Solved My hard drive has been infected by Conduit

[BlueGuy]

The links to both are embedded in that page, you just have to wave your pointer over them.
Normally I wouldn't run Beta software.

 

[cottonball]

Heck, if you use the supposed 2.05 beta link at MG, you end up with version 2.04 anyway.
Something is not right there...guess v2.05 never made it to the big leagues.

 

[GerryR]

CNET mention

BlueGuy,

You mentioned the download sites that you personally feel are safe.

I just thought that for the benefits of those who are reading this thread and who may not be aware of it that the mere act of downloading from CNET, once a reputable source, is now an invitation to have several very bad things happen to your computer. Some people may not be aware of this.

GerryR

 

[GerryR]

Malware

I think that the most universally attempted installation is the Ask Toolbar which is sheer malware. There was a new program out that I really liked, but it insisted in downloading it's own installer. Too bad! If you let them get their installer on your hard drive they have an open path to install whatever they wish to.

I think that the time is going to come when the Internet refuses to mention programs that pull this junk. I understand why hackers want to install malware on your computer, but why otherwise legitimate companies - they must be getting great kickbacks.

 

[GerryR]

This isn't my primary reply Blueguy. There was this really nice-looking program, but in order install it they "just had to put a little installer on my hard drive". That's another monster gotcha. Of course I always choose custom over standard. It's unfortunate that this trends seems to be accelerating. The one that I find myself declining the most frequently is the AVG toolbar, frequently but not always, accompanied by making your default engine AVG, and making AVG your home page. I NEVER RUSH. I've found some programs that looked good but, I haven't downloaded anything except what I've been downloading to get rid of conduit. I'm almost there, one step more - RogueKiller, which, to tell the truth is the most complex piece of anti-malware that I've ever seen and I must admit to being nervous about running it.

I'm not really a computer guy. Doctorate in mathematics, M.S. in statistics, Fortran programmer before any IBM PC came out. So now I've had to learn. I had to take a disability retirement, for many health reasons that I won't mention again. At least now I can start catching up with what I didn't know about PCs. I always thought of the computer as a means to an end, i.e. analysis. During the DOS days I became very competent in Object-oriented Pascal, C, C++, and VBA. I subscribed to a bulletin board and picked up some nice freeware and commercial-ware. Vernon Burg's List, PKZip, etc.

 

[GerryR]

conduit and the Windows Seven Support Team

Re: Conduit -> The logs from Adwcleaner and JRT are in this reply. They're quite small.

I first used the Remove Conduit Toolbar and search.conduit.exe

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.1 (09.15.2013:1)
OS: Windows 7 Home Premium x64
Ran by Gerald on Wed 09/18/2013 at 3:33:15.23
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Then I ran the Temporary File Cleaner

Then I ran Adwcleaner - what follows is their log:

===========================================================================================================

# AdwCleaner v3.004 - Report created 18/09/2013 at 03:24:14
# Updated 15/09/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Gerald - GERALD-PC
# Running from : C:\InstallationFiles\AdwCleaner_2.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Users\Gerald\AppData\Roaming\Mozilla\Firefox\Profiles\halibpwn.default-1378957229315\jetpack
Folder Deleted : C:\Users\Gerald\AppData\Roaming\Mozilla\Firefox\Profiles\halibpwn.default-1378957229315\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
File Deleted : C:\Users\Gerald\AppData\Roaming\Mozilla\Firefox\Profiles\halibpwn.default-1378957229315\Extensions\[email protected]

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16686


-\\ Mozilla Firefox v24.0 (en-US)

[ File : C:\Users\Gerald\AppData\Roaming\Mozilla\Firefox\Profiles\halibpwn.default-1378957229315\prefs.js ]


-\\ Google Chrome v29.0.1547.66

[ File : C:\Users\Gerald\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Then I ran AdwCleaner - the log is below


