL: Default -> hxxps://poshukach.com/search?q={searchTerms}&fr=ps&gp=496723&altserp=1
      CHR DefaultSearchKeyword: Default -> poshukach engin search
      CHR DefaultSuggestURL: Default -> hxxps://suggest.finditnowonline.com/suggestionfeed/suggestion?format=json&gd=496721&q={searchTerms}
      S2 DCIService; C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe [X]
      S3 EpicOnlineServices; "C:\Program Files (x86)\Epic Games\Epic Online Services\service\EpicOnlineServicesHost.exe" [X]
      AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [10]
      AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [7266]
      EmptyTemp:
      End::

      3- Once the script is copied, click Fix, FRST will automatically take the script from the clipboard.



      Let the fix complete, once it's done you will be asked to restart your PC, do it as soon as requested, see below.
      Then once your computer is restarted:
      4- You will have a Fixlog file on your desktop, then send these reports to https://www.cjoint.com/ see this tutorial then provide the link generated by Cjoint in your next message.

      5- CHECK AND TELL ME IF YOUR PROBLEM IS STILL PRESENT

      .

      --
      bazfile
      Moderator/Security Contributor.
      A hello, a response, a thank you are always appreciated.
      0
      1. Zelt.8k
        Il semble que le lien que vous avez partagé soit un fichier ou une image. Je ne peux pas y accéder directement. Si vous souhaitez expliquer ce qui semble étrange avec Chrome ou si vous avez besoin d'aide à ce sujet, n'hésitez pas à fournir plus de détails !
        0
      2. bazfile Moderator
        @Zelt.8kIs Poshukach still present?
        What do you mean by strange in Chrome? Poshukach was in Chrome.
        0
      3. Zelt.8k
        @bazfileI don't know if it's just me, but I think it's slower. I'm going to restart and get back to you. By the way, it's like it's been reset. I don't know, sorry to bother you like this.
        0
    4. Zelt.8k
      It's all good, problem solved, thank you so much and I'm sorry again, it's all good, I've reset, I'm recovering my accounts, everything is back in order.
      Thank you soooooo much
      Just a few small questions before closing this discussion:
      1. Is there any risk from Poshukach since this morning around 8:00 regarding my data?
      2. If possible, recommend me a good free antivirus to avoid this happening again.
      Thanks again
      0
      1. bazfile Moderator
        Poshukach is a parasitic search engine or, if you prefer, adware. It usually comes through the installation of free software, and antivirus programs will not protect you from this kind of thing. It's up to you to be careful before allowing the installation of such stuff, as you are the one who authorized its installation, perhaps because of SpyHunter that you downloaded this morning, which is software to avoid.

        Here’s how it happens in images:
        In the future, be careful when installing free software; during the installation, make sure to read the different screens carefully to avoid being trapped. You need to uncheck the proposed boxes, as they are not always visible at first glance, for example:

        1
      2. zelt.8k Author
        @bazfileThank you so much, but I want to clarify that I downloaded SpyHunter after being infected to remedy the situation. I really appreciate you taking the time to help me and answer my questions.
        0
      3. bazfile Moderator
        @zelt.8kYou're welcome.
        See you on CCM.
        0