Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This adware came bundled with some freeware I downloaded. It hijacked my home page and search engine. I have fixed both of those things, but still every time I open Chrome, it opens http://search.conduit.com/?ctid=CT3289847&SearchSource=48&CUI=UN27663547709134535&UM=2&sspv=TB_CH2:enter image description here in addition to the new tab page (which I have set as my home page)

What I have tried, to no avail:

  1. Following the instructions from How do I remove the Conduit toolbar that comes with µTorrent?, which sounded like a similar question (Basically deleting the .crx file and any registry item that pointed to the directory in which I found it)
  2. Removing any programs I didn't recognize
  3. Removing the freeware that installed the adware in the first place
  4. Manually changing my home page and default search provider
  5. Running: ADWCleaner, CCleaner, and Malware Bytes Anti-Malware

One more thing: I noticed that "search.conduit.com" is referenced several times in the file C:\Users\MattVS\AppData\Local\Google\Chrome\User Data\Default\Preferences. I have tried modifying this file, but I really don't know what I'm doing with it. I suspect that my changes to this file are being put back anyways.

What else can I do??

From that Preferences file I referenced, here are the two groups of text that mention "conduit" or "WhiteSmoke": conduit ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// whitesmoke2

EDIT: I deleted the Extensions folder per @Jason's suggestion. The folder was already empty before I deleted it, and the problem persists

EDIT: I tried reinstalling Chrome. This fixed the problem until I restarted the computer and the problem came back on my newly installed version of chrome (even though I was able to stop it from installing any extensions or changing any settings)

Here are the results from HijackThis. I don't see anything malicious, do you?: enter image description here enter image description here

EDIT: I downloaded autoruns and ran it. I used ctrl+F to search for "conduit" and "smoke" (up and down) and did not find anything. Anything else I should search for?

share|improve this question
    
the Spybot Immunization features block tens of thousands of bad/ad sites by adding a poisoned Hosts file entry (one that points to 127.0.0.1), so it may help. otherwise you can add an entry pointing search.conduit.com to 127.0.0.1. –  Frank Thomas Jul 17 '13 at 16:36
1  
@FrankThomas That won't solve the underlying issue, though, and it won't even stop the extra tab being opened in Chrome. ComboFix will almost certainly remove the infection that's causing the trouble; it's been my go-to tool for years in dealing with malware that nothing else will budge, and despite the warnings with which it's hedged around, I have never seen it destroy a Windows install except in cases where the machine was already so badly infected as to be unusable, and even then the data remained recoverable. –  Aaron Miller Jul 17 '13 at 17:05

3 Answers 3

Ah....YE OLDE WHITESMOKE.

I remove this sick little puppy almost daily with the help of hijack this. Do a scan in admin mode and remove the BHO related to whitesmoke.

Also I noticed the adware has a startup item so locate it with autoruns. Also, a THOROUGH scan with malwarebytes is probably in order and check DOUBLY that the program is removed from your programs list.

share|improve this answer
    
That sounds promising...can you define "BHO" and "autoruns" for me? –  Michael Jordan Jul 17 '13 at 18:48
    
I posted the log file from Hijack this. Do you see anything? –  Michael Jordan Jul 17 '13 at 19:00
    
The font is too small to read. The easiest way is to hit control + F and search for "whitesmoke" "conduit" etc and remove accordingly. BHO's are internet explorer specific modules designed to add extra features to the browser. You still need to remove them however. Autoruns is a program that lists startup entries that "autorun" when the PC boots. If your problem is still persistent after a reboot, you need to download autoruns (from sysinternals) and figure out where the program is hiding. –  Scandalist Jul 17 '13 at 19:08
    
I tried that, but Ctrl+F doesn't seem to do anything. If you right click on the image and hit "view image" or "open the image in a new tab" can you read it? I will try autoruns, although I didn't see anything under msconfig-->startup –  Michael Jordan Jul 17 '13 at 19:11
    
Yea, I don't see anything in that log file. Try autoruns, its not a native utility so you must download. Google "autoruns sysinternals" –  Scandalist Jul 17 '13 at 19:39
up vote 1 down vote accepted

It sounds like you have done all the right things to start, namely removing any programs you don't recognize, removing the unwanted extension, and fixing your default search provider and home page. Here are a couple more things to try:

Make sure you aren't signed into Chrome on any other infected machines. Your settings are probably synced between instances of Chrome wherever you are logged in, so your settings can be changed by any infected machine on which you are logged into Chrome.

Lastly, after you correct your homepage and search provider settings, look where it says "On startup" and make sure "Open a specific page or set of pages" is not marked and set to something like search.conduit.com enter image description here

share|improve this answer

I had to clean this out around 3 or 4 times last week.

The way I did this was to close Chrome and delete your C:\Users\{username}\AppData\Local\Google\Chrome\User Data\Default\Extensions folder.

This will remove all extensions from Chrome including these malware extensions.

After this reopen Chrome and go to Settings>Manage Search Engines and delete conduit and whitesmoke as well as any unwanted engines.

That fixed it for me.

share|improve this answer
    
That folder was already empty. I deleted it anyway, but that did not seem to help –  Michael Jordan Jul 17 '13 at 17:44
    
What about the search engines? Also it may seem a bit extreme but if you have chrome set to sync its not that bad deleting your Google AppData folder and reinstalling chrome then resyncing your settings etc. I know this tends to work for removing Babylon search –  Jason Bristol Jul 17 '13 at 17:48
    
I had already deleted unwanted search engines. They are still gone. I have not tried re-installing chrome, though. I will do that next –  Michael Jordan Jul 17 '13 at 17:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.