MozillaZine

How did Conduit get installed?

User Help for Mozilla Firefox
rick7
 
Posts: 237
Joined: July 16th, 2005, 5:33 am

Post Posted November 25th, 2011, 2:28 pm

I just installed Firefox 8 and now I see that when I open up New Tab it loads something called conduit.com ready to be used as a search engine. Google is still my search engine in the toolbar, and Mozilla Firefox Start Page is still my home page under Tools | Options, but this is scary. Any idea how Conduit got installed, and how do I get rid of it? Thanks for any help.

DanRaisch
Moderator

User avatar
 
Posts: 107725
Joined: September 23rd, 2004, 8:57 pm
Location: Somewhere on the East Coast

Post Posted November 25th, 2011, 2:31 pm

1. From what URL did you download Firefox 8.0?
2. Did you install any extensions recently or any plug-ins like Flash, Java or anything of that sort?

rick7
 
Posts: 237
Joined: July 16th, 2005, 5:33 am

Post Posted November 25th, 2011, 2:53 pm

Thanks. I realized that I shouldn't have attributed it to installing Firefox 8, and that today I did install an Add-on to Thunderbird. I did get that add-on directly from addons.mozilla.org, so it should be copacetic but I'll have to investigate. In the meantime, any help uninstall this would be greatly appreciated. It's not installed as a toolbar but only as something that loads when I do New Tab. It also does NOT appear when I initially start Firefox. Thanks for any help.

JayhawksRock

User avatar
 
Posts: 8920
Joined: October 24th, 2010, 8:51 am

Post Posted November 25th, 2011, 2:59 pm

Conduit is a Trojan that Hijacks your search. It is disguised as a "Free" Toolbar
Remove from Firefox by
1. Open Firefox
2. On the address bar, type – about:config in the URL. Press Enter.
3. You will be warned about Warranty. Click on “I’ll be careful…”
4. On the Filter dialog box type – search.conduit
5. It will display all related entries. Right-click on Preferences Name and Reset

Sometimes installed without toolbar by sites that say like "Your flash is out of date..... click here to update. or some other Free offer

Edit: Also Delete your cookies or at least the ones you dont recognize.... Conduit leaves a tracking cookie.
Last edited by JayhawksRock on November 25th, 2011, 3:15 pm, edited 1 time in total.
"Computers make it easier to do a lot of things, but most of the things they make it easier to do don't need to be done." ~ Andy Rooney

LoudNoise
Moderator

User avatar
 
Posts: 39105
Joined: October 18th, 2007, 1:45 pm
Location: Next door to the west

Post Posted November 25th, 2011, 3:14 pm

What was the extension?
Post wrangler
“It's tough to make predictions, especially about the future.”
― Yogi Berra

rick7
 
Posts: 237
Joined: July 16th, 2005, 5:33 am

Post Posted November 25th, 2011, 3:21 pm

I was initially a bit hesitant to mention it because I'm not at all positive this was the culprit but it's called TBDialOut and is at https://addons.mozilla.org/en-US/thunde ... tbdialout/. I will follow the above directions to remove it. I have NoScript so at least Firefox didn't run any scripts from the web site. Thank you.

Edit: I reset all the config entries that contained search.conduit (about four or five) but it's still happening. I then searched for just the string 'conduit' in about: config and I see there are now about 50 entries containing either conduit.com or conduit-services.com. About half of these have Preference Name beginning with CTnnnnn and the other half begin with CommunityToolbar...'. Help is appreciated.

KWierso
 
Posts: 8813
Joined: May 7th, 2006, 10:29 pm
Location: California

Post Posted November 25th, 2011, 4:34 pm

Reset all of those, then restart the browser.

KWierso
 
Posts: 8813
Joined: May 7th, 2006, 10:29 pm
Location: California

Post Posted November 25th, 2011, 4:38 pm

I just looked through the code in that extension (which is for thunderbird?), but I don't see any references to "conduit" in there...

rick7
 
Posts: 237
Joined: July 16th, 2005, 5:33 am

Post Posted November 25th, 2011, 4:44 pm

(1) Doing that right now... There are a few entries whose value is 'ConduitIntegration'. I should reset those also, yes?

(2) Considering that NoScript should have blocked any scripts from running from conduit.com, how important would you say it is for me to delete cookies? The idea of deleting all my cookies (with all my logons and preferences) is not an easy thought -- but of course I'll do it if it's necessary to get rid of this.

Thank you VERY much.

P.S. Yes, that's a Thunderbird extension, so... at this point I just am not sure how I got this...

rick7
 
Posts: 237
Joined: July 16th, 2005, 5:33 am

Post Posted November 25th, 2011, 4:50 pm

Eighteen of the about:config entries have a Preference Name whose name includes the string 'conduit.com' or 'conduit-services.com'. Can/should these be simply deleted?

KWierso
 
Posts: 8813
Joined: May 7th, 2006, 10:29 pm
Location: California

Post Posted November 25th, 2011, 4:54 pm

If you reset them to default (with the extension that created those entries disabled/uninstalled), they should disappear the next time you restart Firefox.

rick7
 
Posts: 237
Joined: July 16th, 2005, 5:33 am

Post Posted November 25th, 2011, 5:29 pm

Yes! All those about:config entries deleted when I restarted, and now no entries contain the string 'conduit'. I also deleted all cookies with 'conduit.com' or 'conduit-services.com' in their name. Doing New Tab now gives me a big ole beautiful blank page. Do you think I'm ok now? Should I consider combing through other cookies, or deleting all cookies to be safe, or...?

I'm curious if a computer-wide malware scan would reveal anything.

Thank you VERY much. I may never know exactly what happened...

L.A.R. Grizzly

User avatar
 
Posts: 4721
Joined: March 15th, 2005, 5:32 pm
Location: Akron, Ohio, USA

Post Posted November 25th, 2011, 6:59 pm

rick7 wrote:Yes! All those about:config entries deleted when I restarted, and now no entries contain the string 'conduit'. I also deleted all cookies with 'conduit.com' or 'conduit-services.com' in their name. Doing New Tab now gives me a big ole beautiful blank page. Do you think I'm ok now? Should I consider combing through other cookies, or deleting all cookies to be safe, or...?

I'm curious if a computer-wide malware scan would reveal anything.

Thank you VERY much. I may never know exactly what happened...


Just to be safe, you should check the about:config in Thunderbird for conduit entries as well.
Win7 Pro SP1 64 Bit
Comodo Internet Security
Firefox 39.0, Thunderbird 38.1.0 and SeaMonkey 2.33.1

rick7
 
Posts: 237
Joined: July 16th, 2005, 5:33 am

Post Posted November 25th, 2011, 7:44 pm

Thanks; there's nothing in Thunderbird's about:config for 'conduit'.

I'm curious: would you expect this kind of trojan to show up in a general anti-virus scan on the computer, or is it limited in effect to the web browser?

Frank Lion

User avatar
 
Posts: 17612
Joined: April 23rd, 2004, 6:59 pm
Location: ... The Exorcist... United Kingdom

Post Posted November 25th, 2011, 7:53 pm

rick7 wrote:... at this point I just am not sure how I got this...

You have Hotspot Shield?
Metal Lion latest Firefox Themes -Tiger SP, Tiger, Graphite, Australis
"The only thing necessary for the triumph of evil, is for good men to do nothing." - Edmund Burke (attrib.)

Return to Firefox Support


Who is online

Users browsing this forum: Agozer, DanRaisch, Google Adsense [Bot] and 18 guests