Solved My hard drive has been infected by Conduit

[GerryR]

I purged Firefox and in the process have created some sort of problem with JavaScript. I reinstalled all of my old add-ons except after having been totally crazy again by Noscript I deleted it. Between Ghostery, Quick java, Cookie Monster and a slew of other defensive programs I feel reasonably secure. With Noscript overruling all other programs I had to allow an entire page which might have who knows what in it.

Chrome has forgotten my identity and I have been trying to get it back, preferably with my old extensions and settings. I can't even open it to sign in. Whatever variation you use Google or other search engines to access it, it brags about its greatness and asks if you want to download it.

As to IE10, I am never going to open it again. Therefore my question is, "Do I still have to make it conduit-proof?"

Therefore I am still at Step 2.

Hi cottonball.

I must admit that some of these programs that you want me to use really require more expertise than I have. I'm going to try to get an expert friend help me through this, after I get through Step 2.

GerryR

 

[BlueGuy]

IE 10 got nothing to do with it..I'm running IE 10 now, ya never should have installed java, I don't and if a website insists on its' use, I move on to another. M$ is the only one that uses Silverlight, so ditto.
As for Chrome[ I don't use] or FF you should always back up the profile folders and .ini files to removables or burn a CD.
No Script is usually a dependable add-on but then I stopped using it after the first year of release because I won't run Java. At least in my circle, on other forums Java is falling out of favour.
You came up with the best idea, have someone who can see your machine to tutor you one on one.
I wish you good luck.

 

[GerryR]

Conduit

This question seems to have been ignored, although I suspect that it is being worked on. Once somebody removes conduit from his/her system and the Big Three browsers, what is going to prevent reinfection? As long as conduit is running around on the Internet, can't Conduit simply reinfect one's system?

GerryR

 

[GerryR]

conduit

I finally was notified by a friend that Google, in its infinite wisdom, has changed my username and password for Chrome to my Gmail name and password. Fortunately it retained all of my extensions. I use Firefox pretty exclusively.

 

[GerryR]

Conduit Annihilation

Blueguy,

The only program that I don't feel good about is RogueKiller. That's a pretty long tutorial and my high school French has long since deserted me.

Gerry

 

[GerryR]

Java and Noscript?

Blueguy,

Could you expand on that. My problem with Noscript is the number of times that it interferes with reading a page, viewing or hearing a video, etc. Why do you find Java useless? I must admit that I don't know of anything that it does specifically that is crucial to my work.

Thanks,

Gerry

 

[BlueGuy]

I didn't say useless, my meaning was that it is insecure.
Criticism of Java - Wikipedia, the free encyclopedia
http://www.howtogeek.com/122934/java-is-insecure-and-awful-its-time-to-disable-it-and-heres-how/

 

[BlueGuy]

This question seems to have been ignored, although I suspect that it is being worked on. Once somebody removes conduit from his/her system and the Big Three browsers, what is going to prevent reinfection? As long as conduit is running around on the Internet, can't Conduit simply reinfect one's system?

GerryR

Frankly, I have no experience removing Conduit because I never let it install, referring to a previous post here, I was installing the update to SUPER <c>, now eRightsoft, in order to make it freeware puts adware
into the installer, Majorgeeks warns you about that ahead of time, as well as the ASK toolbar.
However eRightsoft gives the user a break by designing the installer package into giving you the right to opt out. This is where the adage "When you rush...you make mistakes" comes in. So during the install process I just take it one step at a time, clicking on 'do not accept' and 'decline' until I reach the actual
step for the main application. That way eRightsoft gets some funding and you don't get stuck with, not necessarily malware, but badly behaving programs.
My only other suggestion, if you removed the main portion of Conduit, is to use CCleaner or my favourite,
EasyCleaner {Majorgeeks or SourceForge} to clear out the registry entries and any 'breadcrumbs' from the boot and storage drives.

Some where along the line, you wanted something, downloaded it but rushed, therefore allowing it to be installed, Conduit doesn't actively do it, you would have had to click an accept button.
You were given excellent instructions by a more senior member on removal, follow them, then try a cleaner.

 

[BlueGuy]

Right from the page "Cottonball" directed you to.

"You should always pay attention when installing software because often, a software installer includes optional installs, such as this browser hijacker. Be very careful what you agree to install. Always opt for the custom installation and deselect anything that is not familiar, especially optional software that you never wanted to download and install in the first place. It goes without saying that you should not install software that you don’t trust."

