Solved My hard drive has been infected by Conduit

[GerryR]

My hard drive is infected with Conduit. It is so powerful that after I turned a post into a Word document with the top line reading "How to Remove Conduit" (no quotation marks), when I pressed "Save As" the file was saved as "How to Remove". Fortunately it "allowed me" to rename the file "How to Remove Conduit". I've tried three apparently logical removal suggestions that I googled and they have all been thwarted. I have been able to get rid of the Conduit toolbar and Search Engine on my own, but this one is way out of my class!

IT'S OVER FOR ME. The clue to use Adwcleaner, a program whose existence was unknown to me, got the major work done and, with administrator privileges and some thought (not to mention backups), conduit has been expunged from my Registry and my Hard Drives.

 

[madcratebuilder]

Conduit toolbar is a adware-malware program that should be easy to remove. I'm sure one of our anti virus experts well post soon on the best program to use. MBAM or SASW should detect it. A google search well give you plenty of info.

 

[cottonball]

GerryR,

Please follow this guide:

Remove Conduit Toolbar and search.conduit.com (Uninstall Guide)

Go up to and include running Malwarebytes Anti-Malware


:ar:Please post the AdwCleaner report in your reply.


:info:When you are done running Malwarebytes Anti-Malware, a report opens in Notepad.
:ar: Please copy/paste the entire contents of the MBAM report in your reply.

Will take a look at those and see what we need to do next.


Thanks!

 

[GerryR]

I've run MBAM and SASW Pro. Also Kaspersky. They all came up empty. I got rid of the toolbar and search engine without taking a deep breath. But getting it off of the hard drive is a totally different can of worms. Even when I signed on a administrator, I couldn't even Conduit's PNG files - I got "error messages" to the effect that I could not enter those files. It protects PNG files from the administrator!! That's one very stubborn infection.

Unfortunately, after I first backed up my Registry and my system to an external HDD and I went into the Registry. I started with Find Conduit and continued with Find Nexts. The scroll bar had moved about one quarter of the way down when I reached the fiftieth occurrence of Conduit. If that trend continued that would give me 200 occurrences. I backed out. Revo Uninstaller Pro's forced install found Conduit, but then offered me those choices to make in the Registry. There was no way I was going to make that many Registry decisions. I know my limits, and I don't think that there are a lot of people who could make those two hundred decisions correctly. I'm certainly not one of them - nobody I know is either and I'm friends with a lot of highly competent developers. I offered to let them take control of my computer and they all declined.

I hope that there's some super-developer out there who can write a program that will eliminate Conduit.

I'm just a mathematician - not a developer. I can write tutorials for friends, but Conduit is out of my class. It doesn't appear to be doing anything so I suspect it's spyware. I certainly hope it can't break my super-strong passwords to important folders. Fortunately my passwords to Internet connection are on a backed-up flash drive. They appear nowhere on my hard drive. I doubt that even Conduit can get information from flash drives that are on my computer table.

Any help will certainly be appreciated.

 

[GerryR]

GerryR,

Please follow this guide:

Remove Conduit Toolbar and search.conduit.com (Uninstall Guide)

Go up to and include running Malwarebytes Anti-Malware


:ar:Please post the AdwCleaner report in your reply.


:info:When you are done running Malwarebytes Anti-Malware, a report opens in Notepad.
:ar: Please copy/paste the entire contents of the MBAM report in your reply.

Will take a look at those and see what we need to do next.


Thanks!

MBAM comes up empty. 0 incidents of malware. SuperAntiSpyware Pro also comes up empty. So does Kaspersky Anti-Virus. So does Revo Uninstaller Free. This is certainly malware, but while you can see it, helpful programs cannot.

Thanks a lot for your time, but I've already done what other people are suggesting. If they had worked I would not have posted the question. Google turns up many suggestions but they are only appropriate for run-of-the-mill malware and I can take care of that. BTW this came down when I decided to open IE10 the first time. There was a flood of garbage, flashing ads, toolbars, default search engines and what not. By the time I had loaded an arsenal to take care of that, but because it had infected Firefox (my default) browser, I won't be using IE10. I should have known better than to use IEx. I'll just stick to Firefox and Chrome. I had wanted IE10 for easier access to Windows Updates- never again!

