Getting rid of Vaudix
QueenJuls
Posted messages
4
Status
Member
-
Malekal_morte- Posted messages 178136 Registration date Status Moderator, Security Contributor Last intervention -
Malekal_morte- Posted messages 178136 Registration date Status Moderator, Security Contributor Last intervention -
Hello,
For several weeks now, I’ve been troubled by a virus invading my web pages: Vaudix. At first, intrusive ads appeared only on commercial sites (eBay, IKEA, etc.), but since yesterday they’re everywhere: La Poste, Google, Madmoizel... No matter how I close them, they come back every time. I’ve tried to delete them with CCleaner and Malwarebytes, but it doesn’t help. Each time I disable the extension in my Chrome settings, it doesn’t change anything. I should mention that I have Adblock extensions, just in case.
If someone could help me, I’d be really grateful!
Thanks in advance.
Configuration: Windows 7 / Chrome 36.0.1985.125
For several weeks now, I’ve been troubled by a virus invading my web pages: Vaudix. At first, intrusive ads appeared only on commercial sites (eBay, IKEA, etc.), but since yesterday they’re everywhere: La Poste, Google, Madmoizel... No matter how I close them, they come back every time. I’ve tried to delete them with CCleaner and Malwarebytes, but it doesn’t help. Each time I disable the extension in my Chrome settings, it doesn’t change anything. I should mention that I have Adblock extensions, just in case.
If someone could help me, I’d be really grateful!
Thanks in advance.
Configuration: Windows 7 / Chrome 36.0.1985.125
3 answers
-
Hi,
You have installed adware and parasite programs on your PC that open ads and slow down the computer and web browsers.
Here is the procedure to remove them:
Download https://www.malekal.com/adwcleaner-supprimer-virus-adwares-pup/?t=33839&start= AdwCleaner (by Xplode) on your desktop.
On the AdwCleaner page, on the right, click the gray floppy disk with the green arrow to start the download.
Run AdwCleaner, click on [Scanner].
The scan can take several minutes, please wait.
Once the scan is finished, click [Clean]
Once the cleaning is complete, a report will open. Copy/paste the contents of the report in your next reply by copy/paste.
If that doesn’t work, use the site http://pjjoint.malekal.com to host the report, provide the link to the report in a new message.
Note: The report is also saved at C:\AdwCleaner[S1].txt
then reset your browsers:
==================================
Reset your browsers or manually reconfigure your web browsers (start page, search engine etc) but also delete/disable unnecessary/parasite extensions:
* Internet Explorer and add-ons / search engines: https://forum.malekal.com/viewtopic.php?t=41399&start=
* Firefox: https://www.malekal.com/reparer-firefox/?t=36057&start=
* Google Chrome: https://www.malekal.com/reparer-google-chrome/?t=35837&start=
--
Comme l’ange que tu es, tu ris en apportant une légèreté à ma poitrine,
Tes yeux me traversent,
(Ta réponse est toujours 'peut-être')
C’est à ce moment-là que je me suis levé et que je suis parti -
Good evening,
Thank you very much for your reply! Clearly AdwCleaner did its job. Here is the report:
# AdwCleaner v3.310 - Report created on 21/09/2014 at 18:40:19
# Updated on 12/09/2014 by Xplode
# Operating system: Windows 7 Home Premium Service Pack 1 (32-bit)
# User name: admin - ADMIN-PC
# Ran from: C:\Users\admin\Downloads\adwcleaner_3.310.exe
# Option: Clean
***** [ Services ] *****
***** [ Files / Folders ] *****
Folder Deleted: C:\ProgramData\speedypc software
Folder Deleted: C:\ProgramData\Trusted Publisher
