My hard drive has been infected by Conduit

BlueGuy · 14 Sep 2013

Then I don't know what happened, on the day I loaded Seven, I started out with IE8, then upgraded to IE9 on one of the Tuesdays, then at the end of last year (on a Tuesday) IE 10 and I never got the result you did, now it did make Bing the default but using the drop down [arrow in the search bar] to the IE gallery where I selected Google, it showed up in the drop down and clicking it fills the white space in the icon with light blue, signifying that Google is the default. After that no problems, it was even easy to change my home page from the default.
As I said, I only trust Majorgeeks.com and SourceForge for downloading utilities and to add, FileHippo for when I need to obtain older versions of something. CNET I only read the articles, never have downloaded from there.
BTW, what does CNET have to do with this discussion? You downloaded IE 10 using windows update
didn't you?

GerryR · 15 Sep 2013

Blueguy,
There is another problem. There is a very legitimate and highly praised program called conduit. My expert friend showed me some photos of his registry where, because of the complexity of his system, he has more than 60 entries of the word conduit in his registry. If an Ipad is connected to a computer it needs the legitimate Conduit program. Ditto many other items. In my case this may not be a problems as I have no attachments to the desktop other than printers, keyboard, mouse, and external HDDs and none of these use the legitimate Conduit program. The people who developed the malware Conduit were quite clever in giving it the name of a program that includes, as I have found out by calling seven other users, some of whom were afraid to open Control Panel until I assured them that it was safe, I wrote a tutorial for them as to how to use regedit -> edit -> find. Five of the seven have conduit because of tablets, smart phones, etc. Indeed a diabolical trick.

I hope that you read my reply about how I became infected (opening IE10). Right now my system is clean of references to conduit except for references to two pdf instructions files.

I am not a happy camper. You and cottonball seem to be more knowledgeable than I am. In reading every EULA completely I have protected myself until that wave of crap flooded in the first time that I opened IE10. I have since then made it safe, but since I have never liked IEx, I sincerely doubt that I will ever open it again.

Helpful hints will be appreciated. RogueKiller is out. I'm not willing to take that risk. I'll run the others with Administrator privileges.

GerryR · 15 Sep 2013

BlueGuy

I tend to download from author's pages. They frequently give helpful instructions as to how to use their software, sometimes in the form of tutorials. No other download source does that. If you can't trust the author's hints or downloads, you shouldn't be running his/her programs.

GerryR · 15 Sep 2013

Agreed, I misspoke. Java is risky. So too are the Yahoo Toolbar, and, most of all, flashplayer. It will be so good when HTML5 becomes sufficiently close to being ubiquitous as to close down flashplayer. Sometimes you do have to take risks, but I'll be glad to done with that one.

amaidi · 15 Sep 2013

All you have to do is Uninstall the the program called "Search protect by Conduit" from Programs and features. Reset Internet explorer. In Google Chrome settings change the Default Search to "Google". Issue will be Fixed.

cottonball · 15 Sep 2013

GerryR,

There is a very legitimate and highly praised program called conduit.

Not in the wildest of dreams am I an expert (see signature). However, the Conduit that I have seen in the forefront during the last few years is a hair-pulling and exasperating program. This is verified by simply doing a search and looking at the gazillion posts throughout the Web wanting to get rid of it, since the User never intended to install it.

We can wish getting rid of Conduit is as simple as running Regedit and doing a Find for the word 'Conduit'. This program has lots of detrimental features, and the capacitiy to install deep into the Operating System. Involved are Registry entries that do not contain the word 'Conduit' at all. There are also those with random named files, others with CLSIDs (CLasS ID - an identifier for an application), and who knows what else.

Delving into the Registry is a risky endeavor, and using Registry Cleaner applications may do more harm that good. So, what to do??

There are programs like AdwCleaner and the Junkware Removal Tool that target Conduit:
Conduit Search - Virus Removal Guide
The above is just one of the approaches to getting rid of Conduit.

As for RogueKiller, it is an excellent program, if you know how to use it.
Whether it targets Conduit or not, a Scan (which only diagnoses) will let you know.

You can also try HijackThis:
http://www.bleepingcomputer.com/download/hijackthis/
Save to a folder of its own on the Desktop. So, make a folder titled 'HijackThis' on the Desktop, and place HJT in it.
Right-click and select: Run as Administrator
Accept the License Agreement if you decide to run the program.

When the HijackThis console opens, press the following button: Do A system scan and save a logfile

When done scanning, a log opens in Notepad, and also appears on your Desktop.

Please post the HijackThis log in your reply.

When done, go back to the HijackThis program console, press: Config > Misc Tools > Open Uninstall Manager
Once the Add/Remove Program Manager list appears, click: Save list...

Please save to the Desktop, and post in your reply.

Would also run HitmanPro.

Last, but not least, in your shoes, I would clean up IE.

GerryR · 15 Sep 2013

I am afraid that Conduit may have altered my Windows 7 Home Premium Control Panel - All Control Panel Items which I have never changed. Googling has not produced results.

If anybody out there has Windows 7 Home Premium, would you please copy your Control Panel All Items, turn it into a pdf file and mail it to ** REMOVED **. I'm really getting desperate!

Thank you,

GerryR

cottonball · 15 Sep 2013

Altered how?

Can you use the Snipping tool to provide a screenshot:

How to Use the Snipping Tool in Vista

BlueGuy · 16 Sep 2013

I'd like to thank Cottonball, I hate getting old, I had forgotten about HijackThis because it has been so long since I had to deal with such an infected machine, but look at what they say over at MG..

Gerry:
"EditorsNote: Hijack This is for advanced users. If you are not familiar with running processes on your computer as well as anything ever installed that could tie into your web browser, it will not be much help to you. Finally, Hijack This has been taken over by Trend Micro."

Download HijackThis - MajorGeeks

Look at the stats, d/l'd almost 7 million times!

They work closely with MG on updates and tutorials for their products, you'll find URLs embedded in the stat page that lead to the MG forums where the tutorials are. It might seem lazy but it would take me too long with these arthritic fingers to re-type what's already there.

Read, go slow, one step at a time and again, I wish you good luck, too bad I can't be there to walk you through it.

Brink: I hope I haven't stepped on any toes getting Gerry this info.

cottonball · 16 Sep 2013

@BlueGuy,

Version 1.99 of HijackThis was the last version Merijn (the author) released (I believe), then it went to TrendMicro. I am surprised MG is hosting the old version.

The one to download is version 2.04 or version 2.05Beta:
v2.04 Download Trend Micro HijackThis - MajorGeeks
v2.05 http://www.majorgeeks.com/files/deta...this_beta.html

With all the Registry actions taken on this system, wouldn't be surprised if "Missing this or that" errors start showing up.

HijackThis does backups to use if something goes wrong after running it.
Which reminds me, it should be installed to its own folder!

My hard drive has been infected by Conduit

Conduit Removal

Conduit

Conduit

Control Panel Windows 7 Home Premium may have been altered