 

[GerryR]

Conduit

Blueguy,

Actually I can be very specific about how I got conduit. I had not yet used IE10. When I turned it on I got the conduit toolbar, Babylon search as my new default search engine, flashing ads, non-flashing ads, and banners as well as a new home page. I closed it. When I turned on Firefox I still had the Conduit toolbar, Babylon search, etc, just no ads. I reset my home page. Then I reset my "changed" download site. Next using Firefox - Options I got rid of the conduit toolbar. I rebooted all was well on my homepage back to Yahoo. The Yahoo toolbar was now where the conduit one had been. I then googled third party software until I had made IE10 safe. I turned on IE10 and got Yahoo as my home page, an inferior version of the Yahoo Toolbar and no crap. They did replace Google as my default search engine with Bing which was hardly amazing. I changed it back to Google, screwed around with IE10 and decided that I didn't like it as much as Firefox (my first choice) or Chrome (second). I thought that all was well with the world. A few months later I noticed that conduit.exe was in Program Files(86). I searched my hard drives for incidences of conduit. There were more than 50. I used regedit - edit - find and find next and found out that my registry was overwhelmed with conduit. I backed up the entire system (with validation, of course). I went back to an April backup for recovery purposes. It was the last one before I had opened IE10. I back up frequently so I have to delete backups. I recovered April - no sign of conduit anywhere. I then used a June recovery (post opening IE10). Both hard drives and the registry were thick with conduit. So I recovered my latest backup and ran Malwarebytes, Kaspersky Anti-Virus, and SuperAntiSpyware Pro none of them found a thing. I wrote my first message to this forum. On the good advice I ran Adwcleaner. I was left with about 50 incidences of conduit in the registry and twelve files with conduit in their names on my boot drive. I gave myself Administrator privileges and deleted the files (none were programs) from my hard drive. I went back to the Registry and much to my surprise there was only mention of conduit left. It referred to the conduit toolbar, so I knew it wasn't the legitimate conduit program. I deleted it. For two days the Registry and hard drives were clean. Then, as if by magic, since I had not installed anything, there were four incidences of conduit appeared in the Registry. I reran Adwcleaner and they were gone. That's when I recontacted this forum. This was not my fault. This was the direct result of opening IE10 for the first time. I won't open IE10 again. That's okay! I use Firefox 90% of the time and Chrome 10%.

I am ultra-ultra careful about installations with gifts. BTW it is no longer safe to download from CNET. They don't ask about their gifts, they just give them to you as well as making you a member of the CNET form. Fortunately I read EULAs completely.

My expert friend turned me down.

I'm not sure what my next move will be. Right now my system is clean of conduit.

This was not my fault - it happened when I opened IE10. How was I to know that it was that unsafe. A relational database developer European friend of mine said that the worst virus on the Internet is Microsoft. I think that he's right.

 

[BlueGuy]

Then I don't know what happened, on the day I loaded Seven, I started out with IE8, then upgraded to IE9 on one of the Tuesdays, then at the end of last year (on a Tuesday) IE 10 and I never got the result you did, now it did make Bing the default but using the drop down [arrow in the search bar] to the IE gallery where I selected Google, it showed up in the drop down and clicking it fills the white space in the icon with light blue, signifying that Google is the default. After that no problems, it was even easy to change my home page from the default.
As I said, I only trust Majorgeeks.com and SourceForge for downloading utilities and to add, FileHippo for when I need to obtain older versions of something. CNET I only read the articles, never have downloaded from there.
BTW, what does CNET have to do with this discussion? You downloaded IE 10 using windows update
didn't you?

 

[GerryR]

Conduit Removal

Blueguy,
There is another problem. There is a very legitimate and highly praised program called conduit. My expert friend showed me some photos of his registry where, because of the complexity of his system, he has more than 60 entries of the word conduit in his registry. If an Ipad is connected to a computer it needs the legitimate Conduit program. Ditto many other items. In my case this may not be a problems as I have no attachments to the desktop other than printers, keyboard, mouse, and external HDDs and none of these use the legitimate Conduit program. The people who developed the malware Conduit were quite clever in giving it the name of a program that includes, as I have found out by calling seven other users, some of whom were afraid to open Control Panel until I assured them that it was safe, I wrote a tutorial for them as to how to use regedit -> edit -> find. Five of the seven have conduit because of tablets, smart phones, etc. Indeed a diabolical trick.

I hope that you read my reply about how I became infected (opening IE10). Right now my system is clean of references to conduit except for references to two pdf instructions files.

I am not a happy camper. You and cottonball seem to be more knowledgeable than I am. In reading every EULA completely I have protected myself until that wave of crap flooded in the first time that I opened IE10. I have since then made it safe, but since I have never liked IEx, I sincerely doubt that I will ever open it again.

Helpful hints will be appreciated. RogueKiller is out. I'm not willing to take that risk. I'll run the others with Administrator privileges.

