Friday
2011-05-25, 17:04
The following instructions have been created to help you to get rid of "Conduit.PriceGong" manually.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Categories:
pups
Description:
Conduit.PriceGong is a toolbars powered by Conduit. Uninstall does not remove operational toolbar components for Mozilla Firefox and Google Chrome. Userbenefit is questioned.
Removal Instructions:
Installed Software List:
You can try to uninstall products with the names listed below; for items identified by other properties or to avoid malware getting active again on uninstallation, use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) or RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) to locate and get rid of these entries.
Products that have a key or property named "PriceGong".
Products that have a key or property named "PriceGongbar Toolbar".
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\chrome\pricegongbar.jar".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\install.rdf".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\setup.ini".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\version.txt".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome.manifest".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\options.js".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\options.xul".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\overlay.js".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\PriceGong.png".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\pricegong.xul".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale\en-US\overlay.dtd".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale\en-US\pricegong.dtd".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\skin\overlay.css".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\components\pg_inst.txt".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\components\PriceGong.xpt".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\components\PriceGongFF.dll".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\install.rdf".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\modules\Observers.js".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\modules\pricegong.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_19_283_CT2832419_Images_634244704299731250_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_19_283_CT2832419_Images_634250628440006250_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_19_283_CT2832419_Images_Email_xml-6-Classic-634244707067075000_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_19_283_CT2832419_Images_Weather_xml-11-Classic-634244707246137500_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_About_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Browse_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Contact_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Hide_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_LikeIcon_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_More_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_MoreFromPublisher_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Options_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Privacy_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Refresh_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Share_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___Storage_conduit_com_BankImages_ConduitEngine_ContextMenu_Upgrade_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_BankImages_Dsilkset_television_add_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Events_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_BankImages_Facebook_facebook_icon_1_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Friends_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Groups_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Home_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Inbox_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Logout_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Photos_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Profile_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Settings_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Share_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Status_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_ClientImages_radio_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_bullet_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_france_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_Germany_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_holland_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_italy_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_spain_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_uk_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_usa_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_about_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_clear_history_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_contact_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_help_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_home_page_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_options_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_privacy_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_refresh_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_shrink_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_tell_a_friend_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_upgrade_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_SearchEngines_images_search_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_SearchEngines_news_icon_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_searchengines_search_icon_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_SearchEngines_site_search_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_searchengines_softonic_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_SearchEngines_tfd_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_SearchEngines_video_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_MarketPlace_2e_33e_2ec9e65c-72a4-4035-8a0e-06a6f1e0533e_Appearance_634179333047193753_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_MarketPlace_9b_1c5_9b145804-a2fe-4b13-aa3d-2a7d0d2e71c5_Appearance_634045313698673754_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\AddedAppDialog\app-added.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\AddedAppDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DefualtImages\icon.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DetectedAppDialog\app-2go.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DetectedAppDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DialogsAPI.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\EngineFirstTimeDialog\EngineFirstTimeDialog.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\EngineFirstTimeDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\EngineFirstTimeDialog\right-click.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\excanvas.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\generalDialogStyle.css".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\PIE.htc".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\RoundedCorners.css".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\RoundedCornersIE9.css".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\Images\info.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\Images\ok.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\Images\ok-on.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\SearchProtector.css".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\SearchProtector.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\settings.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\app-store-icon.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\arrow.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\divider.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\emailNotifier.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\facebook.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\radio.GIF".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\Thumbs.db".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\truste_welcome.GIF".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\weather.GIF".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\ToolbarFirstTimeDialog.css".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\ToolbarFirstTimeDialog.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarUntrustedAppsApprovalDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarUntrustedAppsApprovalDialog\ToolbarUntrustedAppsApprovalDialog.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAddedAppDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAddedAppDialog\UT-app-dialog-added.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppApprovalDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppApprovalDialog\UT-app-dialog-needs-your-approval.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppPendingDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppPendingDialog\UT-app-dialog-is-waiting.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\version.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\AccountTypes.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\aol.com.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\comcast.net.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\google.com.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\hotmail.com.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\yahoo.com.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=GottenApps&locale=en.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=OtherApps&locale=en.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=SharedApps&locale=en.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=Toolbar&locale=en.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\RadioPlayer\IP_Stations_Media_List.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\RadioPlayer\Predefined_Media_List.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\AppsMetaData\data.bck.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\AppsMetaData\data.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\DynamicDialogs\data.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\ToolbarLogin\data.bck.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\ToolbarLogin\data.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\ToolbarSettings\data.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_en\ToolbarTranslation\data.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\SearchInNewTab\SearchInNewTabContent.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\tbPri0.dll".
