Windows that open on their own..

Solved

Peewee128 -
val - 20 Apr 2014 at 16:51

Hello,

Lately, many windows keep opening repeatedly - whether it's Google Chrome, which I use regularly, or IE, which I never use.
No matter how many scans I run with Avast! or Spybot, it doesn't change anything.

How can I get rid of these ads that keep opening incessantly?

Thank you in advance for your help!
Configuration: Windows Vista / Safari 536.5

15 answers

Answer 1 / 15

Best answer
The best answer is the one that has been validated by our teams.
kalimusic Posted messages 14619 Status Security Contributor 3 027

Hello,

You must have installed one or more unwanted programs.
Let's take a look at this together:

Download AdwCleaner (by Xplode) to your desktop.
● Launch AdwCleaner
- On XP, double-click the icon to launch the tool.
- On Vista/Seven, right-click the icon and choose "Run as administrator" from the context menu.
● Click on Search
● Wait for the scan to finish, the report should open automatically at the end.

The report is saved at the root of drive C:\AdwCleaner[R1].txt

Post the report, see you +
--
“Reason and logic cannot do anything against stubbornness and foolishness.”
3
1. sam
  
  Hello, I also have the same problem. I installed AdwCleaner, I did the scan and received the report, but how can I find out the name of the virus? Thank you for replying.
  
  0
2. kalimusic Posted messages 14619 Status Security Contributor 3 027
  
  Hello,
  
  Thank you for creating your own topic: https://forums.commentcamarche.net/forum/virus-securite-7/new
  
  0
3. maguigrigri Posted messages 48 Status Member 5
  
  # AdwCleaner v3.007 - Report created on 10/12/2013 at 20:44:12
  # Updated on 10/09/2013 by Xplode
  # Operating System: Windows 7 Home Premium (64 bits)
  # Username: DAVELUY Magali - SAMSUNG-PC
  # Executed from: C:\Users\DAVELUY Magali\Downloads\adwcleaner.exe
  # Option: Scan
  
  ***** [ Services ] *****
  
  ***** [ Files / Folders ] *****
  
  Folder Present: C:\Users\DAVELUY Magali\AppData\Local\Google\Chrome\User Data\Default\Extensions\cnmdgidklhhnmppphpohildcefnaaflp
  Folder Present C:\Users\DAVELUY Magali\AppData\Local\pixeasy Air
  File Present: C:\Users\DAVELUY Magali\AppData\Roaming\Mozilla\Firefox\Profiles\c0dh4an7.default\Extensions\jid1-FCM5fDwCW5M3AQ@jetpack.xpi
  File Present: C:\Windows\System32\Tasks\BoxSoftwareUpdate
  
  ***** [ Shortcuts ] *****
  
  ***** [ Registry ] *****
  
  Key Present: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
  Key Present: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5}
  Key Present: [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
  Key Present: HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
  Key Present: HKLM\Software\Classes\Installer\Features\DF42B2AC01EE9B240B94AA0862E8E712
  Key Present: HKLM\Software\Classes\Installer\Products\DF42B2AC01EE9B240B94AA0862E8E712
  Key Present: HKLM\SOFTWARE\Classes\protector_dll.protectorbho
  Key Present: HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
  Key Present: HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
  Key Present: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CA2B24FD-EE10-42B9-B049-AA80268E7E21}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{01947140-417F-46B6-8751-A3A2B8345E1A}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{0BF91075-F457-4A8B-99EF-140B52D2F22A}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{37425600-CB21-49A0-8659-476FBAB0F8E8}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{431FB0E5-2CBB-4602-9FE6-F1D64488ADD7}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{5C9A230D-70A5-11D5-AFB0-0050DAC67890}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{8911483C-C00A-4183-9FBC-6C9C00946C15}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{C3F058A9-407D-4CD1-8F66-B75605B54B69}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{EFDCAF05-D29C-4D4D-9836-8CDCD606A6B2}
  Key Present: [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
  Key Present: [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
  