 

[GerryR]

Conduit

BlueGuy

I tend to download from author's pages. They frequently give helpful instructions as to how to use their software, sometimes in the form of tutorials. No other download source does that. If you can't trust the author's hints or downloads, you shouldn't be running his/her programs.

 

[GerryR]

Conduit

Agreed, I misspoke. Java is risky. So too are the Yahoo Toolbar, and, most of all, flashplayer. It will be so good when HTML5 becomes sufficiently close to being ubiquitous as to close down flashplayer. Sometimes you do have to take risks, but I'll be glad to done with that one.

 

[amaidi]

All you have to do is Uninstall the the program called "Search protect by Conduit" from Programs and features. Reset Internet explorer. In Google Chrome settings change the Default Search to "Google". Issue will be Fixed.


:devil2::devil2::devil2:

 

[cottonball]

GerryR,

There is a very legitimate and highly praised program called conduit.

Not in the wildest of dreams am I an expert (see signature). However, the Conduit that I have seen in the forefront during the last few years is a hair-pulling and exasperating program. This is verified by simply doing a search and looking at the gazillion posts throughout the Web wanting to get rid of it, since the User never intended to install it.

We can wish getting rid of Conduit is as simple as running Regedit and doing a Find for the word 'Conduit'. This program has lots of detrimental features, and the capacitiy to install deep into the Operating System. Involved are Registry entries that do not contain the word 'Conduit' at all. There are also those with random named files, others with CLSIDs (CLasS ID - an identifier for an application), and who knows what else.

Delving into the Registry is a risky endeavor, and using Registry Cleaner applications may do more harm that good. So, what to do??

:info: There are programs like AdwCleaner and the Junkware Removal Tool that target Conduit:
Conduit Search - Virus Removal Guide
The above is just one of the approaches to getting rid of Conduit.

:info: As for RogueKiller, it is an excellent program, if you know how to use it.
Whether it targets Conduit or not, a Scan (which only diagnoses) will let you know.

:info: You can also try HijackThis:
http://www.bleepingcomputer.com/download/hijackthis/
Save to a folder of its own on the Desktop. So, make a folder titled 'HijackThis' on the Desktop, and place HJT in it.
Right-click and select: Run as Administrator
Accept the License Agreement if you decide to run the program.

When the HijackThis console opens, press the following button: Do A system scan and save a logfile

When done scanning, a log opens in Notepad, and also appears on your Desktop.
:ar: Please post the HijackThis log in your reply.

When done, go back to the HijackThis program console, press: Config > Misc Tools > Open Uninstall Manager
Once the Add/Remove Program Manager list appears, click: Save list...
:ar: Please save to the Desktop, and post in your reply.

:info: Would also run HitmanPro.

:info: Last, but not least, in your shoes, I would clean up IE.

 

[GerryR]

Control Panel Windows 7 Home Premium may have been altered

I am afraid that Conduit may have altered my Windows 7 Home Premium Control Panel - All Control Panel Items which I have never changed. Googling has not produced results.

If anybody out there has Windows 7 Home Premium, would you please copy your Control Panel All Items, turn it into a pdf file and mail it to ** REMOVED **. I'm really getting desperate!

Thank you,

GerryR

 

[cottonball]

Altered how?

Can you use the Snipping tool to provide a screenshot:

How to Use the Snipping Tool in Vista

 

[BlueGuy]

I'd like to thank Cottonball, I hate getting old, I had forgotten about HijackThis because it has been so long since I had to deal with such an infected machine, but look at what they say over at MG..

Gerry:
"EditorsNote: Hijack This is for advanced users. If you are not familiar with running processes on your computer as well as anything ever installed that could tie into your web browser, it will not be much help to you. Finally, Hijack This has been taken over by Trend Micro."

Download HijackThis - MajorGeeks

Look at the stats, d/l'd almost 7 million times!


They work closely with MG on updates and tutorials for their products, you'll find URLs embedded in the stat page that lead to the MG forums where the tutorials are. It might seem lazy but it would take me too long with these arthritic fingers to re-type what's already there.

Read, go slow, one step at a time and again, I wish you good luck, too bad I can't be there to walk you through it.

Brink: I hope I haven't stepped on any toes getting Gerry this info.

 

[cottonball]

@BlueGuy,

Version 1.99 of HijackThis was the last version Merijn (the author) released (I believe), then it went to TrendMicro. I am surprised MG is hosting the old version.

The one to download is version 2.04 or version 2.05Beta:
v2.04 Download Trend Micro HijackThis - MajorGeeks
v2.05 http://www.majorgeeks.com/files/details/trend_micro_hijackthis_beta.html

With all the Registry actions taken on this system, wouldn't be surprised if "Missing this or that" errors start showing up.

HijackThis does backups to use if something goes wrong after running it.
Which reminds me, it should be installed to its own folder!