The file at "<$LOCALAPPDATA>\PriceGongbar\ThirdPartyComponents.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\toolbar.cfg".
The file at "<$LOCALSETTINGS>\Temp\{}\META-INF\manifest.mf".
The file at "<$LOCALSETTINGS>\Temp\{}\META-INF\zigbert.rsa".
The file at "<$LOCALSETTINGS>\Temp\{}\META-INF\zigbert.sf".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\chrome.manifest".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\chrome\pricegongbar.jar".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\alertSettingsComponent.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\appContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\engineContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\engineSettings.json".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\fbAlert.js".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\getAppsContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\postAppsContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\toolbarContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\unsharedAppsContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\install.rdf".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\lib\xpcom.js".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\META-INF\manifest.mf".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\META-INF\zigbert.rsa".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\META-INF\zigbert.sf".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\version.txt".
The file at "<$LOCALSETTINGS>\Temp\PriceGongbar.exe".
The file at "<$PROGRAMFILES>\PriceGong\2.2.0\PriceGongIE.dll".
The file at "<$PROGRAMFILES>\PriceGong\uninst.exe".
The file at "<$PROGRAMFILES>\PriceGongbar\GottenAppsContextMenu.xml".
The file at "<$PROGRAMFILES>\PriceGongbar\INSTALL.LOG".
The file at "<$PROGRAMFILES>\PriceGongbar\OtherAppsContextMenu.xml".
The file at "<$PROGRAMFILES>\PriceGongbar\PriceGongbarToolbarHelper.exe".
The file at "<$PROGRAMFILES>\PriceGongbar\PriceGongbarToolbarHelper1.exe".
The file at "<$PROGRAMFILES>\PriceGongbar\prxtbPri0.dll".
The file at "<$PROGRAMFILES>\PriceGongbar\SharedAppsContextMenu.xml".
The file at "<$PROGRAMFILES>\PriceGongbar\tbPri0.dll".
The file at "<$PROGRAMFILES>\PriceGongbar\tbPri1.dll".
The file at "<$PROGRAMFILES>\PriceGongbar\tbPric.dll".
The file at "<$PROGRAMFILES>\PriceGongbar\toolbar.cfg".
The file at "<$PROGRAMFILES>\PriceGongbar\ToolbarContextMenu.xml".
The file at "<$PROGRAMFILES>\PriceGongbar\uninstall.exe".
The file at "<$PROGRAMFILES>\PriceGongbar\UNWISE.EXE".
Make sure you set your file manager to display hidden and system files. If Conduit.PriceGong uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) to remove them.
Folders:
Please use Windows Explorer or another file manager of your choice to locate and delete these folders.
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\chrome".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\defaults".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale\en-US".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\skin".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\components".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\modules".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}".
The directory at "<$APPDATA>\PriceGong\Data".
The directory at "<$APPDATA>\PriceGong".
The directory at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\AddedAppDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DefualtImages".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DetectedAppDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\EngineFirstTimeDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\Images".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarUntrustedAppsApprovalDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAddedAppDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppApprovalDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppPendingDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs".
The directory at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier".
The directory at "<$LOCALAPPDATA>\PriceGongbar\ExternalComponent".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Logs".
The directory at "<$LOCALAPPDATA>\PriceGongbar\RadioPlayer".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\AppsMetaData".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\DynamicDialogs".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\ToolbarLogin".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\ToolbarSettings".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_en\ToolbarTranslation".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_en".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository".
The directory at "<$LOCALAPPDATA>\PriceGongbar\SearchInNewTab".
The directory at "<$LOCALAPPDATA>\PriceGongbar".
The directory at "<$LOCALSETTINGS>\Temp\{}\META-INF".
The directory at "<$LOCALSETTINGS>\Temp\{}\toolbar\chrome".
The directory at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults".
The directory at "<$LOCALSETTINGS>\Temp\{}\toolbar\lib".
The directory at "<$LOCALSETTINGS>\Temp\{}\toolbar\META-INF".