Folder Deleted: C:\Program Files\Adblocker
Folder Deleted: C:\Program Files\predm
Folder Deleted: C:\Program Files\Uninstaller
Folder Deleted: C:\Users\admin\AppData\Local\Chromatic Browser
Folder Deleted: C:\Users\admin\AppData\Local\torch
Folder Deleted: C:\Users\admin\AppData\Roaming\cacaoweb
Folder Deleted: C:\Users\admin\AppData\Roaming\DriverCure
Folder Deleted: C:\Users\admin\AppData\Roaming\speedypc software
Folder Deleted: C:\Users\Administrateur\AppData\Local\Chromatic Browser
Folder Deleted: C:\Users\Administrateur\AppData\Local\torch
Folder Deleted: C:\Users\Invité\AppData\Local\Chromatic Browser
Folder Deleted: C:\Users\Invité\AppData\Local\torch
Folder Deleted: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\wwn0xidx.default\Extensions\***@***
Folder Deleted: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\wwn0xidx.default\Extensions\***@***
Folder Deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iblenkmcolcdonmlfknbpbgjebabcoae
Folder Deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\edlhklplaaiegaajbjkoccakgcmofbkk
[!] Folder Deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Administrateur\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
[!] Folder Deleted: C:\Users\Invité\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbghkkcfnalpneelejhpopkphibkchje
Fichier Deleted: C:\Users\admin\daemonprocess.txt
Fichier Deleted: C:\Users\admin\AppData\Roaming\LiveSupport.exe_log.txt
Fichier Deleted: C:\Users\admin\AppData\Roaming\regsvr32.exe_log.txt
Fichier Deleted: C:\Users\admin\Desktop\cacaoweb.exe
Fichier Deleted: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\wwn0xidx.default\user.js
Fichier Deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Fichier Deleted: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
***** [ Scheduled Tasks ] *****
***** [ Shortcuts ] *****
***** [ Registry ] *****
Deleted Value: HKCU\Software\Microsoft\Windows\CurrentVersion\Run [cacaoweb]
Deleted Key: HKLM\SOFTWARE\Classes\Vaudix.Vaudix
Deleted Key: HKLM\SOFTWARE\Classes\Vaudix.Vaudix.1.3
Deleted Key: HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Deleted Key: HKLM\SOFTWARE\Classes\CLSID\{CB2D7AD4-079B-6060-E67F-A29DB33A1D91}
Deleted Key: HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}
Deleted Key: HKLM\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}
Deleted Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{CB2D7AD4-079B-6060-E67F-A29DB33A1D91}
Deleted Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CB2D7AD4-079B-6060-E67F-A29DB33A1D91}
Deleted Key: HKCU\Software\cacaoweb
Deleted Key: HKCU\Software\Optimizer Pro
Deleted Key: HKCU\Software\RegisteredApplicationsEx
Deleted Key: HKCU\Software\speedypc software
Deleted Key: HKCU\Software\AppDataLow\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Deleted Key: HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Deleted Key: HKLM\SOFTWARE\{4A0F38A9-FE55-4B89-B73F-E60FDC0F72E9}
Deleted Key: HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Deleted Key: HKLM\SOFTWARE\Bench
Deleted Key: HKLM\SOFTWARE\speedypc software
Deleted Data: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~1\sw-boo~1\assist~1.dll
Deleted Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA0054A5AB3EFFE4CB5660E44A1E7DCC
***** [ Browsers ] *****
-\\ Internet Explorer v11.0.9600.17239
-\\ Mozilla Firefox v9.0.1 (fr)
[ File : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\wwn0xidx.default\prefs.js ]
Deleted Line: user_pref("extensions.JcZbrE1l.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"warnalert11.com\")>-1||url.indexOf(sumorob[...
