Conduit Search Engine Virus Windows RT

[Atomic Wanderer Chicken]

I inadvertently downloaded the Conduit search engine virus downloading a program. The conduit search engine got onto both my Windows 8.1 laptop and my Windows RT Asus tablet. I ran Malwarebytes on my laptop and got rid of it. However on my Asus Windows RT tablet, it put itself onto Internet Explorer. I reset my Internet Explorer on my Asus VivoRT tablet. Am I safe with Windows RT or should I remove everything and reinstall windows? I ran Windows defender multiple times and it found nothing.

[Atomic Wanderer Chicken]

Could someone please help? I reset Internet Explorer. Am I safe browsing on Windows RT after the conduit engine added itself, or should I completely reinstall remove everything and reinstall Windows?

[LimeMaster]

Scan your tablet using Recuse Disk 10:

http://support.kaspersky.co.uk/4162

 

Assuming your tablet let's you boot from a USB device, then it should work.

[Atomic Wanderer Chicken]

This is Windows RT though

[JustGeorge]

I don't think RT is vulnerable yet, but I might be wrong.

[Wapoz]

Wut?  How did this infect Windows RT?  I thought you couldn't install any x86 software, or anything for that matter that doesn't come from the windows store...

[Atomic Wanderer Chicken]

It put itself on Internet Explorer not Windows RT itself. I found the conduit engine search add on in the "manage add ons"

[JustGeorge]

It put itself on Internet Explorer not Windows RT itself.

But IE is part of RT.

[webdev511]

This is Windows RT though

So that would be the first ever WinRT malware I've ever heard of. If you're on 8.1 on both systems the reason your RT device is going to the bad home page, is because they are synced across devices. Just log all the way out/restart and reset your IE on your RT device.

[LimeMaster]

I forgot Windows RT was strict with third party solutions. You might want to try these steps to remove it manually:

http://blog.vilmatech.com/search-conduit-com-virus-help-remove-search-conduit-com-redirect-virus-thoroughly/

[Wapoz]

Actually, you should be fine.  I reread what you wrote, and you had mentioned you had 2 windows 8.1 machines- The browser settings from your laptop (favorites, homepage, default search engine) more than likely synched over to your Asus WinRT tablet.  Even with those settings changed, you should still be impervious to infection since you're on the ARM version of windows.

[Dot Matrix]

This doesn't make any sense... 

[Atomic Wanderer Chicken]

I reset IE already and its gone. The sync feature must be the reason conduit add on was also on my Windows RT tablet also

[_dandy_]

I'd like to know how it "put itself on IE".  Is this just some script?  It can't be some x86 executable as it wouldn't even have any way to run at all.

 

<edit>

Never mind.  Others are right, synced settings have probably caused this, as changing homepage and crap like that is one of its effects.  I'd say you probably never really had anything actually dangerous running on RT.

[Wapoz]

I'd like to know how it "put itself on IE".  Is this just some script?  It can't be some x86 executable as it wouldn't even have any way to run at all.

 

The virus itself didn't change anything on his WinRT machine.  Skydive synch across devices merely mirrored the homepage, search, and addon settings from the Laptop, since his laptop is most likely the main machine on his Microsoft account.  The changes for the most part are only superficial since the actual virus never installed on the RT tablet (and wouldn't be able to anyways).

[Atomic Wanderer Chicken]

It was the IE conduit add on that got onto my IE in Windows RT most likely because of the skydrive sync. Sorry for the confusion

[vcfan]

damnit, you know to use a VM when looking at porn.

[Atomic Wanderer Chicken]

I was downloading a iso burning tool which put conduit engine onto my laptop, which then synced the conduit IE add on to my IE on my Window RT tablet. So I think everything is fine

damnit, you know to use a VM when looking at porn.

[vcfan]

I was downloading a iso burning tool which put conduit engine onto my laptop, which then synced the conduit IE add on to my IE on my Window RT tablet. So I think everything is fine

I was just messing with you :)

[LimeMaster]

Porn comes on .iso's too! :shifty: :laugh:

 

Seriously but, I'm glad you got your issue sorted.

[Dot Matrix]

I was downloading a iso burning tool which put conduit engine onto my laptop, which then synced the conduit IE add on to my IE on my Window RT tablet. So I think everything is fine

You know Windows has ISO burning built right in since Windows 7? 

 

[Forjo]

You keep mentioning the "add-on". Did you happen to see the .dll or .ocx filename? Was it truly an add-in that installed, or just that your default search or home page was changed?

-Forjo

[Atomic Wanderer Chicken]

My laptop has Windows 8 and I must have forgotten

You know Windows has ISO burning built right in since Windows 7? 

[Atomic Wanderer Chicken]

I think it was the default search that was changed in matter of fact, not an add on

You keep mentioning the "add-on". Did you happen to see the .dll or .ocx filename? Was it truly an add-in that installed, or just that your default search or home page was changed?

-Forjo

[_dandy_]

I think it was the default search that was changed in matter of fact, not an add on

 

That's what I pointed out when I went back and edited my original post, after I realized it just synced those settings from your other infected box.  Again, your RT machine, in all likelihood, never had any malware's binaries running on it.