Malware Removal Advice (Entrusted Toolbar/Search.Conduit)

[JME2]

Malware Removal Advice (Entrusted Toolbar)

So I normally don't have any problems with Malware given I'm vigilant about running virus scans and watching what I download.

Last night was an exception as I accidentally downloaded Entrusted Toolbar with a piece of video software.

It installed itself into Firefox. A partial system restore appeared to remove it, but it was back this morning.

This time, I went into the control panel to remove it and Search.conduit.com, as the two are linked together as part of the download. I purged it from Firefox next and I'm also going to do a full Norton scan tonight.

My concern is that even thought it's not showing up anymore, am I doing enough? Are these steps enough to ensure my privacy hasn't been compromised?

I've read up and saw that it installs itself in browsers. I have Internet Explorer, but Firefox is my primary browser. I don't use IE because it crashes every time I try to load it. It doesn't look like it installed because the brief glimpse only shows the HP toolbar in the browser, not the ET toolbar.

If anyone's had experience with this piece of Malware or can recommend any additional steps (i.e. free Malware removal programs), I'd appreciate it.

Thanks guys.

[Mr Bean]

Funny enough I had to scrub this off 13 computers yesterday.
Conduit is not pure malware but it reads as malware because of how terribly it's coded and how often it kills IE just by being installed. Not on purpose but it fights IE for control to try change the browser settings to change the homepage every .5 seconds.

Get malwarebytes download the latest version, restart in safemode full scan and your done after removal.

[Edi]

Uninstall the software, then Ccleaner and Malwarebytes. You can also get rid of it on Firefox, by using the following procedure:

Download and install MozBackup, then do a backup of your profile where you only save bookmarks and possibly passwords. No extensions, no settings, nothing else. Make hidden files in the computer visible, go in and delete the entire %appdata%\Mozilla folder (Thunderbird puts its user data in a separate folder in %appdata%, Mozilla is all Firefox from what I've seen).

Restart Firefox. This recreates the Mozilla folder in %appdata% and creates a new profile from scratch. Now use Mozbackup to restore the bookmarks and other uncontaminated stuff. The new profile gets replaced, but since you only had uncontaminated stuff in the backup, the browser is clean on restart. You do have to fix all custom settings and reapply extensions, but shit happens sometimes.

In case you don't have a universal video file player, download and install VLC Media Player. I haven't found stuff yet that it can't play. There was one special case where midi files didn't work, but that computer was seven different ways of screwed up anyway, so could have been that.

[JME2]

I think Firefox will be fine without MozBackup. There were additional instructions for a manual removal.

I'll run MWB shortly. Still mulling over CCleaner.

Will keep you updated; thanks guys.

[Edi]

I think Firefox will be fine without MozBackup. There were additional instructions for a manual removal.

I'll run MWB shortly. Still mulling over CCleaner.

Will keep you updated; thanks guys.

It's still likely to leave all kinds of crap in your about:config file for Firefox unless there is a simple way to edit the relevant stuff out of there.

[JME2]

I think Firefox will be fine without MozBackup. There were additional instructions for a manual removal.

I'll run MWB shortly. Still mulling over CCleaner.

Will keep you updated; thanks guys.

It's still likely to leave all kinds of crap in your about:config file for Firefox unless there is a simple way to edit the relevant stuff out of there.

The man removal specified removing the extensions through FF. And the scans went through FF and didn't find anything.

The fact that no pop up adds, strange websites, or the reappearance of that toolbar have occurred is another good sign.

[Edi]

I think Firefox will be fine without MozBackup. There were additional instructions for a manual removal.

I'll run MWB shortly. Still mulling over CCleaner.

Will keep you updated; thanks guys.

It's still likely to leave all kinds of crap in your about:config file for Firefox unless there is a simple way to edit the relevant stuff out of there.

The man removal specified removing the extensions through FF. And the scans went through FF and didn't find anything.

The fact that no pop up adds, strange websites, or the reappearance of that toolbar have occurred is another good sign.

Even if you remove the extensions like that, it still leaves a lot of crap entries in the about:config file. Just type about:config to the address bar and then go check the entries, there will still be references. Since some of the stuff those would use has been removed, they don't do anything most of the time. There's still residual contamination, so it depends on just how clean an install of the browser do you want.

[JME2]

Yeah.

I went ahead and ran MozBackup.

I think it's safe to say this is the current state of my computer.

Thanks for all your help, guys.