Where does the phantom music come from

Conduit is listed as "Search Protect" in Programs and Features.

Yes, that's what I am saying. If it's not listed there but it's showing in your browser, then you need to go in to your browser extensions and disable it there.

Three programs that I use on my computers to get rid of such trash.

AdwCleaner Download

https://www.malwarebytes.org/

Free Virus Scan | Online Virus Scanner from ESET

k0065126 said:

Thanks Bill,

I have followed some of your advice so far. The Google toolbar for IE has now been uninstalled. I have reset IE, Firefox and Chrome, although I could not remove the Conduit extension as it is not listed.

There are a few differences in the AdwCleaner log from last time but I will wait until tomorrow before I let it clean the registry as I wish to make a registry backup and have a new system backup in case of problems.

I will let you know how I get on tomorrow, thanks for all your help.

Backups makes sense to me. I'll read the new AdwCleaner log and wait for your next post. I expect the new log shows your resetting the browsers (Chrome... understood, no conduit - thanks).

I'm not concerned about nircmd, it is in the correct location
>> VirusTotal suspects in other reports is most likely due to it being in other locations.... if that were the case on your machine, I would be more concerned)

Did you get any feedback from VoiceTeach?

I'm also glad you waited - I only recommended Unticking nircmd, but after reviewing your post with the VirusTotal information, I'll revise that to also Untick install.rdf.

You seem fairly comfortable and knowledgeable with computers, I'm guessing you would have done that on your own.

Bill
.

A quick look at AdwCleaner[R8] confirms that the difference is due to the browser and toolbar work you already did.

So now... I'll wait until your backups are done and you run the clean cycle of AdwCleaner.

Please post the logs after you run AdwCleaner Clean.

Then a few other scans to double check.

If at any time the "phantom music" isn't present, please post that information. It might not be east to determine that though since it's intermittent.

If the "phantom music" does get resolved in the first pass using AdwCleaner, it doesn't mean you shouldn't run additional scans

Bill
.

Thanks for the update Viv,

I'd still like to see the logs from any scanner you have run (if you're following Layback's list that would be AdwCleaner and Malwarebytes (Mbam)) and the ESET log when it finishes.

And just so I'm on track - you are cleaning / removing malware when the scanner displays the results, right?

Good about the sound, but yeah it's inconclusive for the moment. Keep track of the web pages you open as you increase the number to see if a specific often visited page is the culprit.

Bill
.