  ***** [ Browsers ] *****
  
  -\\ Internet Explorer v9.0.8112.16476
  
  -\\ Mozilla Firefox v12.0 (fr)
  
  [ File: C:\Users\DAVELUY Magali\AppData\Roaming\Mozilla\Firefox\Profiles\c0dh4an7.default\prefs.js ]
  
  -\\ Google Chrome v
  
  [ File: C:\Users\DAVELUY Magali\AppData\Local\Google\Chrome\User Data\Default\preferences ]
  
  *************************
  
  AdwCleaner[R0].txt - [40922 bytes] - [09/03/2013 16:37:59]
  AdwCleaner[R1].txt - [1475 bytes] - [09/05/2013 18:08:15]
  AdwCleaner[R2].txt - [2000 bytes] - [09/20/2013 18:47:05]
  AdwCleaner[R3].txt - [4762 bytes] - [10/12/2013 20:44:12]
  AdwCleaner[S0].txt - [39984 bytes] - [09/03/2013 16:46:12]
  AdwCleaner[S1].txt - [2086 bytes] - [09/20/2013 19:11:45]
  
  ########## EOF - C:\AdwCleaner\AdwCleaner[R3].txt - [4943 bytes] ##########
  
  There you go :p I have already done scans with it for ads on Google Chrome ;)
  
  0
4. kalimusic Posted messages 14619 Status Security Contributor 3 027
  
  Good evening
  
  Thank you for creating your own topic: https://forums.commentcamarche.net/forum/virus-securite-7/new
  
  -1
5. val
  
  # AdwCleaner v3.100 - Report created on 20/04/2014 at 16:29:14
  # Updated on 20/04/2014 by Xplode
  # Operating System: Windows 8.1 (64 bits)
  # Username: synergy - PORTABLE
  # Executed from: C:\Users\synergy\Downloads\adwcleaner.exe
  # Option: Clean
  
  ***** [ Services ] *****
  
  Service Deleted: CltMngSvc
  Service Deleted: NewPlayerUpdaterService
  Service Deleted: Wajam Internet Enhancer Service
  
  ***** [ Files / Folders ] *****
  
  Folder Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NewPlayer
  Folder Deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wajam
  Folder Deleted: C:\Program Files (x86)\NewPlayer
  Folder Deleted: C:\Program Files (x86)\SearchProtect
  Folder Deleted: C:\Program Files (x86)\Wajam
  Folder Deleted: C:\Users\synergy\AppData\Local\NewPlayer
  Folder Deleted: C:\Users\synergy\AppData\Local\SearchProtect
  Folder Deleted: C:\Users\synergy\AppData\Roaming\wp_update
  Folder Deleted: C:\Users\synergy\Documents\Youcam
  Folder Deleted: C:\Users\synergy\AppData\Local\Google\Chrome\User Data\Default\Extensions\majjphhgppkndjjkmhhnbgafooenebhd
  File Deleted: C:\Users\Public\Desktop\NewPlayer.lnk
  File Deleted: C:\Users\synergy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.wajam.com_0.localstorage
  File Deleted: C:\Users\synergy\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.wajam.com_0.localstorage-journal
  
  ***** [ Shortcuts ] *****
  
  ***** [ Registry ] *****
  
  Key Deleted: HKCU\Software\Wajam
  Key Deleted: HKLM\Software\Wajam
  Key Deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wajam
  
  ***** [ Browsers ] *****
  
  -\\ Internet Explorer v11.0.9600.17037
  
  -\\ Mozilla Firefox v
  
  [ File: C:\Users\synergy\AppData\Roaming\Mozilla\Firefox\Profiles\p1y195yn.default\prefs.js ]
  
  -\\ Google Chrome v33.0.1750.154
  
  [ File: C:\Users\synergy\AppData\Local\Google\Chrome\User Data\Default\preferences ]
  
