Conduit search engine virus + friends

[TheLee]

So I had this last month or something. I thought I got rid of it, but I recently noticed a Pup virus appear and it was rather determined to stay. So I started to follow some of the instruction on this site. Well, after removing some curious files, conduit has reappeared. 

 

Can anyone help me through this. Normally I can take care of a virus, but these new ones seem a bit more difficult. 

[AdvancedSetup]

Hello and

Please run the following steps and post back all the logs as ATTACHMENTS by clicking on the More Reply Options button.
Please don't put logs in code or quote tags or copy/paste them into your reply unless you're unable to attach them.
Please enable your system to show hidden files: How to see hidden files in Windows

P2P/Piracy Warning:

• If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
• Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
• If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.
  

STEP 01
Backup the Registry:
Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

• Please download ERUNT from one of the following links: Link1 | Link2 | Link3
• ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
• Double click on erunt-setup.exe to Install ERUNT by following the prompts.
• NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO.
• Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
• Choose a location for the backup.
  
  • Note: the default location is C:\Windows\ERDNT which is acceptable.
    

  [*]Make sure that at least the first two check boxes are selected. [*]Click on OK [*]Then click on YES to create the folder. [*]Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe
  

STEP 02
Please download RogueKiller and save it to your desktop.

You can check here if you're not sure if your computer is 32-bit or 64-bit

• RogueKiller 32-bit | RogueKiller 64-bit
• Quit all running programs.
• For Windows XP, double-click to start.
• For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
• Read and accept the EULA (End User Licene Agreement)
• Click Scan to scan the system.
• When the scan completes Close the program > Don't Fix anything!
• Don't run any other options, they're not all bad!!
• Post back the report which should be located on your desktop.
  

STEP 03
Please download Malwarebytes Anti-Rootkit from here

• Unzip the contents to a folder in a convenient location.
• Open the folder where the contents were unzipped and run mbar.exe
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
• When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt
  

STEP 04
Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next reply message
• When completed make sure to re-enable your antivirus
  

STEP 05
Please download AdwCleaner by Xplode to your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
• If prompted by the User Account Control click Yes to allow it to run.
• Under Actions click on the Delete button.
• Click OK on all prompts.
• You will be prompted to restart your computer. A text file will open after the restart.
• Please post the entire contents of that logfile to your next reply.
• You can find the logfile at C:\AdwCleaner[s1].txt where the number in brackets indicates how often it was run.
  

STEP 06


Please go here to run the online antivirus scannner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Click Start
• Make sure that the option Remove found threats is unticked
• Click on Advanced Settings and ensure these options are ticked:
  
  • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
    

  [*]Click Scan [*]Wait for the scan to finish [*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.
  

STEP 07
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.
  

 

[TheLee]

Hi and thank you. That was a lot of programs to run. Here are the results. RKreport0_S_08132013_225807.txtmbar-log-2013-08-13 (23-25-25).txtsystem-log.txtJRT.txtAdwCleaner5.txteset.txtAddition.txtFRST.txt

[TheLee]

PS: I also DL'd defender pro from a site because it sort of looked legit the way it was played off. Hopefully this will help get rid of that too. 

[AdvancedSetup]

No Defender Pro is another crap program.  Please uninstall it and do not install things not requested.

 

Please uninstall ALL versions of Java.  If at all possible you should try to use the computer without Java.  It is one of the most common means of allowing your computer to get infected.   If you really have to have Java make sure you always keep it up to date and uninstall older versions.

 

http://www.java.com

 

Java 7 Update 25
Java Auto Updater
Java™ 6 Update 31
Java™ 7 Update 1

 

You can uninstall the Pando Media Booster that is just a Peer2Peer downloader for games but once your game is installed and running you no longer need Pando and it actually sucks up resources and slows your system by uploading to others.

 

 

 

After you have uninstalled those please do the following.

 

Please download the attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST or FRST64 and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt). Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.
 

fixlist.txt

[TheLee]

I actually uninstall the defender program and it came back.

[AdvancedSetup]

Please run the requested items and post back the logs.

[TheLee]

Alright here is the results. Sorry I am trying to get java to work after uninstalling it as requested. 

[TheLee]

Sadly I needed java to attach files because of the button. Tried the old method and it loaded but didn't place it. Here is a C&P. 

 

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-08-2013

Ran by Owner at 2013-08-14 03:25:43 Run:1

Running from C:\Users\Owner\Desktop

Boot Mode: Normal

==============================================

 

C:\Users\Owner\AppData\Local\NDOORS\pynzokmm.dll => Moved successfully.