Deleted Line: user_pref("extensions.enabledAddons", "***@***:1.6.0,{ad9a41d2-9a49-4fa6-a79e-71a0785364c8}:9.5.3,{972ce4c6-7e08-4474-a285-3208198ce6fd}:9.0.1");
Deleted Line: user_pref("extensions.irmysearch.aflt", "telemsd1103");
Deleted Line: user_pref("extensions.irmysearch.cd", "2XzuyEtN2Y1L1QzuyE0CyCtD0D0EyB0ByCtBtC0BtBzz0CtDtN0D0Tzu0SyBtDyBtN1L2XzutBtFtBtFtCyEtFtCtAyBzytN1L1CzutCyD1B1P1R");
Deleted Line: user_pref("extensions.irmysearch.cr", "880923437");
Deleted Line: user_pref("extensions.irmysearch.instlRef", "");
Deleted Line: user_pref("browser.search.order.1", "WebSearch");
Deleted Line: user_pref("browser.search.defaultenginename", "WebSearch");
Deleted Line: user_pref("browser.search.selectedEngine", "WebSearch");
Deleted Line: user_pref("browser.search.order.1,S", "WebSearch");
Deleted Line: user_pref("browser.search.defaultenginename,S", "WebSearch");
Deleted Line: user_pref("browser.search.selectedEngine,S", "WebSearch");
-\\ Google Chrome v36.0.1985.125
[ File : C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Deleted [Search Provider] : hxxp://www.maisonsdumonde.com/FR/fr/search/?searchQuery={searchTerms}&search_category=0¤tPage=0&rawQuery=true&catHash=
Deleted [Search Provider] : hxxp://www.telesurtv.net/search?SearchableText={searchTerms}&sort_on=created
Deleted [Extension] : fbghkkcfnalpneelejhpopkphibkchje
Deleted [Extension] : iblenkmcolcdonmlfknbpbgjebabcoae
*************************
AdwCleaner[R0].txt - [37361 bytes] - [29/10/2013 16:18:31]
AdwCleaner[R1].txt - [7566 bytes] - [21/09/2014 18:38:09]
AdwCleaner[S0].txt - [34810 bytes] - [29/10/2013 16:22:27]
AdwCleaner[S1].txt - [7789 bytes] - [21/09/2014 18:40:19]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [7849 bytes] ########## -
Ok, voici la suite en anglais:
Scan Malwarebytes (time: about 40 minutes for the scan):
==================================================
Download and install Malwarebyte: https://www.malekal.com/tutoriel-malwarebyte-anti-malware/
Update it, then run a scan.
At the end of the scan, click on "Quarantine all" at the bottom left.
Restart the computer if needed.
After reboot, relaunch Malwarebytes.
Go to the History tab.
On the left, Scan history.
Double-click on the scan in the list.
Then at the bottom Copy to clipboard
Go to http://pjjoint.malekal.com and at the bottom, right-click / paste to paste the Malwarebytes scan report.
Click send.
In a new message here in reply, provide the pjjoint link so we can view the report.
then:
Run an OTL Scan - Time: About 40 minutes
=====================
OTL helps diagnose running programs and detect infections - the program will generate two reports OTL.txt and Extras.txt
Provide both reports:
You can follow the instructions on this page to help you: https://www.malekal.com/tutorial-otl/
* Download http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ to your desktop.
(On Vista/Win7, right-click OTL and choose Run as administrator)
* Run OTL
* In the top right of Quick Analysis, check "all users"
* In OTL, under Personalization, copy-paste the script below:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%ALLUSERSPROFILE%\Application Data\*.dll /s
%APPDATA%\*.
%PROGRAMFILES%\*.
%PROGRAMDATA%\*.
%APPDATA%\*.exe /s
%temp%\*.exe /s
%SYSTEMDRIVE%\*.exe
%systemroot%\*. /mp /s
%systemroot%\system32\consrv.dll
%systemroot%\system32\*.dll /lockedfiles
%windir%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
/md5start
explorer.exe
winlogon.exe
services.exe
wininit.exe
/md5stop
HKEY_CLASSES_ROOT\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /s
HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s
HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor /s
HKEY_CURRENT_USER\Software\Microsoft\Command Processor /s
CREATERESTOREPOINT
nslookup www.google.fr /c
ping www.google.fr /c
ipconfig /all /c
SAVEMBR:0
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
* Click the Analyze button.
**** If during the scan - OTL stops responding, do not touch anything and let the scan continue ****
* When the scan is finished, use the site http://pjjoint.malekal.com/ to send the OTL.txt report (and Extras.txt if present).
Provide the pjjoint link(s) that point to these reports here in a reply.
I repeat: provide the pjjoint report link here in the reply.
DO NOT COPY/PASTE THE REPORT HERE - PROVIDE THE PJJOINT LINK IN A NEW MESSAGE
--
Like the angel you are, you laugh creating a lightness in my chest,
Your eyes they penetrate me,
(Your answer's always 'maybe')
That's when I got up and left