Anyway, I appreciate your time spent and your suggestions but Conduit is beyond them.

Gerry

 

[ThrashZone]

GerryR,

Please follow this guide:

Remove Conduit Toolbar and search.conduit.com (Uninstall Guide)

Go up to and include running Malwarebytes Anti-Malware


:ar:Please post the AdwCleaner report in your reply.


:info:When you are done running Malwarebytes Anti-Malware, a report opens in Notepad.
:ar: Please copy/paste the entire contents of the MBAM report in your reply.

Will take a look at those and see what we need to do next.


Thanks!

I should have known better than to use IEx./ I had wanted IE10 for easier access to Windows Updates

I'm not sure what this even means,
What is IEx ?
Clean boot post screen shots of the Startup and Services sections,
http://www.sevenforums.com/tutorials/179159-troubleshoot-application-conflicts-performing-clean-startup.html
Why would ie10 make it "easier access to windows updates"
Where exactly did you download ie10 ?
Because conduit certainly does not come with it,
If you got all sorts of popups when you opened ie10 it's because your machine already had Conduit installed possibly from Chrome but also could of come from Firefox without you knowing,
I leaning to Chrome because many of it's resources are on their servers so something downloading Without your knowledge is more than likely,
Check your Extensions in Chrome browser.
Look for items you don't recognize,
View attachment 285036

 

[carwiz]

Run SFC /scannow just to make sure the OS files and registry entries are intact. Take note that it may be necessary to run it several times if you keep getting error messages on the console.

Have you tried running Microsoft's Malicious Software Removal Tool? Conduit is not on the list but it may be named something else with the same signature.

Here's the link: Families Cleaned by the Malicious Software Removal Tool

 

[carwiz]

Holly cow! You sure like the tool bars don't ya.

 

[GerryR]

Thank you note

Thanks a lot for your work done so far and work that you will have ahead of you.

Also thanks for apprising me of the existence of AdwCleaner.

GerryR

 

[BlueGuy]

This is why about 37 minutes ago, the same time you were making your last post, I went very slow when installing SUPER © Simplified Universal Player Encoder & Recorder [update] because since day one they used adware to make it free.
Step by step I was going "Decline" , "Decline" and yes, Conduit was there, always choose custom.
It is great, powerful and on Brink's list, you just have to be wary. When you rush...you make mistakes.

 

[cottonball]

GerryR,

Quite a few Conduit entries in that report.

How is it going?

 

[GerryR]

GerryR About Conduit

In the interim I have granted myself administrator privileges and deleted everything that was on the C and D drives that had the word conduit in it. Adwcleaner removed the majority of registry entries with the word conduit in it but there are still approximately fifteen left. I feel uncomfortable about removing them. However I'm going to do a complete system backup since so much of conduit is gone. Then I might try to delete the remaining Registry entries. However the backup will take some time. I have already made a donation to Adwcleaner's developer. It really is a great program.

 

[cottonball]

GerryR,

:info: Let this program take a shot at removing those entries: Junkware Removal Tool Download
Save to the Desktop.

Make sure you temporarily disable your AntiVirus, Firewall, and any other AntiSpyware applications. These programs may interfere with the running of JRT.
Info: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - Security Mini-Guides

Right-click JRT.exe and select: Run as Administrator

The tool opens and starts scanning the system. Please be patient as this can take a while...

When done, a report, JRT.txt is saved on the Desktop.

:ar: Please post the contents of JRT.txt in your reply.

 

[cottonball]

:info: Also download RogueKiller:
http://tigzy.geekstogo.com/roguekiller.php
Select the version that applies to the system.
Save to the Desktop.