C:\Users\Owner\Downloads\Firefox_Setup.exe => Moved successfully.

C:\Users\Owner\Downloads\mozilla firefox setup.exe => Moved successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{82F75D72-34E2-4360-8F65-153419398F25} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{82F75D72-34E2-4360-8F65-153419398F25} => Key deleted successfully.

C:\Windows\System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => Moved successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows Defender\MP Scheduled Scan => Key deleted successfully.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\QuickScanner => Value deleted successfully.

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched => Value not found.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully.

HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key deleted successfully.

HKCR\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully.

HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully.

HKLM\Software\MozillaPlugins\@java.com/JavaPlugin => Key not found.

"C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll" => not found.

HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.25.2 => Key deleted successfully.

C:\Windows\SysWOW64\npDeployJava1.dll => Moved successfully.

HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2 => Key not found.

C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll not found.

HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin => Key deleted successfully.

C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll not found.

HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin => Key not found.

C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll not found.

C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll => Moved successfully.

C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll not found.

C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll not found.

C:\Windows\SysWOW64\npDeployJava1.dll not found.

HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\dkjaldeegndmngnahlmdbfnejdobkmil => Key deleted successfully.

"C:\Users\Owner\AppData\Local\CRE\dkjaldeegndmngnahlmdbfnejdobkmil.crx" => File/Directory not found.

 

==== End of Fixlog ====

[AdvancedSetup]

I don't know what you're talking about for Java.  Our site does not require Java to post.  I don't have Java installed and I post every day on the site.

JAVA = Evil {sooner or later you're going to get infected if you use Java} unless you're very diligent about keeping it up all the time.

 

Please run the following antivirus scanner.  Temporarily disable your antivirus when running this one.

 

 

1. Please download Dr.Web CureIt! antivirus and save it to your computer. The file size is in excess of 100MB
2. NOTE: Free usage of Dr.Web CureIt! for business purposes is illegal.
3. Internet Explorer may show a warning when downloading - the file is safe to download from the provided link.
4. Shutdown your antivirus to avoid any conflicts while scanning.
5. Once the scans have completed please re-enable your antivirus.
6. If using Malwarebytes Anti-Malware PRO you can right click over the tray icon and disable the Protection Modules
7. If needed you can also temporarily disable it from starting with Windows
8. Temporarily turn off any other security add-ons or applications you may also have.
9. Once you have downloaded Dr.Web CureIt! you should right click over it and choose Properties and verify it has a Digital Signature.
10. If it does not have a Digital Signature then do not run it.
11. Close all open programs including all Web browsers and then double-click on drweb-cureit.exe to start the installer.
12. You should have your User Account Control (UAC) enabled for improved security and which should then produce a dialog box asking for approval to run the installer.
13. Click on the Yes button to start the installer.
14. Click OK to scan your computer in the Enhanced Protection Mode
15. Click on the check box to agree to participate in their software improvement program.
16. Then if needed choose your Language by clicking on the small globe like icon in the upper right corner by the wrench.
17. Then click on the Continue button and then click on the Select objects for scanning link just below the "Start scanning" button.
18. Place a check mark on all the items except for Temporary files and System restore points - those items should not have a check mark on them.
19. Then click on the Start scanning button.
20. If a threat is found you can click on the Action column in the program.
21. Your options will be Cure or Ignore
22. If you see an item that you are absolutely sure is OK, then un-check the check box for that item, otherwise keep it on Cure.
23. Then click on the Neutralize button.
24. Once completed click on the green Open Report link. It will open the report in NOTEPAD
25. Save the report to your desktop. The report will be called Cureit.log
26. Close Dr.Web Cureit!
27. Reboot your computer to allow files that were in use to be moved/deleted during reboot.
28. After reboot, attach the log Cureit.log you saved previously in your next reply.
29. Re-Enable your antivirus and other security programs when all done.
    

 

[TheLee]

Sorry, thought it was java. Lol yeah I used to avoid it, but I have a couple of java based games. (Minecraft and Scrolls)

But it was actually this C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.95\PepperFlash\pepflashplayer.dll => Moved successfully. 

 

The attach button is pepperflash or flash. Bugged out my Chrome browser. Which is what I am using. I managed to fix it. 

 

Completed the scan with Dr. Web cureit and it said no threats detected, I didn't see a report button. 

