Helping a friend remove a "conduit" trojan remnant remotely. His antivirus (MSE) caught it for the most part but there are still settings in browsers that i reset (search engine, home page) and found it on the startup menu in msconfig and disabled that listing etc etc etc, cleared registry, ipconfig- flushdns, release, renew...checked their router settings, firewall settings, ran antivirus multiple times.
The problem here is that when the remote machine is restarted and a NEW invitation is sent to me and I enter the correct password, it will not reconnect.
When the client runs the internet connection troubleshooter, they receive a message that "windows needs more information" to successfully fix/diagnose the problem.
What called the client's attention to a problem was that when their computer starts, an error msg states that it can't find a rundll Bin file. Running regedit and chasing the path produces nothing in the registry. A registry search (Find) for "conduit" "Conduit, Inc" etc etc produces no new results as I cleared them all in the first session. I also uninstalled all the remnant programs that conduit had downloaded. So upon restart, I don't think the trojan is being reactivated, but some setting is being applied in the Firewall (have tried disabling firewall, and changing network connection types... Home, Work and Public with firewall off) or Network settings (or their router?).
We have reset the router several times as well.
Any input would be very greatly appreciated. It seems like there is a setting being applied that prevents new Windows Remote Assistance connections. Perhaps changing a port number in a place that is obscured to me. I just don't know at this point.
The thing is that this is happening intermittently. One in five restarts will allow a successful Windows Remote Assistance connection. Easy connect is not available to us.
The client system is Windows 7 Home Premium and mine is Win 7 Pro.
For clarity, We are using Windows Remote Assistance, NOT Remote Desktop.
The problem here is that when the remote machine is restarted and a NEW invitation is sent to me and I enter the correct password, it will not reconnect.
When the client runs the internet connection troubleshooter, they receive a message that "windows needs more information" to successfully fix/diagnose the problem.
What called the client's attention to a problem was that when their computer starts, an error msg states that it can't find a rundll Bin file. Running regedit and chasing the path produces nothing in the registry. A registry search (Find) for "conduit" "Conduit, Inc" etc etc produces no new results as I cleared them all in the first session. I also uninstalled all the remnant programs that conduit had downloaded. So upon restart, I don't think the trojan is being reactivated, but some setting is being applied in the Firewall (have tried disabling firewall, and changing network connection types... Home, Work and Public with firewall off) or Network settings (or their router?).
We have reset the router several times as well.
Any input would be very greatly appreciated. It seems like there is a setting being applied that prevents new Windows Remote Assistance connections. Perhaps changing a port number in a place that is obscured to me. I just don't know at this point.
The thing is that this is happening intermittently. One in five restarts will allow a successful Windows Remote Assistance connection. Easy connect is not available to us.
The client system is Windows 7 Home Premium and mine is Win 7 Pro.
For clarity, We are using Windows Remote Assistance, NOT Remote Desktop.
Last edited:
My Computer
At a glance
Win 7 ProAMD Phenom II 960T8 Gb 1333MSI Cyclone Ti 550
- Computer type
- PC/Desktop
- Computer Manufacturer/Model Number
- Custom Build
- OS
- Win 7 Pro
- CPU
- AMD Phenom II 960T
- Motherboard
- GA 990FXA-UD3
- Memory
- 8 Gb 1333
- Graphics Card(s)
- MSI Cyclone Ti 550
- Sound Card
- Firewire to Presonus Firebox to Monitors
- Monitor(s) Displays
- Dual
- Hard Drives
- 128Gb SSD Samsung Sata III for Win 7
- PSU
- 500W Antec Earthwatt
- Antivirus
- MSE in 7
- Browser
- Chrome, IE 10