The directory at "<$LOCALSETTINGS>\Temp\{}\toolbar".
The directory at "<$PROGRAMFILES>\PriceGong\2.2.0".
The directory at "<$PROGRAMFILES>\PriceGong".
The directory at "<$PROGRAMFILES>\PriceGongbar".
Make sure you set your file manager to display hidden and system files. If Conduit.PriceGong uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!
Registry:
You can use regedit.exe (included in Windows) to locate and delete these registry entries.
A key in HKEY_CLASSES_ROOT\ named "PriceFactorIE.PriceGongBHO.*", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "PriceFactorIE.PriceGongBHO", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "PriceGongIE.PriceGongCtrl.*", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "PriceGongIE.PriceGongCtrl", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "Toolbar.CT2832419", plus associated values.
Delete the registry key "{0C5F997D-F664-4AFB-9652-EA7FD92F383D}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{0c5f997d-f664-4afb-9652-ea7fd92f383d}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\".
Delete the registry key "{0F226142-0534-44BF-B190-44E0F8B074A7}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\".
Delete the registry key "{1631550F-191D-4826-B069-D9439253D926}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{1631550F-191D-4826-B069-D9439253D926}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\".
Delete the registry key "{30F9B915-B755-4826-820B-08FBA6BD249D}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\".
Delete the registry key "{379FDD1D-E873-4882-820A-3C0A1C37AECC}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{835315FC-1BF6-4CA9-80CD-F6C158D40692}" at "HKEY_CLASSES_ROOT\AppID\".
Delete the registry key "{8B3372D0-09F0-41A5-8D9B-134E148672FB}" at "HKEY_CLASSES_ROOT\TypeLib\".
Delete the registry key "{afdbddaa-5d3f-42ee-b79c-185a7020515b}" at "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\".
Delete the registry key "{B7BB906C-FFFC-44B1-A449-9258AE9315A8}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\".
Delete the registry key "{D2A2595C-4FE4-4315-AA9B-19DBD6271B71}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "PriceGong" at "HKEY_CURRENT_USER\Software\".
Delete the registry key "PriceGongbar" at "HKEY_CURRENT_USER\Software\".
Delete the registry key "PriceGongbar" at "HKEY_LOCAL_MACHINE\SOFTWARE\".
Delete the registry key "PriceGongIE.DLL" at "HKEY_CLASSES_ROOT\AppID\".
Delete the registry value "{0c5f997d-f664-4afb-9652-ea7fd92f383d}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\".
Delete the registry value "{30F9B915-B755-4826-820B-08FBA6BD249D}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\".
If Conduit.PriceGong uses rootkit technologies, use our RegAlyzer (http://www.safer-networking.org/index.php?page=regalyzer), RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
Browser:
The following browser plugins or items can either be removed directly in your browser, or through the help of e.g. Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) or RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer).
Please check your bookmarks for links to "search.conduit.com".
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.
There are more files or system entries belonging to this product that <$SPYBOTSD> can remove, but that cannot be easily described in text. Please use <$SPYBOTSD> to make sure <$PRODUCTNAME> gets completely removed.
Use this guide at your own risk; software should usually be better suited to remove malware, since it is able to look deeper.
If this guide was helpful to you, please consider donating towards this site (http://www.safer-networking.org/index.php?page=donate).
Threat Details:
Categories:
pups
Description:
Conduit.PriceGong is a toolbars powered by Conduit. Uninstall does not remove operational toolbar components for Mozilla Firefox and Google Chrome. Userbenefit is questioned.
Removal Instructions:
Installed Software List:
You can try to uninstall products with the names listed below; for items identified by other properties or to avoid malware getting active again on uninstallation, use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) or RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer) to locate and get rid of these entries.
Products that have a key or property named "PriceGong".
Products that have a key or property named "PriceGongbar Toolbar".
Files:
Please use Windows Explorer or another file manager of your choice to locate and delete these files.
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\chrome\pricegongbar.jar".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\install.rdf".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\setup.ini".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\version.txt".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome.manifest".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\options.js".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\options.xul".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\overlay.js".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\PriceGong.png".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content\pricegong.xul".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale\en-US\overlay.dtd".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale\en-US\pricegong.dtd".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\skin\overlay.css".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\components\pg_inst.txt".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\components\PriceGong.xpt".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\components\PriceGongFF.dll".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\install.rdf".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\modules\Observers.js".