*************************

AdwCleaner[R0].txt - [53956 octets] - [07/09/2013 19:30:46]
AdwCleaner[R1].txt - [1269 octets] - [07/09/2013 19:49:25]
AdwCleaner[R2].txt - [1156 octets] - [07/09/2013 20:29:53]
AdwCleaner[R3].txt - [1801 octets] - [18/09/2013 03:20:22]
AdwCleaner[S0].txt - [53085 octets] - [07/09/2013 19:32:00]
AdwCleaner[S1].txt - [1336 octets] - [07/09/2013 20:25:13]
AdwCleaner[S2].txt - [1218 octets] - [07/09/2013 20:30:35]
AdwCleaner[S3].txt - [1732 octets] - [18/09/2013 03:24:14]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1792 octets] ##########

==================================================================================

Then I ran the Junkware Removal Tool - what follows is their log.


~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\yt.ytnavassistplugin.1
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1BB8B3AE-757D-443F-B3A4-0629E709B0D9}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\updater by sweetpacks
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011441193}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110111261187}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askchecker_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askchecker_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskInstallChecker-1_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskInstallChecker-1_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\aol_pricecheck_fx_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\aol_pricecheck_fx_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\aol_pricecheck_ie_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\aol_pricecheck_ie_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011441193}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110111261187}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\askchecker_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\askchecker_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskInstallChecker-1_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskInstallChecker-1_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\aol_pricecheck_fx_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\aol_pricecheck_fx_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\aol_pricecheck_ie_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\aol_pricecheck_ie_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{85EFCE3B-EAC0-4E19-8B2C-45D7AFB747EF}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{F40F5728-5BD1-414F-9E6E-DDE0668F0011}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\pc1data"
Successfully deleted: [Folder] "C:\Users\Gerald\AppData\Roaming\strongvault"
Successfully deleted: [Folder] "C:\Users\Gerald\appdata\local\visualbeeclient"
Successfully deleted: [Folder] "C:\ai_recyclebin"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"



~~~ FireFox

Successfully deleted: [File] C:\user.js
Successfully deleted: [File] C:\Users\Gerald\AppData\Roaming\mozilla\firefox\profiles\halibpwn.default-1378957229315\extensions\[email protected]
Emptied folder: C:\Users\Gerald\AppData\Roaming\mozilla\firefox\profiles\halibpwn.default-1378957229315\minidumps [1 files]



~~~ Chrome

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Policies\Google\Chrome\extensioninstallforcelist [Blacklisted Policy]
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\extensioninstallforcelist [Blacklisted Policy]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Wed 09/18/2013 at 3:39:43.87
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

=============================================================================================


I have not as yet run RogueKiller. Is that necessary? In any case I'm going to do a complete system backup tonight while I wait for an answer about RogueKiller.

Thanks to all,

GerryR

 

[GerryR]

Careful

BlueGuy,

People who watch me on the computer are amazed to see the care with which I make selections. I actually read EULAs. The only "standard installations" that I make are from Mozilla and Internet Download Manager. They just keep upgrading. I also accept updates to databases for MalwareBytes Anti-Malware, etc. There's no way to check that sort of thing.

I use Acronis True Image Home for my backups. It has a wonderful feature, "Try and Decide". When you start that you can install anything that you want to, then check it by MBAM, etc. No matter what the disaster, you're working on a virtual machine and can turn it off so that you are back to where you were when you entered "Try and Decide". I even install upgrades to CCleaner in "Try and Decide" although I'm pretty sure that's a waste of time. I always try out anything that I am contemplating there, I can download as free as a bird, install, screw around with the program, etc. Then I check it with MBAM and a host of others.

Many years ago, picking "Standard Installation" was safe. That was a long time ago. I click custom install on what I analyze in "Try and Decide". BTW, why are the manufacturers of AVG anti-virus which I don't use but do consider to be safe, trying to shove the AVG Toolbar down everybody's throat? Nobody I know seems to have figured this apparent dichotomy out. I think that I see that as an "option" more than any other one thing. The totality of programs that want to "just install a little installer" is growing by leaps and bounds.

