View original (French)

Virus poshukach: how to remove it?

Solved
gbagbo29 Posted messages 4 Status Member -  
bazfile Posted messages 58498 Registration date   Status Moderator Last intervention   -

Hello everyone,

For a while now, I've noticed that my web homepage has changed with the continuous presence of a rather strange site.

After some research, I found out that it was a virus called poshukach. I tried to remove it using instructions on Google and even YouTube videos, but to no avail.

I'm reaching out to you for help in removing it.

Thank you in advance!


5 answers

  1.
    bazfile Posted messages 58498 Registration date   Status Moderator Last intervention   20 273
     

    Hello.
    Download FRST once downloaded, save it on the desktop then right-click on FRST and select Run as administrator you will have this:

    Click on Analyze

    Warning, wait for the messages saying that the analysis is complete to appear.

    At the end of the analysis, you will have two text files on the desktop FRST and Addition.

    Then send the FRST and ADDITION reports to CJOINT see THIS TUTORIAL then give the two links generated by Cjoint in your reply.

    bazfile
    Moderator/Security Contributor.
    a hello, a response, a thank you are always appreciated.

    0
  3. bazfile Posted messages 58498 Registration date   Status Moderator Last intervention   20 273
     

    Procedure to follow in the indicated order:

    First Uninstall the following software:

    - Avast Secure Browser

    - Chrome Browser

    - SearcherBar

    - SMADAV version 14.8.1

    - Web Companion

    You have a non-official version of Firefox in your programs called Firefox Browser published by Istart, known for distributing adware. Uninstall Firefox Browser, to install Firefox you must go through the official site.

    Then do the following:

    1- Open FRST as an administrator by right-clicking on FRST and choosing run as administrator
    2 - Copy the entire script that is in the box below:

      Start:: CreateRestorePoint: CloseProcesses: HKU\S-1-5-21-557437099-1609467969-272288800-1001\...\Run: [Firefox Browser] => C:\Firefox\X-Firefox.exe [549794 2018-07-09] (www.winpenpack.com) [Unsigned file] C:\Firefox HKU\S-1-5-21-557437099-1609467969-272288800-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe [9250224 2022-08-09] (Lavasoft Software Canada Inc. -> Lavasoft) R2 DCIService; C:\Program Files (x86)\Lavasoft\Web Companion\Service\x64\DCIService.exe [3413424 2022-08-09] (Lavasoft Software Canada Inc. -> ) R2 WCAssistantService; C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe [22960 2022-08-09] (Lavasoft Software Canada Inc. -> ) Edge Notifications: Default -> hxxps://www.facebook.com Edge HomePage: Default -> hxxps://go-go.tech?fr=ps&gp=496724&altserp=1 Edge StartupUrls: Default -> "hxxps://go-go.tech?fr=ps&gp=496724&altserp=1" Edge DefaultSearchURL: Default -> hxxps://go-go.tech/search?q={searchTerms}&fr=ps&gp=496724&altserp=1 Edge DefaultSearchKeyword: Default -> go go tech search Edge DefaultSuggestURL: Default -> hxxps://suggest.finditnowonline.com/suggestionfeed/suggestion?format=json&gd=496721&q={searchTerms} CHR HomePage: Default -> hxxps://go-go.tech?fr=ps&gp=496724&altserp=1 CHR StartupUrls: Default -> "hxxps://go-go.tech?fr=ps&gp=496724&altserp=1" CHR DefaultSearchURL: Default -> hxxps://go-go.tech/search?q={searchTerms}&fr=ps&gp=496724&altserp=1 CHR DefaultSearchKeyword: Default -> go go tech search CHR DefaultSuggestURL: Default -> hxxps://suggest.finditnowonline.com/suggestionfeed/suggestion?format=json&gd=496721&q={searchTerms} HKU\S-1-5-21-557437099-1609467969-272288800-1001\...\RunOnce: [Delete Cached Update Binary] => C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\PC\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" (File not found) HKU\S-1-5-21-557437099-1609467969-272288800-1001\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\PC\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (File not found) HKU\S-1-5-21-557437099-1609467969-272288800-1001\...\RunOnce: [Uninstall 22.176.0821.0003] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\PC\AppData\Local\Microsoft\OneDrive\22.176.0821.0003" (File not found) Task: {3621D697-0100-4F8E-A971-A11E265F2D49} - System32\Tasks\Opera scheduled Autoupdate 1652629015 => C:\Users\PC\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (File not found) AV: 360 Total Security (Enabled - Up to date) {FFDC234A-CE9B-08F9-406B-F876951CE066} FirewallRules: [{8DC5E880-2B5B-4DC4-9DF5-99A772CA5483}] => (Allow) C:\Users\PC\AppData\Local\Programs\Opera\86.0.4363.59\opera.exe => File not found FirewallRules: [{22C6DC0C-57CC-4258-A279-52B4FFE44BA7}] => (Allow) C:\Users\PC\AppData\Local\Programs\Opera\87.0.4390.36\opera.exe => File not found EmptyTemp: End::

    3- Once the script is copied click on Fix, FRST will automatically take the script that is in the clipboard.


    Let the fix complete once it's done you will be asked to restart your PC, do it as soon as prompted, see below.

    Then once your computer has restarted:
    4- You will have a Fixlog file on your desktop then send these reports to https://www.cjoint.com/ then provide the link generated by Cjoint in your next message.

    5- CHECK AND LET ME KNOW IF YOUR ISSUE IS STILL PRESENT

    bazfile
    Moderator/Contributor security.
    a hello, a response, a thank you are always appreciated.

    0
  6. bazfile Posted messages 58498 Registration date   Status Moderator Last intervention   20 273
     

    The fixlog is OK.


    You can uninstall FRST, rename the FRST file you downloaded to uninstall, and once the file is renamed, open it; the uninstallation will proceed automatically via a restart of the PC.

    bazfile
    Moderator/Security Contributor.
    A hello, a response, a thank you are always welcome.

    0