  *************************
  
  AdwCleaner[R0].txt - [75962 bytes] - [20/04/2014 15:48:27]
  AdwCleaner[R1].txt - [2338 bytes] - [20/04/2014 16:24:56]
  AdwCleaner[S0].txt - [66486 bytes] - [20/04/2014 15:53:07]
  AdwCleaner[S1].txt - [2254 bytes] - [20/04/2014 16:29:14]
  
  ########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2314 bytes] ##########
  
  0
Answer 2 / 15
M@thew Posted messages 2602 Registration date Status Security Contributor Last intervention 67

Hello.

Spybot hasn’t been updated for a long time, so
you can remove it from your PC as it is no longer useful.

To replace it, you can download: Malwarebytes

We all learned this one day, we should never forget it...
1
Answer 3 / 15
kalimusic Posted messages 14619 Status Security Contributor 3 027

re,

If the report is too long, it cannot be posted on the forum.
Host it on one of the following sites:
https://www.cjoint.com/
http://pjjoint.malekal.com/
http://threat-rc.com/
https://textup.fr/
You will get a link that you will give me in your next message so that I can review it.

See you later
--
“Reason and logic can do nothing against stubbornness and foolishness.”
1
Answer 4 / 15
Peewee128

Can't respond because supposedly "title not provided"... Am I really a noob or what? :|
0
Answer 5 / 15
Peewee128

Thank you very much!

Here is the link: http://cjoint.com/?BEAkjCzSH0C
0
Answer 6 / 15
kalimusic Posted messages 14619 Status Security Contributor 3 027
ok,

The advertising manager is the software/tutorial pctuto, to understand why: https://forum.security-x.fr/securite-generale/tuto4pc-et-accord-de-licence/

You need to be careful when installing a program, never through advertising links. Avoid various toolbars or search bars, etc., offered during installation: https://forum.malekal.com/viewtopic.php?t=33776&start=

1. Uninstall if still present and if possible:
```
Agence-Exclusive Babylon or/and Babylon Toolbar Conduit or/and conduit engine InstallPedia PCTuto or Tuto4pc (the software + the tutorial) ScanQuery Soft2PC
```
Help: How to uninstall a program

2. Relaunch AdwCleaner

- Under XP double-click on the icon to launch the tool.
- Under Vista/Seven right-click on the icon and choose "Run as administrator" from the context menu.
● Click on Removal
● Wait for the scan to complete, agree to restart if the tool requests it
● The report should open automatically.

The report is saved at the root of the disk C:\AdwCleaner[S1].txt

Post the report, A +
--
"Reason and logic can do nothing against stubbornness and folly."
0
1. Peewee128
  
  Tadaaa :
  
  Key Present: HKCU\Software\Tuto4PC
  [x64] Key Present: HKCU\Software\Tuto4PC
  
  ***** [Registry - GUID] *****
  
  ***** [Browsers] *****
  
  -\\ Internet Explorer v9.0.8112.16421
  
  [OK] The registry does not contain any illegitimate entries.
  
  -\\ Mozilla Firefox v11.0 (fr)
  
  Profile name: default
  File: C:\Users\Dominique et Estelle\AppData\Roaming\Mozilla\Firefox\Profiles\xl0n4wge.default\prefs.js
  
  [OK] The file does not contain any illegitimate entries.
  
  Profile name: default
  File: C:\Users\Mow'\AppData\Roaming\Mozilla\Firefox\Profiles\okzuen2e.default\prefs.js
  
  [OK] The file does not contain any illegitimate entries.
  
  Profile name: default
  File: C:\Users\Rom & Dana\AppData\Roaming\Mozilla\Firefox\Profiles\l6ojzqda.default\prefs.js
  
  [OK] The file does not contain any illegitimate entries.
  
  Profile name: default
  File: C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\7ix23xm5.default\prefs.js
  
  [OK] The file does not contain any illegitimate entries.
  
