Solved My hard drive has been infected by Conduit

[GerryR]

File Extensions and conduit

Cottonball,

Since the extensions are still showing and the value ends in 0, I'll take a guess that 0 means false. The problem is that I suspect that whatever is making this change in hiding and then letting me temporarily showing my extensions changes the value in the registry rather than messing around with Control Panel. Unless there is a way that I can make that 0 permanent it will get changed to a 1 within the next 48 hours. Am I right that 0 is false and 1 is true? If so is there any way to make that setting permanent, because if there isn't my guess is that it will be changed to a 1 and I'll lose the extensions again. However, if I do lose them again I'll follow your instructions again, but assume that I'll see a 1. So I guess the question is, "Can I make that 0 permanent, assuming that what I have written above is true?" I'm not a computer guru by any means, but we mathematicians tend to be quite logical.

 

[cottonball]

This is not a work computer with policies set up, or is it?

Assuming not, please go to Control Panel > Folder Options, check the View tab
Is: Hide extensions for known file types checked or unchecked?

On the Registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1 = hidden (checked in Folder Options)
0 = not hidden/showing (not checked in Folder Options)


Also look in the following Registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Is there an entry for: HideFileExt

 

[well48]

GerryR- Several times you mention downloading IE10 and everything malware exploding as soon as you opened it.
I find that hard to believe unless you were already infected with something.
To begin after an update it would burst open open to a page about IE. Informing you about all the new features and options about search providers etc.
Your description of its behavior reminds me of SAHAgent years ago. Once it got into your system, it attached it self to many files and slowed your pc down severely. You can get it from a website.
It seems that I have seen instances of Conduit in Eye Candy Licenses for downloads of games, music, lyrics etc.

You said one thing in jest but you should consider it for reinfection. I'm talking about it jumping from the USB drives on your table. That could happen when you plug an infected USB drive into your computer.

I'd believe that before IE10 installing Conduit. There is no way IE10 installed conduit on your pc. Corrupted files are possible but not Conduit.

 

[GerryR]

Conduit infection

Cottonball,

My computer is a stand alone desktop. I haven't even networked it to my laptop for fear that if one was infected the infection might move across the network.

Given the path that you gave me yesterday and have repeated today in more concise form, I have the following entry.

Name Type Data

HideFileExt REG_WORD 0x00000000(0)

Since 1 is Boolean for True and 0 is Boolean for False, that 0 should mean

No The File Extension is not hidden

To experiment I changed (0) to (1) and of course the extensions were hidden and when I checked Control Panel - View, the entry "Hide extensions for known file types" was now checked. Of course I then went back into the Registry and changed the value back to (0) and the extensions returned and the entry
"Hide extensions for known file types" was unchecked.

So this is all coordinated as I knew it would be.

I would imagine that if the extensions were to disappear it would be easier to change the Data number in the Registry than to mess around with Control Panel. I guess it might help if I told you that as far as understanding Boolean Operators I have a doctorate in mathematics and have programmed in FORTRAN, Turbo Pascal, C, C++, Visual Basic 5 and 6, and Visual Basic for Applications as well as creating complex spreadsheets with lovely macros in Excel for my ex-wife, hiding the macros so far below on the first sheet that people thought that she was doing the work. This got her a double-jump promotion. I have also worked with DBase3 and Access, but all of this except for the VBA was either at work on mainframes (FORTRAN) or in DOS.

I mentioned that just to make the point that I did know what you were doing and that the Control Setting and the Data numbers and the extensions change with perfect coordination. The problem has been that some infection has made those changes "for me". Maybe that will stop, but I wouldn't bet on it. I've run all of the programs suggested in order twice except for HijackThis which is beyond my level of computer expertise.

Does that answer your question?

Thanks again,

Gerry

 

[cottonball]

Name Type Data

HideFileExt REG_WORD 0x00000000(0)

What was provided above, is that what is showing for the following Registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | HideFileExt


Once again in the Registry Editor, navigate to:
HKEY_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden|SHOWALL
What is CheckedValue set to?

Also, go to Edit > Find, and see if you can find the following: NeverShowExt

If there is nothing found, then, go to Folder Options and check or uncheck settings as you prefer them.
Next, click Apply for Windows Explorer to reflect the settings.
Now, click Apply to Folders to make the settings selected the default.

The following tutorial will help:
http://www.sevenforums.com/tutorials/11356-folder-view-apply-folders.html

 

[GerryR]

Two Messages

Cottonball - I know how to do it. Perhaps the problem is now solved, the extensions have not disappeared recently. I certainly know how to go through folder options and do what you suggested.