 

[GerryR]

To the Windows 7 Forum Support Team

I did send you the results of Adwcleaner and JRT, but not MBAM because MBAM came up with 0 objects and that was kind of dull.

 

[GerryR]

BlueGuy,

I kept seeing articles about uninstalling Java because its security was Swiss cheese. I did that four days ago and so far everything that I've tried to run has run. I don't use Open Office or Libre Office. what exactly have I lost?

GerryR

 

[GerryR]

Where did you download IE10?

I didn't download IE10 in the normal sense. It came down as part of a Windows Update from Microsoft! How was I do know it would explode when I opened it. Flashing ads, non-flashing ads, banner, conduit toolbar, conduit search engine, something wolf search engine, and more. If it weren't for the fact that Microsoft claims that you must have it to run Windows I would uninstall it. I certainly will never use it again.

So far I've run Adwcleaner, Hitman Pro, Junk Removal Tool, Temporary File Cleaner, Kaspersky, Malwarebyes, and I want to run Rogue Killer. Unfortunately I don't know any French and when you opt for the English tutorial, the windows are still in French and I don't know what to do. I have run each of the above at least three times, but I'm still having a weird problem. Like all the rest of you, I assume, I want to see my files' extensions. They disappeared 10 days ago. I reset them. They disappeared three days ago. I reset them, so far so good, but obviously not good. If anybody actually wrote a version of the Rogue Killer with the windows in English and wouldn't mind doing so, please send me a copy. I hope this is not breaking a rule of the forum - one of my addresses is [removed] The only thing of interest is that Adwcleaner, quite rightly, uninstalls the Yahoo Toolbar, which is really useful but, so I've read and been told, a potential security weakness. Maybe I'll just put the toolbar into my bookmarks, one piece at a time.

But I ***really want to run Rogue Killer*** once I know what the windows selections in the tutorial mean. The only one that's clear is a repetitive -> Please donate via PayPal. If I can run it and it finishes conduit off, I'll donate to him - I've already donated to Adwcleaner. I am a strong believer in donations for services rendered. My biggies are CCleaner and Wikipedia.

 

[GerryR]

Hijack This

I know about Hijack This, I've read about it and I am not sufficiently competent to feel comfortable running it. The link that was supposed to get me to a program to clean up IE was two separate links. One got me to a miniscule gif file. The other got me to a program in German that I didn't understand, and I clicked on what I thought might be an English translation and LOL it showed me a group of smileys. At that point I decided to vacate the program before I did something that might be destructive.

BTW, Hijack This has been replaced by the original author by what he claims is a far more powerful tool than Hijack This. Basically the actions of Hijack This are a small subset of the actions of the other program. Since I'm not at a level to run Hijack This, I'm certainly not going to try his newer, more powerful program.

If a correct link to whatever is supposed to clean out IE10 were posted, that would be great. Once again thanks to all of you.

Blueguy, I uninstalled Java last week and thus far have not seen any problems. Thanks for the tip. As to flashplayer, what can one say. When you run Adwcleaner it deletes the Yahoo toolbar - that's not very encouraging.

 

[GerryR]

I will have to do this better

Resulrs

 

[GerryR]

Latest

System Summary for GerryR

Adwcleaner deleted the Yahoo toolbar and found no other errors.

Junkware Removal Tool and Hitman Pro found no problems.

Temporary File Cleaner erased my temp folder, and otherwise found no problems.

I am awaiting a translation of the windows in the tutorial for RogueKiller.

Malwarebytes found no objects.

Kaspersky Internet Suite (including anti-virus) found no problems

SuperAntiSpyware Pro found no problems.

Neither the registry nor the hard drive show any mention of the word conduit.

I will run RogueKiller, but I suspect hat I am now officially clean.

Thanks to all, especially Cottonball and Blueguy. You are both examples of what knowledgeable forum members should be.

Happily,

GerryR

P.S. I am not going to unsubscribe from this thread until I have run RogueKiller.

 

[cottonball]

Thank you for the kind words.

Per Post #14, all RogueKiller is going to do is Scan the computer.