[TheLee]

Apparently my flash player is all buggy now. Tried reinstalling but it seems to give me not loading shock wave player on some pages and the audio cuts out on flash players. 

 

Well besides where we left off. 

[AdvancedSetup]

Please try the following to remove and then reinstall Chrome
Manually uninstall Google Chrome in Windows

See the following to manually remove all versions of Flash prior to reinstalling Adobe Flash
Manually uninstall Flash

If you have issue getting Flash reinstalled then please review the help from here.
Flash Player installation issues
 
 
Let me  know if you're still having or showing the Conduit redirect after removing and reinstall Chrome and Flash.

[TheLee]

For uninstalling google, when I try to down load the remove.txt it says it failed and there is a server problem. I already uninstall all the flash player. That other program is still on my pc as well even though I uninstalled it. Defender Pro Quick Scanner.

[AdvancedSetup]

That's because junk programs like that are often difficult to remove.

 

Please see if you can just do a normal uninstall of Chrome without the advanced guide and see how that goes.

 

Then run the following software and we'll see about doing a forced removal of anything left over.

 

 

Please visit this webpage and read the ComboFix User's Guide:

• Once you've read the article and are ready to use the program you can download it directly from the link below.
• Important! - Please make sure you save combofix to your desktop and do not run it from your browser
• Direct download link for: ComboFix.exe
• Please make sure you disable your security applications before running ComboFix.
• Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
• Please attach that log file to your next reply.
• If needed the file can be located here:  C:\combofix.txt
• NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.
  

 

[TheLee]

Chrome is back up. But with Combofix I hit a snag. ComboFix appears to crash when it completes ComboFix is backing up the Windows Registry. I hear a chime and then it closes at completion of that. I never get the yes or no window.

[AdvancedSetup]

Are you sure you disabled your antivirus when you ran it?

 

 

Please disable your antivirus and run the JRT and AdwCleaner tools again and post back their logs.

[TheLee]

Before I saw this message I managed to get the program to run a bit farther. But Completed Stage 49 never ends. I left my machine alone for 3 hours at it. Still sitting there.

 

I don't have any anti virus running while running these programs.  Just finished the other 2 that you requested. JRT.txtAdwCleaner7.txt

[AdvancedSetup]

Try running the ESET scan again from STEP 6 and let's see if it can find something that might be stopping combofix.

[TheLee]

Alright, trying that now. Erunt never worked from the start but I skipped that since it was just a back up system. Could it be the same reason why it never worked? 

[AdvancedSetup]

Well that's even worse.  All that is doing is trying to backup the Registry Hives.  If that is failing too then you have something odd going on with this computer.

Getting late here so I'll check back on you tomorrow.

[TheLee]

Alright, night! 

 

Something for you to read when you check next.

 

I did have part of an old hard drive placed on this one because I had files I wished to keep from it. This may be what is causing the back up conflict. The old hard drive had died completed. Drive failure, but the techs in this hole in the wall computer store I go to managed to get my data and put it on this hard drive. But I am not certain if that was the problem with the back up. ESET is still running. Once it is complete I will try combofix again. 

[TheLee]

This is what pops up when I start my PC. 

 

Error saving file

C:\windows\erdnt\autobackup\8-15-2013\ security!

continue with the next file? 

 

[RegCreateKeyEx:5-Access is denied]

 

That pops up 5 times if I keep hitting yes. Then I get this: 

 

Error saving file

C:\windows\erdnt\autobackup\8-15-2013\users\00000001\ntuser.dat!

 

Continue with the next file? 

 

[RegCreateKeyEx:5-Access is denied]

 

Then it says the same but the file is 00000002\UsrClass.dat!

Then I click yes one last time and nothing else happens. 

[TheLee]

I did a little digging and remembering (had been a while since I had to roll up my sleeves and fight a virus). So I pulled up rkill and tried the programs again. It appears that the Adwcleaner was corrupting every time. You see there was no delete button. After Rkill the format of the program looked different. Here were the new results of this program. AdwCleanerS1.txt and then after I hit delete, AdwCleanerS2.txt. Also the erunt program stopped giving me errors or problems. So that is I guess resolved. Going to try combifix now. 

[AdvancedSetup]

The error from ERUNT is because you have a link in your START UP group for a backup.  This gets launched without Admin rights so it fails.  You can either modify the shortcut to have Admin rights or remove the shortcut and that should get rid of the error.

 

Please post the combofix log when ready.  As for the files from a failed drive there is no issue and it should not bother any programs aside from length of time to scan if there are a lot of them.