Well 48. I have two very fast laptops. One of them is my guinea pig. It is loaded with Kaspersky Internet Security which contains a very potent anti-virus, malwarebytes, and SUPERAntiSpyware Pro. When I buy a new (presumably uninfected and empty) flash drive I stick into that guinea pig and run those three programs. Anytime that I download a new program, I download it into the guinea pig and run those three programs. If it passes muster then I will transfer it to my desktop. If it is an installation file and it passes muster, then I install it and check the entire hard drive of the guinea pig. I have a portable 1 TB external HDD which has those three programs on it and is constantly being checked. I use that to transfer the downloads to my sacred desktop and if I am downloading an installation file whose product has been installed on the guinea pig, I install it on my desktop. These are not networked thus guaranteeing that an infection in one won't spread to the others. There is only one group of programs that I cannot protect myself against - updates. The minor program updates get checked on the guinea pig. I do not run Java and wish that I did not have to run flashplayer. The one thing that I can't protect myself against is updates from Microsoft, which as a developer friend of mine said is considered among developers to be the worst piece of malware on the Internet. I have checked the recommended automatic updates for Microsoft. It updated IE9 to IE10. The moment I opened IE10 all hell broke loose. Given the precautions that I take I can only conclude that something really bad managed to attach itself to the IE10 update in transit. Now, where do you think the weaknesses in my protection are? I should point out that I reformat the guinea pig about every three months. What more precautions can I take. We constantly read in ZDNET bulletins of many critical patches to Microsoft products only to be told later that the patches were infected. I have to assume that either on a Patch Tuesday or in the update from IE9 to IE10 something came along for the ride. I cannot protect myself against Microsoft. If they did not insist that Windows must have IEx, I would have uninstalled it years ago. I use Firefox and Chrome and through lack of choice Outlook with IMAP. Now, feel free to make any comments about something that I am missing in this process. If you have something useful to suggest I add to my procedures, please let me know. BTW I will be reinstalling Windows 7 Ultimate on my desktop quite soon. Right now my arthritic fingers are not up to the task of uninstalling programs on the desktop so that I can reinstall them on the reformatted desktop,reformatting, changing the BIOS order to CD/DVD first and the hard drive second and then starting the massive project of bringing in and installing my carefully checked apps and bringing in the huge amounts of data that I have. If you have anything useful to add, please be my guest. That is a serious suggestion.

 

[GerryR]

NeverShowExt

Cottonball,


I was in a hurry to get going but I did this search.


Find Next was finding so many incidences "NeverShowExt" (no quotes) that I quit bothering to continue.


If the density of the first ten was an accurate representative of the whole there could be hundreds of them.


When I get back home I'll look at the entire message from you but I must get rolling.


GerryR

 

[GerryR]

Cottonball,

It would I have clicked your scale too much.

"You must spread some Reputation around before giving it to cottonball again"

 

[GerryR]

Showall

Relative to HKEY_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden|SHOWALL the key is 0x00000001(1) --> I believe there were seven consecutive zeroes but it's hard to count them

Re NeverFindExt, I have checked twice since and in each check I get my original findings. Before the scroll bar marker has gone down 5% of the way I have more than ten finds of NeverShowExt. The second time that I checked I sat through twenty finds and the scroll bar marker "might have been" 7% of the way down. It's hard to be precise looking at a scroll bar. If I hadn't been watching the left column I would not have thought that it had moved. In each case the entry looked like this:

I had to use dots for spacing.

Name........................................... Type..................... Data

{a red ab} then NeverFindExt..........REG_SZ...........This area is blank


For what it's worth this is always the third entry on the right.

For all I know there could be thirty entries like this or three hundred or more.

GerryR

 

[Layback Bear]

Could this NeverFindExt be a add on to a game?

 

[cottonball]

NeverFindExt or NeverShowExt???

There are hidden files marked as Super Hidden Files that are not viewed by the normal routine.


Please download SystemLook from one of the links below:
Link 1
Link 2
(Only direct links available)

Save the file to the Desktop

• Double-click SystemLook.exe to run it.
• Copy the content of the following code box into the open textfield:

:regfind 
NeverShowExt 
NeverFindExt

• Click the Look button to start the scan.
• When finished, a Notepad window opens with the results of the scan.
  

Please post the SystemLook.txt in your reply.


Thanks!

 

[Layback Bear]

Thank you Cottonball. I learned something today and I like that.
Super Hidden Files
I didn't know I had any.
Thanks again.

 

[cottonball]

@Layback Bear:

There is something to be learned every day you work here.
Don't you ever have some "What the heck is the OP talking about?" moments?
If you don't, you are lucky. I have those all the time. Some of them qualify under "Senior Moments"!