The file at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\modules\pricegong.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_19_283_CT2832419_Images_634244704299731250_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_19_283_CT2832419_Images_634250628440006250_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_19_283_CT2832419_Images_Email_xml-6-Classic-634244707067075000_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_19_283_CT2832419_Images_Weather_xml-11-Classic-634244707246137500_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_About_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Browse_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Contact_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Hide_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_LikeIcon_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_More_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_MoreFromPublisher_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Options_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_Conduit_com_bankImages_ConduitEngine_ContextMenu_Privacy_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Refresh_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_ConduitEngine_ContextMenu_Share_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___Storage_conduit_com_BankImages_ConduitEngine_ContextMenu_Upgrade_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_BankImages_Dsilkset_television_add_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Events_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_BankImages_Facebook_facebook_icon_1_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Friends_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Groups_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Home_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Inbox_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Logout_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Photos_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Profile_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Settings_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Share_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_bankImages_FaceBook_Status_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_ClientImages_radio_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_bullet_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_france_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_Germany_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_holland_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_italy_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_spain_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_uk_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_icons_flags_usa_flag_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_about_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_clear_history_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_contact_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_help_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_home_page_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_options_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_privacy_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_refresh_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_shrink_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_tell_a_friend_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_main_menu_upgrade_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_SearchEngines_images_search_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_SearchEngines_news_icon_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_searchengines_search_icon_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_SearchEngines_site_search_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_searchengines_softonic_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_SearchEngines_tfd_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_images_SearchEngines_video_gif.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_MarketPlace_2e_33e_2ec9e65c-72a4-4035-8a0e-06a6f1e0533e_Appearance_634179333047193753_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons\http___storage_conduit_com_MarketPlace_9b_1c5_9b145804-a2fe-4b13-aa3d-2a7d0d2e71c5_Appearance_634045313698673754_png.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\AddedAppDialog\app-added.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\AddedAppDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DefualtImages\icon.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DetectedAppDialog\app-2go.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DetectedAppDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DialogsAPI.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\EngineFirstTimeDialog\EngineFirstTimeDialog.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\EngineFirstTimeDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\EngineFirstTimeDialog\right-click.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\excanvas.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\generalDialogStyle.css".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\PIE.htc".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\RoundedCorners.css".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\RoundedCornersIE9.css".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\Images\info.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\Images\ok.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\Images\ok-on.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\SearchProtector.css".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\SearchProtector.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\settings.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\app-store-icon.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\arrow.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\divider.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\emailNotifier.gif".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\facebook.png".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\radio.GIF".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\Thumbs.db".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\truste_welcome.GIF".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images\weather.GIF".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\ToolbarFirstTimeDialog.css".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\ToolbarFirstTimeDialog.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarUntrustedAppsApprovalDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarUntrustedAppsApprovalDialog\ToolbarUntrustedAppsApprovalDialog.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAddedAppDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAddedAppDialog\UT-app-dialog-added.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppApprovalDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppApprovalDialog\UT-app-dialog-needs-your-approval.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppPendingDialog\main.html".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppPendingDialog\UT-app-dialog-is-waiting.js".
The file at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\version.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\AccountTypes.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\aol.com.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\comcast.net.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\google.com.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\hotmail.com.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier\yahoo.com.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=GottenApps&locale=en.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=OtherApps&locale=en.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=SharedApps&locale=en.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\ExternalComponent\http___contextmenu_toolbar_conduit-services_com__name=Toolbar&locale=en.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\RadioPlayer\IP_Stations_Media_List.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\RadioPlayer\Predefined_Media_List.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\AppsMetaData\data.bck.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\AppsMetaData\data.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\DynamicDialogs\data.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\ToolbarLogin\data.bck.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\ToolbarLogin\data.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\ToolbarSettings\data.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_en\ToolbarTranslation\data.txt".
The file at "<$LOCALAPPDATA>\PriceGongbar\SearchInNewTab\SearchInNewTabContent.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\tbPri0.dll".
The file at "<$LOCALAPPDATA>\PriceGongbar\ThirdPartyComponents.xml".
The file at "<$LOCALAPPDATA>\PriceGongbar\toolbar.cfg".
The file at "<$LOCALSETTINGS>\Temp\{}\META-INF\manifest.mf".
