New
#21
Conduit is listed as "Search Protect" in Programs and Features.
Strollin,
Sorry, I do not understand. Are you saying that there should be a program named "Search Protect" in the list of programs? I cannot see one and I cannot see any programs which I am not aware of.
Viv
Yes, that's what I am saying. If it's not listed there but it's showing in your browser, then you need to go in to your browser extensions and disable it there.
Three programs that I use on my computers to get rid of such trash.
AdwCleaner Download
https://www.malwarebytes.org/
Free Virus Scan | Online Virus Scanner from ESET
Yikes!!!! Conduit is bad news. It's a search engine hijack and more. You can Google conduit Removal instructions. I've done it once before - seemed straight forward in my case - but you'll also find threads from others who ended up with more problems when trying on their own. May be best to get removal assistance from a security/malware forum expert. Or at least backup / image u r disk if u want to first try on your own
Backups makes sense to me. I'll read the new AdwCleaner log and wait for your next post. I expect the new log shows your resetting the browsers (Chrome... understood, no conduit - thanks).
I'm not concerned about nircmd, it is in the correct location
>> VirusTotal suspects in other reports is most likely due to it being in other locations.... if that were the case on your machine, I would be more concerned)
Did you get any feedback from VoiceTeach?
I'm also glad you waited - I only recommended Unticking nircmd, but after reviewing your post with the VirusTotal information, I'll revise that to also Untick install.rdf.
You seem fairly comfortable and knowledgeable with computers, I'm guessing you would have done that on your own.
Bill
.
A quick look at AdwCleaner[R8] confirms that the difference is due to the browser and toolbar work you already did.
So now... I'll wait until your backups are done and you run the clean cycle of AdwCleaner.
Please post the logs after you run AdwCleaner Clean.
Then a few other scans to double check.
If at any time the "phantom music" isn't present, please post that information. It might not be east to determine that though since it's intermittent.
If the "phantom music" does get resolved in the first pass using AdwCleaner, it doesn't mean you shouldn't run additional scans
Bill
.
LaybackBear,
Thanks, I already have the first two you mentioned and I am now running a scan with ESET which looks as if it will run for most of the night.
Bill,
I have had no response from VoiceTeach regarding nircmd.exe yet but I suspect that it is not a problem due to it's location. There have been no more phantom sounds in the last couple of days, but maybe I was not listening at the right time. Due to the occasional nature of it's occurrence it will probably be a few weeks before I can be sure that it has ceased, but my best guess is that it is from a web page which is no longer open. I will gradually increase the number of web pages which are open, (it is normally the same ones each day), to see if there is a recurrence of the sound.
Viv
Thanks for the update Viv,
I'd still like to see the logs from any scanner you have run (if you're following Layback's list that would be AdwCleaner and Malwarebytes (Mbam)) and the ESET log when it finishes.
And just so I'm on track - you are cleaning / removing malware when the scanner displays the results, right?
Good about the sound, but yeah it's inconclusive for the moment. Keep track of the web pages you open as you increase the number to see if a specific often visited page is the culprit.
Bill
.