Adware.Conduit on mac

[geezer2005]

Ive just downloaded malwarebytes, its scanning and comes up with Adware.Conduit. ( I believe this is what is redirecting all my searches to Yahoo?)

However, it is saying "Remedy Failed".

Does this mean malwarebytes can not remove this? Anyway I can remove this?

[alvarnell]

Well, that's a real oldie. Wonder if it's making a comeback?

Not sure why Malwarebytes is struggling with this, but here are some five year old instructions that were written by the original developer for Malwarebytes for Mac before it was a thing that may still work:

http://www.thesafemac.com/arg-conduit/

Be sure to write down anything you find and reply back here listing them in case there is something that can be done to fix the Remedy situation and to let us know if it fixed your issue.

[treed]

What version of Malwarebytes are you using? If you're not sure, open the Malwarebytes app, then choose About Malwarebytes from the Malwarebytes menu. (See the screenshot below.)

The current version is 3.7.34 at the time of this writing. If you have an older version, you need to update, as there were bugs in some older versions that could cause this problem. Choose the Check For Updates option in the same menu.

[geezer2005]

I have the latest version just checked. In fact I only purchased it yesterday.

I just scanned again, same result. Took a screenshot if it can help?

[adas]

 Hi @geezer2005,

We need to remove the extension manually if Mojave is your current OS.

Open finder, choose to go to folder from Go menu and copy paste below path

~/Library/Safari/Extensions

delete searchExt.safariextz and rescan the system.

More information on remedy failed for Mojave Users

https://forums.malwarebytes.com/topic/239276-rtprotectiondaemon-full-disk-access-on-mojave/?do=findComment&comment=1281018

 

 

[geezer2005]

10 minutes ago, adas said:

 Hi @geezer2005,

We need to remove the extension manually if Mojave is your current OS.

Open finder, choose to go to folder from Go menu and copy paste below path

~/Library/Safari/Extensions

delete searchExt.safariextz and rescan the system.

More information on remedy failed for Mojave Users

https://forums.malwarebytes.com/topic/239276-rtprotectiondaemon-full-disk-access-on-mojave/?do=findComment&comment=1281018

 

 

Hi, many thanks for the info.

It has removed and shows that its now "Clean". However, I am still getting redirected to Yahoo when searching!

Any ideas?

[alvarnell]

Open Safari Preferences to the Search tab and see if the "Search engine:" popup menu needs to be changed to whatever you normally use.

Edited April 28, 2019 by alvarnell

[geezer2005]

It says Google.

If I type a search in the google search bar, its ok. If I type in the browser bar, it then directs me to Yahoo.

[geezer2005]

Also my page just changed blank and advised me to update Flash.

I believe this is how it all started!

[geezer2005]

I think I have sorted it, i found DataTransportation 1.0. Removed it, all seems ok fingers crossed.

Pic below for your reference.

[treed]

We have seen numerous different adware apps with that same logo, but have not seen a copy of DataTransportation. If you would be willing to let me take a look at your browser history, so that we can identify where this came from, please let me know. Send me a private message here, by clicking my name or avatar at left, then clicking the Message button, and I'll send you instructions. It would also be helpful if you can identify a rough timeframe when the problem started, and which browser you use, so we can limit the amount of history data you'd need to share.

[treed]

On 4/27/2019 at 3:39 PM, geezer2005 said:

I just scanned again, same result. Took a screenshot if it can help?

I notice this is a Safari extension. Are you by any chance running macOS Mojave? If so, this is a problem caused by a bug in Mojave.

There is a new privacy feature in Mojave that prevents apps from being able to access certain data without explicit consent from the user. One of those protected locations is the Safari folder shown in the path in your screenshot.

In theory, this new feature in Mojave should prevent Malwarebytes from even knowing that Safari extension exists. (Fortunately, Mojave also prevents such Safari extensions from actually running, unless they've been given an exemption from Apple, so removing these isn't that important on Mojave.)

In practice, however, Mojave doesn't always behave this way. We don't really understand what causes it, but in some cases Malwarebytes for Mac is able to see extensions in that folder, but Mojave's protection remains intact enough that it's unable to remove them. In such a case, you'll see this error.

For more information, and a solution, see:

https://support.malwarebytes.com/docs/DOC-2873