After closing all windows and browsers, right-click the downloaded RogueKiller file and select: Run as Administrator
At the program console, wait for the Prescan to finish. (Under Status, it says: Prescan finished.)
Press: SCAN

When done, a report opens on the drive: RKreport.txt

:ar: Please provide the RKreport.txt (Mode: Scan) in your reply.

 

[GerryR]

Removing Conduit from my System

My thanks to the Windows 7 Support Team.

I have managed to remove conduit from both my registry and my hard drive, after Adwcleaner did the heavy work. Thanks to those of you who suggested it.

PLEASE don't read that immense log file - I was able to finish what was left on my own. I will leave this thread. I don't know how to delete submitted replies or I would kill those Adwcleaner log files.

Malwarebytes, one of my favorite programs, never turned up a thing, nor did SuperAntiSpyware

 

[GerryR]

GerryR,

I managed to delete three of the four pages of the log file from Adwcleaner. The other one only produced an error message - it's amazing what a short moment of thinking can do. I'm going to try to get rid of the one that is left again. As far as I can tell it's no different from the others - I'll try again.

Again - Thanks to all of you.

 

[GerryR]

Cottonball,

Please don't waste your time. After Adwcleaner did the heavy work, what with administrator privileges and a little bit of ingenuity it's totally gone, registry and hard drives.

BTW, MBAM never found a thing. It's a really good program, one of my favorites, but I needed a great program and Adwcleaner, a program whose existence was unknown to me until you mentioned it, was that great program. I have already made a PayPal donation to the developer. He certainly earned it.

More people should make donations - it's a shame that they don't. If everybody who used Wikipedia donated $20 they could probably buy a small country. LOL


Thanks!

 

[cottonball]

Glad you got the issue resolved.

Good luck, GerryR!!

 

[GerryR]

Conduit in the Registry

It would appear that my celebration was premature. I had taken hints, copied them into Word, turned them into PDF files to kill all of the links, and used Eraser on the word files. I ran regedit at 21:00 Sunday and there were no occurrences of the word conduit. I then searched folder names, file names and inside files throughout my hard drive, and with the exception of the harmless PDF files "conduit" did not exist. Jubilant I backed up the entire system. Then a thought occurred to me. What if Conduit could be reactivated by a program that didn't have the word conduit in it? So at 23:00 I ran regedit and there were four new entries with the word conduit in them. Some soft had indeed reactivated conduit in the registry. My jubilation was dashed! These were clearly keys that could be deleted without harming the registry and I deleted them. At 1:00 Monday I ran regedit and there was no reappearance of the word Conduit. I ran Kaspersky, Malwarebytes, SuperAntiSpyware Pro, and Microsoft Windows Malicious Software Removal Tool August 2013 on Monday afternoon and evening. After nine hours, since I ran full scans, they all proclaimed my system to be clean. I reran regedit and again searched inside files, file names, and folder names for conduit. The only positives were my PDF files. But something installed those four new entries. They're not there now and I'm heading for bed, but it would appear that I may well be dealing with an incredibly diabolical malware. Any thoughts except keep on running regedit, which I will be doing, will be appreciated. In the meantime I have backed up the entire system twice and the boot drive once, changing the date attribute to three consecutive days. Both before and after I ran those backups I checked and found the system to be "clean", so I have three good backups. The D drive is strictly data and some music.

 

[cottonball]

GerryR,

There is more to Conduit than what meets the eye!!

:info: Please follow the link to remove Conduit from your computer and your browser(s):
Remove Conduit Toolbar and search.conduit.com (Uninstall Guide)

Next, download the Temporary File Cleaner (TFC)
http://oldtimer.geekstogo.com/TFC.exe
Save to your Desktop.

• Save any work in progress!! TFC closes open applications and removes unsaved work!! Close all windows.
• Right-click TFC.exe and select: Run as Administrator
• If prompted, click "Yes" to reboot.

Now, run AdwCleaner once again, followed by the Junkware Removal Tool (Post #13).

Follow with RogueKiller (Post #14)

:ar: Please attach the results of AdwCleaner, Junkware Removal Tool, and RogueKiller (RKreport) in your reply.