  Profile name: default
  File: C:\Users\dana et romain\AppData\Roaming\Mozilla\Firefox\Profiles\mnnmz22j.default\prefs.js
  
  [OK] The file does not contain any illegitimate entries.
  
  -\\ Google Chrome v19.0.1084.52
  
  File: C:\Users\Dominique et Estelle\AppData\Local\Google\Chrome\User Data\Default\Preferences
  
  [OK] The file does not contain any illegitimate entries.
  
  File: C:\Users\Mow'\AppData\Local\Google\Chrome\User Data\Default\Preferences
  
  [OK] The file does not contain any illegitimate entries.
  
  File: C:\Users\Rom & Dana\AppData\Local\Google\Chrome\User Data\Default\Preferences
  
  [OK] The file does not contain any illegitimate entries.
  
  File: C:\Users\dana et romain\AppData\Local\Google\Chrome\User Data\Default\Preferences
  
  [OK] The file does not contain any illegitimate entries.
  
  *************************
  
  AdwCleaner[R1].txt - [56863 bytes] - [26/05/2012 09:55:48]
  AdwCleaner[S1].txt - [55362 bytes] - [26/05/2012 10:24:57]
  AdwCleaner[R2].txt - [2595 bytes] - [26/05/2012 10:30:01]
  AdwCleaner[R3].txt - [2528 bytes] - [26/05/2012 10:32:42]
  
  ########## EOF - C:\AdwCleaner[R3].txt - [2656 bytes] ##########
  
  0
Answer 7 / 15
kalimusic Posted messages 14619 Status Security Contributor 3 027

Your report is weird, how many Firefox profiles do you have?

Still having issues?

See you later
“Reason and logic can do nothing against stubbornness and foolishness.”
0
Answer 8 / 15
Peewee128

How many Firefox profiles are there? I don't know what that is.
We are 3 different users on this computer, each with our own session and 2 of us have admin status. Does each session with its own use of Firefox create a profile?

And regarding:
Key Present: HKCU\Software\Tuto4PC
[x64] Key Present: HKCU\Software\Tuto4PC

Does this mean it has not been deleted? Because in Add/Remove Programs they tell me it is not present.
0
Answer 9 / 15
kalimusic Posted messages 14619 Status Security Contributor 3 027

Your report wasn't complete; it was missing the header, that's why.
You posted a research report, initiate a deletion to see.

See you soon

--
“Reason and logic can do nothing against stubbornness and folly.”
0
1. Peewee128
  
  # AdwCleaner v1.607 - Report created on 26/05/2012 at 10:51:51
  # Updated on 23/05/2012 by Xplode
  # Operating System: Windows (TM) Vista Home Premium Service Pack 2 (64 bits)
  # Username: Mow' - PC-DE-DOMINIQUE
  # Executed from: C:\Users\Mow'\Downloads\adwcleaner.exe
  # Option [Deletion]
  
  ***** [Services] *****
  
  ***** [Files / Folders] *****
  
  Deleted on reboot: C:\Users\Dominique et Estelle\AppData\Roaming\Tuto4pc
  
  ***** [Registry] *****
  
  Deleted Key: HKCU\Software\Tuto4PC
  
  ***** [Registry - GUID] *****
  
  ***** [Browsers] *****
  
  -\\ Internet Explorer v9.0.8112.16421
  
  [OK] The registry contains no illegitimate entries.
  
  -\\ Mozilla Firefox v11.0 (fr)
  
  Profile Name: default
  File: C:\Users\Dominique et Estelle\AppData\Roaming\Mozilla\Firefox\Profiles\xl0n4wge.default\prefs.js
  
  [OK] The file contains no illegitimate entries.
  
  Profile Name: default
  File: C:\Users\Mow'\AppData\Roaming\Mozilla\Firefox\Profiles\okzuen2e.default\prefs.js
  
  [OK] The file contains no illegitimate entries.
  
