Need help removing search.conduit from my system

[Realtor]

I tried several things none have worked. Why does virus and spyware not detect this malware? How can I remove it?http://forums.spybot.info/images/smilies/confused1.gif

[ken545]

Please read Before You Post
While best efforts are made to assist in removing infections safely, unexpected stuff can happen. It is advisable that you back up your important data before starting any clean up procedure. Neither Safer Networking Forums nor the Analyst providing the advice may be held responsible for any loss.

Until we deem your system clean I am going to ask you not to install or uninstall any software or hardware except for the programs we may run.

Running programs with Vista or Windows 7 , Right Click and select RUN AS ADMINISTATOR

Download DDS from one of the links below to your desktop

Link 1
Link 2

• Double click the tool to run it.
• A black Screen will open, just read the contents and do nothing.
• When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
• Copy/Paste the contents of 'DDS.txt' into your post.
• 'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)

Information on A/V control Here





Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan


On completion of the scan click save log, save it to your desktop and post in your next reply

[Realtor]

I have windows 8.1 and have not been able to get it to run as Administrator in order for the DDS program to run. Can you assist?

[ken545]

Lets try this one instead

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

[Realtor]

Results of the executing AdwCleaner.exe
# AdwCleaner v3.016 - Report created 27/12/2013 at 14:27:19
# Updated 23/12/2013 by Xplode
# Operating System : Windows 8.1 (64 bits)
# Username : Mack - WORKPC
# Running from : C:\Users\Mack\Desktop\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****

Service Found : CltMngSvc

***** [ Files / Folders ] *****

File Found : C:\Users\Public\Desktop\eBay.lnk
Folder Found C:\Program Files (x86)\Searchprotect
Folder Found C:\Users\Mack\AppData\Local\Searchprotect

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Found : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Found : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{DCABB943-792E-44C4-9029-ECBEE6265AF9}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Key Found : HKLM\Software\SearchProtect
Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16384


-\\ Mozilla Firefox v26.0 (en-US)

[ File : C:\Users\Mack\AppData\Roaming\Mozilla\Firefox\Profiles\o13s4y14.default\prefs.js ]


-\\ Google Chrome v31.0.1650.63

[ File : C:\Users\Mack\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [1660 octets] - [27/12/2013 14:27:19]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1720 octets] ##########

Thanks

Lets try this one instead

Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

[ken545]

Good Morning,

No need to quote me as some of the logs we may ask for maybe large and with a quote may not fit into a reply.

Where you able to run aswMBR, if so run it and post that log please

Then.....

Double click on AdwCleaner.exe to run the tool again.

• Click on the Scan button.
• AdwCleaner will begin to scan your computer like it did before.
• After the scan has finished...
• This time, click on the Clean button.
• Press OK when asked to close all programs and follow the onscreen prompts.
• Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
• After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
• Copy and paste the contents of that logfile in your next reply.
• A copy of that logfile will also be saved in the C:\AdwCleaner folder.

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

OTL by OldTimer

• Download OTL to your desktop.
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
• When the window appears, underneath Output at the top change it to Minimal Output.
• Click the "Scan All Users" checkbox.
• Check the boxes beside LOP Check and Purity Check.
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
    Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

[Realtor]

aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-12-28 10:49:53
-----------------------------
10:49:53.462 OS Version: Windows x64 6.2.9200
10:49:53.462 Number of processors: 2 586 0x200
10:49:53.465 ComputerName: WORKPC UserName: Mack
10:49:54.100 Initialze error 1
11:19:09.915 AVAST engine defs: 13122800
11:19:18.220 The log file has been saved successfully to "C:\Users\Mack\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-12-28 10:49:53
-----------------------------
10:49:53.462 OS Version: Windows x64 6.2.9200
10:49:53.462 Number of processors: 2 586 0x200
10:49:53.465 ComputerName: WORKPC UserName: Mack
10:49:54.100 Initialze error 1
11:19:09.915 AVAST engine defs: 13122800
11:19:18.220 The log file has been saved successfully to "C:\Users\Mack\Desktop\aswMBR.txt"
11:19:41.829 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000028
11:19:41.837 Disk 0 Vendor: HGST_HTS545032A7E380 GGBOACA0 Size: 305245MB BusType: 11
11:19:41.898 Disk 0 MBR read successfully
11:19:41.905 Disk 0 MBR scan
11:19:41.932 Disk 0 unknown MBR code
11:19:41.940 Disk 0 Partition 1 00 EE GPT 2097151 MB offset 1
11:19:41.957 Disk 0 scanning C:\WINDOWS\system32\drivers
11:19:41.968 Service scanning
11:19:42.523 Modules scanning
11:19:42.541 Disk 0 trace - called modules:
11:19:42.565 ntoskrnl.exe CLASSPNP.SYS disk.sys amdxata.sys storport.sys hal.dll amdsata.sys
11:19:42.584 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe000016ab5e0]
11:19:42.601 3 CLASSPNP.SYS[fffff80000646abb] -> nt!IofCallDriver -> [0xffffe000002e9b30]
11:19:42.617 5 amdxata.sys[fffff800007146b4] -> nt!IofCallDriver -> \Device\00000028[0xffffe0000139a060]
11:19:42.633 AVAST engine scan C:\WINDOWS
11:19:42.649 AVAST engine scan C:\WINDOWS\system32
11:19:42.666 AVAST engine scan C:\WINDOWS\system32\drivers
11:19:42.683 AVAST engine scan C:\Users\Mack
11:19:42.700 AVAST engine scan C:\ProgramData
11:19:42.717 Scan finished successfully
11:20:11.844 Disk 0 MBR fix error
11:20:41.924 Disk 0 MBR has been saved successfully to "C:\Users\Mack\Desktop\MBR.dat"
11:20:41.947 The log file has been saved successfully to "C:\Users\Mack\Desktop\aswMBR.txt"

[Realtor]

The resolution is as high as it will go. I tried lesser settings but still it does not display the post button. I have checked the help files on google and performed some of their suggestions but still nothing. Thanks

I have windows 8.1 and have not been able to get it to run as Administrator in order for the DDS program to run. Can you assist?

[ken545]

OK, thanks for letting me know

Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups, any programs that where not removed you can just drag to the trash.


Malwarebytes is the free version and yours to keep and will not be removed

• How did I get infected in the first place ?
  Read these links and find out how to prevent getting infected again.
• Tutorial for System Restore <-- Do this first to prevent yourself from being reinfected.
• WhattheTech
• Grinler BleepingComputer
• GeeksTo Go
• Dslreports

Safe Surfn
Ken