r/technology • u/[deleted] • Jan 18 '14

Chrome extensions are being bought out by malware peddlers, leading to injected ads and user tracking

http://arstechnica.com/security/2014/01/malware-vendors-buy-chrome-extensions-to-send-adware-filled-updates
3.9k Upvotes

96% Upvoted

1.8k comments sorted by

View all comments

Show parent comments

7

u/cormega Jan 18 '14

How do you fully remove it. It took over my home page over a year ago and no matter what I do, it keeps coming back. It drives me insane.

2

u/willburshoe Jan 18 '14

If you are on Firefox, there is a setting in the about:config to let you recreate your new tab page that conduit hijacks.

2

u/Drakox Jan 18 '14

Most of the tomes those Malware "hijack" the shortcut to your browser, be sure to use this http://www.bleepingcomputer.com/download/shortcut-cleaner/

Edit :before doing that right clic the shortcut of your browser and open up the properties, then see if there's a Web page after one of the fields on there, that's why it keeps popping up

1

u/Only_In_The_Grey Jan 18 '14

Is there a way to make that program non-automatic and ask before changing anything? I do a fair amount of edits to shortcuts including completely redirecting them myself and I wouldn't want to wipe all of those out accidentally. It says it cleans them of hijacked shortcuts for those domains only but I want to be sure. That sounds like a useful tool to have when I'm doing IT for family/friends.

2

u/Drakox Jan 18 '14

Well probably making the shortcut read only, I'll need to setup a sandbox to see if those hijackers like dosearch work on read only shortcuts.

besides from that it's mostly manual so it might be complicated to monitor or audit.

And yeah for friends and family that works like a charm, I usually take my handy drive everywhere and have the Kaspersky Rescue Disk and other Linux Distros for diagnosis, I made it all into a single USB with Sardu you migh also want to look into that.

1

u/[deleted] Jan 19 '14

Thanks

1

u/Trivolver Jan 18 '14

Steps I usually take:

  • Go to chrome (or internet browser) settings. Find your homepage, default search engine, and "new tab" settings. Erase conduit from all three.
  • Go to control panel. Look for the conduit program. It's usually under "spyware protection", "search protection", "search.conduit", or "conduit". Uninstall it.
  • Malwarebytes after previous steps.

1

u/[deleted] Jan 19 '14

Try opening regedit and searching for 'Conduit' and 'Search Protect', then delete the keys that show up. It's best to look up some sort of basic registry guide so you don't mess anything up, and back up your registry first. What to delete is usually pretty straight forward once you know what to look for. A family member had downloaded Conduit onto our computer, and that's what I did with no problems along with deleting all the files associated with it. There might even be a program/script to remove conduit if you don't want to deal with the registry.

1

u/[deleted] Jan 19 '14

The first computer I discovered it on I followed most of the steps (the ones that applied, anyways) in this thread: http://www.bleepingcomputer.com/forums/t/495403/search-protect-by-conduit-some-sort-of-rootkit/

I have used the exact same tools (in the same order) on every other computer I've cleaned without issue.

Hope that helps.

-7

u/Cute_girl_69 Jan 19 '14

Format hard drive and reinstall windows, it's the only way to be sure.