The file at "<$LOCALSETTINGS>\Temp\{}\META-INF\zigbert.rsa".
The file at "<$LOCALSETTINGS>\Temp\{}\META-INF\zigbert.sf".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\chrome.manifest".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\chrome\pricegongbar.jar".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\alertSettingsComponent.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\appContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\engineContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\engineSettings.json".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\fbAlert.js".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\getAppsContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\postAppsContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\toolbarContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults\unsharedAppsContextMenu.xml".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\install.rdf".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\lib\xpcom.js".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\META-INF\manifest.mf".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\META-INF\zigbert.rsa".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\META-INF\zigbert.sf".
The file at "<$LOCALSETTINGS>\Temp\{}\toolbar\version.txt".
The file at "<$LOCALSETTINGS>\Temp\PriceGongbar.exe".
The file at "<$PROGRAMFILES>\PriceGong\2.2.0\PriceGongIE.dll".
The file at "<$PROGRAMFILES>\PriceGong\uninst.exe".
The file at "<$PROGRAMFILES>\PriceGongbar\GottenAppsContextMenu.xml".
The file at "<$PROGRAMFILES>\PriceGongbar\INSTALL.LOG".
The file at "<$PROGRAMFILES>\PriceGongbar\OtherAppsContextMenu.xml".
The file at "<$PROGRAMFILES>\PriceGongbar\PriceGongbarToolbarHelper.exe".
The file at "<$PROGRAMFILES>\PriceGongbar\PriceGongbarToolbarHelper1.exe".
The file at "<$PROGRAMFILES>\PriceGongbar\prxtbPri0.dll".
The file at "<$PROGRAMFILES>\PriceGongbar\SharedAppsContextMenu.xml".
The file at "<$PROGRAMFILES>\PriceGongbar\tbPri0.dll".
The file at "<$PROGRAMFILES>\PriceGongbar\tbPri1.dll".
The file at "<$PROGRAMFILES>\PriceGongbar\tbPric.dll".
The file at "<$PROGRAMFILES>\PriceGongbar\toolbar.cfg".
The file at "<$PROGRAMFILES>\PriceGongbar\ToolbarContextMenu.xml".
The file at "<$PROGRAMFILES>\PriceGongbar\uninstall.exe".
The file at "<$PROGRAMFILES>\PriceGongbar\UNWISE.EXE".
Make sure you set your file manager to display hidden and system files. If Conduit.PriceGong uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify files!
Important: There are more files that cannot be safely described in simple words. Please use Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) to remove them.
Folders:
Please use Windows Explorer or another file manager of your choice to locate and delete these folders.
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\chrome".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}\defaults".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{0c5f997d-f664-4afb-9652-ea7fd92f383d}".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\content".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale\en-US".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\locale".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome\skin".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\chrome".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\components".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}\modules".
The directory at "<$APPDATA>\Mozilla\Firefox\Profiles\<$ENV(PriceGong_path)>\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}".
The directory at "<$APPDATA>\PriceGong\Data".
The directory at "<$APPDATA>\PriceGong".
The directory at "<$LOCALAPPDATA>\PriceGongbar\CacheIcons".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\AddedAppDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DefualtImages".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\DetectedAppDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\EngineFirstTimeDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog\Images".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\SearchProtectorDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog\images".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarFirstTimeDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\ToolbarUntrustedAppsApprovalDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAddedAppDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppApprovalDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs\UntrustedAppPendingDialog".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Dialogs".
The directory at "<$LOCALAPPDATA>\PriceGongbar\EmailNotifier".
The directory at "<$LOCALAPPDATA>\PriceGongbar\ExternalComponent".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Logs".
The directory at "<$LOCALAPPDATA>\PriceGongbar\RadioPlayer".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\AppsMetaData".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\DynamicDialogs".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\ToolbarLogin".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419\ToolbarSettings".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_CT2832419".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_en\ToolbarTranslation".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository\conduit_CT2832419_en".
The directory at "<$LOCALAPPDATA>\PriceGongbar\Repository".
The directory at "<$LOCALAPPDATA>\PriceGongbar\SearchInNewTab".
The directory at "<$LOCALAPPDATA>\PriceGongbar".
The directory at "<$LOCALSETTINGS>\Temp\{}\META-INF".
The directory at "<$LOCALSETTINGS>\Temp\{}\toolbar\chrome".