When the program is opened, a Prescan is started. It scans and stops malicious processes, malicious services, loads its driver, and does some version checks. It does not delete anything on the computer.

The Scan option does not modify the system, it only lists problems. It checks automatic startup entries (RUN keys, Services, scheduled tasks, startup folders), and, system hijacks. The scan also does a search of some known infections, and checks for the existence of some rootkits. It verifies the integrity of the Master Boot Record (MBR). Once the scan is finished, a text report is available by clicking on the Report button, and is also available on the desktop as: RKReport.txt

If any malware is found, further action can be pursued. However, if any detected item looks legit, there is the option to uncheck it.

At this point in your endeavour, the program may not find anything of consequence.

Have used this program many times, and IMO, it cuts to the chase and is very effective. Several programs that I use, like RogueKiller, are of European origin, but a translation is available. The French language is not my forte, either!

 

[GerryR]

Run Report From RgoueKiller

I have marked the one place where there was a problem.

RogueKiller V8.6.12 _x64_ [Sep 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : Forum
Website : RogueKiller download
Blog : tigzy-RK

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : Gerald [Admin rights]
Mode : Scan -- Date : 09/27/2013 02:48:57
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standard disk drives) - WDC WD5000AAKS-00V1A0 ATA Device +++++
--- User ---
[MBR] cf67fd206edd8aa5de14c1fe83abc9fb
[BSP] 4a48f4eab0cb1056196a72915a8b20fe : Legit.C MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 476838 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ IDE) (Standard disk drives) - WDC WD5000AAKS-00V1A0 ATA Device +++++
--- User ---
[MBR] 42761630327a24482af4b2447068ca43
[BSP] ead6f9ec241c16ec046616ce9d3e5235 : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 476937 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive2: (\\.\PHYSICALDRIVE2 @ USB) (Standard disk drives) - SAMSUNG HD204UI USB Device +++++
--- User ---
[MBR] 6b8b9b286065d61c43b03b2cba19c461
[BSP] 35c492544a6187dc4d7c3b7fb859bc1a : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 1907727 Mo
User = LL1 ... OK!
Error reading LL2 MBR! <------------------ Is this significant and if so what can I do about it? GerryR

Finished : << RKreport[0]_S_09272013_024857.txt >>
RKreport[0]_D_09272013_024651.txt

 

[cottonball]

The RKReport is as clean as it gets.

What is flagged is not significant, it is a USB drive.

 

[GerryR]

There is still one recurring problem

I prefer to see the extensions of my files. About every third day and that included today, Control Panel is changed to hide extensions. I can reset it in seconds but something is doing that and I hadn't had this problem until after I got the conduit infection. So I reran Adwcleaner (there goes the Yahoo toolbar), Junk Removal Tool, Temporary File Removal, Hitman Pro, and RogueKiller in that order, but I bet the extensions are going to disappear again.

 

[GerryR]

One last problem

I like my files to show extensions - always have, always will. About every three days they disappear. I've gotten pretty good (under 30 seconds LOL) at turning them back on, but then they disappear again. This did not happen pre-conduit. So there's something left in their. At least the BIOS hasn't been tampered with. Any thoughts would be appreciated. I'm thinking reformat.

 

[cottonball]

Please go to Start, in the search box above it type regedit
In the list that appears above, open regedit.

If prompted by the UAC, click: Yes

In the Registry editor, navigate to the following key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Do so by expanding the following (click the > to the left of each entry):
>HKEY_CURRENT_USE
>Software
>Microsoft
>Windows
>CurrentVersion
>Explorer

Under Explorer, click: Advanced
In the right pane of Advanced, look at: HideFileExt
Under Data, does the value end in 1, or in 0 (zero)?

 

[GerryR]

HideFileExt from Cottonball

It currently ends in a 0. Is that correct? If so please let me know, if not please tell to what I should change it. I see other entries under Data with the values 0, 1, and 2.

Thanks,

GerryR

P.S. Don't bother to change the HKEY_CURRENT_USE. I knew that you meant USER.