The hide or show files game is not my thing, although malware can do strange things and hide something where you least expect it. Normally, from what I understand, it is best to leave SuperHidden files just as they are.

Not sure if all files are displayed in Windows Explorer upon enabling 'Show hidden files' in Folder Options.
If a User insists on seeing them, or, if there is a valid need, to display SuperHidden files, you can do the following:

•Open the Registry editor(Start > Run > Regedit)
•Go to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
•In the right pane, double-click on SuperHidden and set its value to: 1

When done, close the Registry and restart the PC.

 

[Layback Bear]

You might of taken me wrong.
I really didn't know what you just explained.
The thank you was meant whole heartily.

Don't you ever have some "What the heck is the OP talking about?" moments

See them every day.

I really don't want to see my Super Hidden files. They are super hidden for a reason and until now I didn't even know their was such a thing. I do find many things on my computer that I don't know what they are. Sometimes I will Google them. 99.999% of the time I just leave them alone.

I will remember if I ever want to see them all I have to do is ask you how.
Once again Thanks!

 

[cottonball]

There are other ways of viewing those SuperHidden files, I'm sure.

I really don't want to see my Super Hidden files. They are super hidden for a reason...

Spot-on!!

 

[GerryR]

For Cottonball

There are five instances of HideFileExt on the given Registry key. I ran it twice and both times came up with 5.

Checked Value is 0x00000001(1)

NeverShowExt does not appear in the Registry

Folder Options is 0.

I set SuperHidden to 1 and rebooted


GerryR

 

[GerryR]

This is the result for Cottonball of using System_x64.exe

SystemLook 30.07.11 by jpshortstuff
Log created at 02:06 on 03/10/2013 by Gerald
Administrator - Elevation successful

========== regfind ==========

Searching for "NeverShowExt"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.DataAccessPage.1]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Diagram.1]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Form.1]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.ShortCut.Function.1]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Macro.1]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Module.1]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Query.1]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Report.1]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.StoredProcedure.1]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.Table.1]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Access.Shortcut.View.1]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Application.Reference]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fdse_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ffs0_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ffs1_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ffs2_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ffs3_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ffs4_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ffs5_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ffs6_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ffs7_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ffs8_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ffse_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\fse_file]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.WEBSITE]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\InternetShortcut]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Microsoft.Website]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\piffile]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchConnectorFolder]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SearchFolder]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SHCmdFile]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ECF03A32-103D-11d2-854D-006008059367}]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\xnkfile]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}]
"NeverShowExt"=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}]
"NeverShowExt"=""

Searching for "NeverFindExt"
No data found.

-= EOF =-

I then ran it twice more and both times got the following result.

SystemLook 30.07.11 by jpshortstuff
Log created at 02:32 on 03/10/2013 by Gerald
Administrator - Elevation successful

========== regfind ==========

Searching for "NeverShowExt "
No data found.

Searching for "NeverFindExt"
No data found.

-= EOF =-

 

[GerryR]

To Cottonball re System_x64.exe

1) Can you tell me what the significance of this is?

2) Is there any point in keeping System_64.exe on my desktop any longer

 

[cottonball]

1) Can you tell me what the significance of this is?

It all deals with file extensions which have a NeverShowExt Registry value.

If you take one of the entries, at random, like:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}]
"NeverShowExt"=""

There's an entry in the Send To menu called "Compressed (zipped) Folder". It is obtained by right-clicking on a file,
If you take a look at the folder specifying the entries for the Send To menu, %APPDATA%\Microsoft\Windows\SendTo, you'll find that this item is: ZFSendToTarget.

The purpose of this shell extension is to allow for creating a compressed folder using Send To.

Some other entries point to file extensions for Supper Hidden Files.

2) Is there any point in keeping System_64.exe on my desktop any longer

Have no clue what System_x64.exe is. However, if you mean SystemLook_x64.exe, you can remove it any time you wish.

 

[GerryR]

SystemLook_x64

We must be in radically different time zones. I don't receive Seven Forums notices from you until about 2:30 AM my time. I am not at my best then. Yes, I meant SystemLook_x64. Does this mean that my computer is now clean of conduit? Unfortunately I am dealing with some people who insist that all pdf files be opened by Adobe Reader. As I really have to deal with them, I'm stuck. I consider that to be a program of dubious security. I had been using Sumatra for PDF files but have temporarily uninstalled it. Somehow their PDF files won't allow Sumatra or Foxit to open them. I consider FlashPlayer to be another hacker target. I've uninstalled Java and so far no adverse effects have followed.

Except for that, is my disaster officially over?

In any case, many thanks,

Gerry