Windows 7: My hard drive has been infected by Conduit

GerryR,

Quite a few Conduit entries in that report.

How is it going?

In the interim I have granted myself administrator privileges and deleted everything that was on the C and D drives that had the word conduit in it. Adwcleaner removed the majority of registry entries with the word conduit in it but there are still approximately fifteen left. I feel uncomfortable about removing them. However I'm going to do a complete system backup since so much of conduit is gone. Then I might try to delete the remaining Registry entries. However the backup will take some time. I have already made a donation to Adwcleaner's developer. It really is a great program.

GerryR,

Let this program take a shot at removing those entries: Junkware Removal Tool Download
Save to the Desktop.

Make sure you temporarily disable your AntiVirus, Firewall, and any other AntiSpyware applications. These programs may interfere with the running of JRT.
Info: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides

Right-click JRT.exe and select: Run as Administrator

The tool opens and starts scanning the system. Please be patient as this can take a while...

When done, a report, JRT.txt is saved on the Desktop.

Please post the contents of JRT.txt in your reply.

Also download RogueKiller:
http://tigzy.geekstogo.com/roguekiller.php
Select the version that applies to the system.
Save to the Desktop.

After closing all windows and browsers, right-click the downloaded RogueKiller file and select: Run as Administrator
At the program console, wait for the Prescan to finish. (Under Status, it says: Prescan finished.)
Press: SCAN

When done, a report opens on the drive: RKreport.txt

Please provide the RKreport.txt (Mode: Scan) in your reply.

My thanks to the Windows 7 Support Team.

I have managed to remove conduit from both my registry and my hard drive, after Adwcleaner did the heavy work. Thanks to those of you who suggested it.

PLEASE don't read that immense log file - I was able to finish what was left on my own. I will leave this thread. I don't know how to delete submitted replies or I would kill those Adwcleaner log files.

Malwarebytes, one of my favorite programs, never turned up a thing, nor did SuperAntiSpyware

GerryR,

I managed to delete three of the four pages of the log file from Adwcleaner. The other one only produced an error message - it's amazing what a short moment of thinking can do. I'm going to try to get rid of the one that is left again. As far as I can tell it's no different from the others - I'll try again.

Again - Thanks to all of you.

Cottonball,

Please don't waste your time. After Adwcleaner did the heavy work, what with administrator privileges and a little bit of ingenuity it's totally gone, registry and hard drives.

BTW, MBAM never found a thing. It's a really good program, one of my favorites, but I needed a great program and Adwcleaner, a program whose existence was unknown to me until you mentioned it, was that great program. I have already made a PayPal donation to the developer. He certainly earned it.

More people should make donations - it's a shame that they don't. If everybody who used Wikipedia donated $20 they could probably buy a small country. LOL


Thanks!

Glad you got the issue resolved.

Good luck, GerryR!!

It would appear that my celebration was premature. I had taken hints, copied them into Word, turned them into PDF files to kill all of the links, and used Eraser on the word files. I ran regedit at 21:00 Sunday and there were no occurrences of the word conduit. I then searched folder names, file names and inside files throughout my hard drive, and with the exception of the harmless PDF files "conduit" did not exist. Jubilant I backed up the entire system. Then a thought occurred to me. What if Conduit could be reactivated by a program that didn't have the word conduit in it? So at 23:00 I ran regedit and there were four new entries with the word conduit in them. Some soft had indeed reactivated conduit in the registry. My jubilation was dashed! These were clearly keys that could be deleted without harming the registry and I deleted them. At 1:00 Monday I ran regedit and there was no reappearance of the word Conduit. I ran Kaspersky, Malwarebytes, SuperAntiSpyware Pro, and Microsoft Windows Malicious Software Removal Tool August 2013 on Monday afternoon and evening. After nine hours, since I ran full scans, they all proclaimed my system to be clean. I reran regedit and again searched inside files, file names, and folder names for conduit. The only positives were my PDF files. But something installed those four new entries. They're not there now and I'm heading for bed, but it would appear that I may well be dealing with an incredibly diabolical malware. Any thoughts except keep on running regedit, which I will be doing, will be appreciated. In the meantime I have backed up the entire system twice and the boot drive once, changing the date attribute to three consecutive days. Both before and after I ran those backups I checked and found the system to be "clean", so I have three good backups. The D drive is strictly data and some music.

GerryR,

There is more to Conduit than what meets the eye!!

Please follow the link to remove Conduit from your computer and your browser(s):
Remove Conduit Toolbar and search.conduit.com (Uninstall Guide)

Next, download the Temporary File Cleaner (TFC)
http://oldtimer.geekstogo.com/TFC.exe
Save to your Desktop.

• Save any work in progress!! TFC closes open applications and removes unsaved work!! Close all windows.
• Right-click TFC.exe and select: Run as Administrator
• If prompted, click "Yes" to reboot.

Now, run AdwCleaner once again, followed by the Junkware Removal Tool (Post #13).

Follow with RogueKiller (Post #14)

Please attach the results of AdwCleaner, Junkware Removal Tool, and RogueKiller (RKreport) in your reply.