The directory at "<$LOCALSETTINGS>\Temp\{}\toolbar\defaults".
The directory at "<$LOCALSETTINGS>\Temp\{}\toolbar\lib".
The directory at "<$LOCALSETTINGS>\Temp\{}\toolbar\META-INF".
The directory at "<$LOCALSETTINGS>\Temp\{}\toolbar".
The directory at "<$PROGRAMFILES>\PriceGong\2.2.0".
The directory at "<$PROGRAMFILES>\PriceGong".
The directory at "<$PROGRAMFILES>\PriceGongbar".
Make sure you set your file manager to display hidden and system files. If Conduit.PriceGong uses rootkit technologies, use our RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
You will have to use a global search for files without a name specified. Be extra careful, because just the name might not be enough to identify folders!
Registry:
You can use regedit.exe (included in Windows) to locate and delete these registry entries.
A key in HKEY_CLASSES_ROOT\ named "PriceFactorIE.PriceGongBHO.*", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "PriceFactorIE.PriceGongBHO", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "PriceGongIE.PriceGongCtrl.*", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "PriceGongIE.PriceGongCtrl", plus associated values.
A key in HKEY_CLASSES_ROOT\ named "Toolbar.CT2832419", plus associated values.
Delete the registry key "{0C5F997D-F664-4AFB-9652-EA7FD92F383D}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{0c5f997d-f664-4afb-9652-ea7fd92f383d}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\".
Delete the registry key "{0F226142-0534-44BF-B190-44E0F8B074A7}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\".
Delete the registry key "{1631550F-191D-4826-B069-D9439253D926}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{1631550F-191D-4826-B069-D9439253D926}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\".
Delete the registry key "{30F9B915-B755-4826-820B-08FBA6BD249D}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\".
Delete the registry key "{379FDD1D-E873-4882-820A-3C0A1C37AECC}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "{835315FC-1BF6-4CA9-80CD-F6C158D40692}" at "HKEY_CLASSES_ROOT\AppID\".
Delete the registry key "{8B3372D0-09F0-41A5-8D9B-134E148672FB}" at "HKEY_CLASSES_ROOT\TypeLib\".
Delete the registry key "{afdbddaa-5d3f-42ee-b79c-185a7020515b}" at "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\".
Delete the registry key "{B7BB906C-FFFC-44B1-A449-9258AE9315A8}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\".
Delete the registry key "{D2A2595C-4FE4-4315-AA9B-19DBD6271B71}" at "HKEY_CLASSES_ROOT\CLSID\".
Delete the registry key "PriceGong" at "HKEY_CURRENT_USER\Software\".
Delete the registry key "PriceGongbar" at "HKEY_CURRENT_USER\Software\".
Delete the registry key "PriceGongbar" at "HKEY_LOCAL_MACHINE\SOFTWARE\".
Delete the registry key "PriceGongIE.DLL" at "HKEY_CLASSES_ROOT\AppID\".
Delete the registry value "{0c5f997d-f664-4afb-9652-ea7fd92f383d}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\".
Delete the registry value "{30F9B915-B755-4826-820B-08FBA6BD249D}" at "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\".
If Conduit.PriceGong uses rootkit technologies, use our RegAlyzer (http://www.safer-networking.org/index.php?page=regalyzer), RootAlyzer (http://forums.spybot.info/downloads.php?id=8) or our Total Commander anti-rootkit plugins (http://forums.spybot.info/downloads.php?id=3).
Browser:
The following browser plugins or items can either be removed directly in your browser, or through the help of e.g. Spybot-S&D (http://www.safer-networking.org/index.php?page=spybotsd) or RunAlyzer (http://www.safer-networking.org/index.php?page=runalyzer).
Please check your bookmarks for links to "search.conduit.com".
Final Words:
If neither Spybot-S&D nor self help did resolve the issue or you would prefer one on one help,
Please read these instructions (http://forums.spybot.info/showthread.php?t=288) before requesting assistance,
Then start your own thread in the Malware Removal Forum (http://forums.spybot.info/forumdisplay.php?f=22) where a volunteer analyst will advise you as soon as available.
There are more files or system entries belonging to this product that <$SPYBOTSD> can remove, but that cannot be easily described in text. Please use <$SPYBOTSD> to make sure <$PRODUCTNAME> gets completely removed.