  Profile Name: default
  File: C:\Users\Rom & Dana\AppData\Roaming\Mozilla\Firefox\Profiles\l6ojzqda.default\prefs.js
  
  [OK] The file contains no illegitimate entries.
  
  Profile Name: default
  File: C:\Users\Dana\AppData\Roaming\Mozilla\Firefox\Profiles\7ix23xm5.default\prefs.js
  
  [OK] The file contains no illegitimate entries.
  
  Profile Name: default
  File: C:\Users\dana et romain\AppData\Roaming\Mozilla\Firefox\Profiles\mnnmz22j.default\prefs.js
  
  [OK] The file contains no illegitimate entries.
  
  -\\ Google Chrome v19.0.1084.52
  
  File: C:\Users\Dominique et Estelle\AppData\Local\Google\Chrome\User Data\Default\Preferences
  
  [OK] The file contains no illegitimate entries.
  
  File: C:\Users\Mow'\AppData\Local\Google\Chrome\User Data\Default\Preferences
  
  0
2. Peewee128
  
  (Pardon, earlier I didn't see a reference to the restart so I thought posting the research report would help see if there were still unresolved issues!)
  
  0
Answer 10 / 15
kalimusic Posted messages 14619 Status Security Contributor 3 027

No worries,

Everything seems to be back to normal for you too?

See you later
--
“Reason and logic can do nothing against stubbornness and folly.”
0
1. Peewee128
  
  For the moment, it seems to be going well :)
  And if it happens again, I know what to do now. Thank you very much, honestly, if I had come across such an easy process earlier, it would have been perfect! Thanks again, have a great day :)
  
  0
Answer 11 / 15
kalimusic Posted messages 14619 Status Security Contributor 3 027

If you understood my link given above, it won't happen again: just stop installing anything randomly ;)

Restart AdwCleaner as an administrator > Click on Uninstall

Make sure that software with potential security vulnerabilities is updated, that's how infections occur:

https://www.malekal.com/maintenir-java-adobe-reader-et-le-player-flash-a-jour/ or you can use this tool: Easily check and update risky software with SX Check&Update

!! Uncheck boxes offering partner software during installations !!

Uninstall any old versions of Java if you still have them installed.
https://www.java.com/fr/download/help/remove_olderversions.html

Have a good day
--
“Reason and logic can do nothing against stubbornness and foolishness.”
0
Answer 12 / 15
shoei

Hello, same advertising issue. Thank you for your help.
http://cjoint.com/?BHfbZxDaNAv
Best regards.
0
Answer 13 / 15
kalimusic Posted messages 14619 Status Security Contributor 3 027

Hello,

Thank you for creating your own topic: https://forums.commentcamarche.net/forum/virus-securite-7/new

Best regards
--
“Reason and logic can do nothing against stubbornness and foolishness.”
0
Answer 14 / 15
Eureka2 Posted messages 3 Status Member

For some time now, many windows keep opening repeatedly - on Google Chrome, which I use regularly.
I've run multiple scans with Avast!, but it doesn't change anything.
So, I downloaded AdwCleaner... after cleaning, still nothing, but here is the report.
Tell me how you managed to resolve it? Thanks.
0
Answer 15 / 15
kalimusic Posted messages 14619 Status Security Contributor 3 027

Hello,

Thank you for creating your own topic: https://forums.commentcamarche.net/forum/virus-securite-7/new

Best regards

--
"Reason and logic can do nothing against stubbornness and foolishness."
0

Windows that open on their own..

15 answers

Persistent anchoring

Help: assign a number to a word in another cell

Unchecked checkbox

Cpu startup impossible

Google maps does not recognize my current location [pc]

Blocked bios

How to remove the justitsrch search engine from pc

Iptv smarters stays stuck on loading on smart tv

G502 x mouse does not charge on powerplay

Iptv bug